Bug 2523472

Summary:	CVE-2026-67214 frama-c: nanoid: Denial of Service via negative size input in non-secure module functions [fedora-all]
Product:	[Fedora] Fedora	Reporter:	Joel Chamberlain <jochambe>
Component:	frama-c	Assignee:	Jerry James <loganjerry>
Status:	CLOSED NOTABUG	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	high	Docs Contact:
Priority:	high
Version:	rawhide	CC:	Andre.MARONEZE, loganjerry
Target Milestone:	---	Keywords:	Security, SecurityTracking
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:	{"flaws": ["f541dbf1-ce45-491a-9832-abc0354b81a5"]}
Fixed In Version:		Doc Type:	---
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2026-08-25 14:35:51 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2508411

Description Joel Chamberlain 2026-08-25 14:33:27 UTC

Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

nanoid (Nano ID) before 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module (nanoid/non-secure). When these functions are given a negative size, the loop counter is decremented from a negative value and never reaches its termination condition, spinning indefinitely and hanging the calling thread. An application that passes an unvalidated, attacker-controlled negative size to these functions is exposed to a denial-of-service condition.

Comment 1 Jerry James 2026-08-25 14:35:51 UTC

The JavaScript code in the frama-c tarball is not used during the build and is not shipped in any binary RPM.  It is completely irrelevant as far as Fedora is concerned.  Please stop scanning it for vulnerabilities.  They don't matter to Fedora.