From 87387903aa47045c1d31e9c6e18d1685d9e592d1 Mon Sep 17 00:00:00 2001
From: Sizhe Zhao <prc.zhao@outlook.com>
Date: Tue, 31 Mar 2026 20:57:26 +0800
Subject: [PATCH] firewalld: fix CVE-2026-4948

---
 pkgs/by-name/fi/firewalld/package.nix | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/pkgs/by-name/fi/firewalld/package.nix b/pkgs/by-name/fi/firewalld/package.nix
index c8a900b678bc..e2f637639772 100644
--- a/pkgs/by-name/fi/firewalld/package.nix
+++ b/pkgs/by-name/fi/firewalld/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch2,
   autoconf,
   automake,
   docbook_xml_dtd_42,
@@ -60,6 +61,12 @@ stdenv.mkDerivation (finalAttrs: {
     ./specify-localedir.patch
 
     ./gettext-0.25.patch
+
+    # CVE-2026-4948: https://github.com/NixOS/nixpkgs/issues/505280
+    (fetchpatch2 {
+      url = "https://github.com/Prince213/firewalld/commit/e621b4b54be7cd8d77ce549ec17c6f814f9bd337.patch?full_index=1";
+      hash = "sha256-8auXNPVYnNk1UI0jM82IEQrMBhG189/I+DbaXt0VEhc=";
+    })
   ];
 
   postPatch = ''