Haskell's vulnerability footprint is concentrated in a narrow set of cryptographic, data-handling, and system-interface libraries such as hs-tls, aeson, xml-conduit, and the process library, reflecting the language ecosystem's exposure to input-parsing and resource-management challenges. The recurring weakness classes across these modules center on improper input validation, command injection, resource cleanup, encryption strength, and weak hash selection—issues typical of libraries that bridge Haskell's type safety with external data formats and system calls. Current severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Haskell over time
Signals from CVEs in this vendor scope (4 CVEs).
4 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2024-3566CRITICAL A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly depend on the CreateProcess function when the specific condit | Apr 10, 2024 | 9.8 | 33 | NO | NO |
CVE-2021-4249HIGH A vulnerability was found in xml-conduit. It has been classified as problematic. Affected is an unknown function of the file xml-conduit/src/Text/XML/Stream/Parse.hs of the compone | Dec 18, 2022 | 7.5 | 24 | NO | NO |
CVE-2022-3433MEDIUM The aeson library is not safe to use to consume untrusted JSON input. A remote user could abuse this flaw to produce a hash collision in the underlying unordered-containers library | Oct 10, 2022 | 6.5 | 23 | NO | NO |
CVE-2013-0243HIGH haskell-tls-extra before 0.6.1 has Basic Constraints attribute vulnerability may lead to Man in the Middle attacks on TLS connections | Dec 5, 2019 | 7.4 | 23 | NO | NO |
Signals from CVEs in this vendor scope (4 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Haskell.
Media articles that mention a CVE ID that affects a product developed by Haskell — matched by CVE ID, not by vendor name.