cabal-install uses expired key policies
Affects cabal-installSource GCVE Database
Rated High by Threat Radar's AI analysis
- Patch
- Available – fixed in 3.10.2.0
Data as of 13 Nov 2026, 18:40 UTC
What to do
Upgrade cabal-install to 3.10.2.0.
Patches and advisories
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Hackagecabal-install | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Users should upgrade to cabal-install version 3.10.2.0 or later, which contains a fix that enforces verification of the key policy file's expiration timestamp. Distributors of older versions have been contacted with patches.
Description
A vulnerability in cabal-install's implementation of the Hackage Security protocol caused it to skip verification of the key policy file's expiration timestamp. This flaw could allow an attacker with a revoked private key and the ability to perform a man-in-the-middle attack to deliver malicious packages. No operational keys have been revoked to date, so this remains a theoretical attack. The issue is fixed in cabal-install version 3.10.2.0.