What is "tmux"?

tmux source code

How to use this package

Quick install

Installs the package into the current environment for this session. Use --build or --runtime to persist it as a build-time or runtime dependency.

min add tmux

Declare as a task dependency in minimal.toml

Listing the package under tasks.<name>.packages makes it available inside that task’s sandbox.

[tasks.dev]
packages = ["tmux"]

Build-time vs runtime

Choose build-time for tools needed during compilation, runtime for dynamic libraries loaded at runtime.

min add --build tmux
min add --runtime tmux

Compare versions

to

Dependencies (12)

Dependencies
Name	Version	Kind
autoconf	2.73	build
automake	1.18.1	build
base	—	build
bison CVE:2	3.8.2	build
glibc	2.44	runtime
libevent CVE:1	2.1.13-stable	runtime
m4	1.4.21	build
make	4.4.1	build
ncurses	6.6	runtime
perl CVE:2	5.44.0	build
pkgconf	3.0.5	build
toolchain	—	build

Dependency changes

No dependants

No other packages in the registry depend on this one.

No direct advisories

This package inherits 9 transitive advisories from its dependencies.

Include transitive

Showing 9 transitive advisories via tmux's dependencies

Security advisories for this package
	Status	IDs	Package	Version	Severity	Published
Critical (2)
	Resolved in 2.1.13	GHSA-jcwh-pvf2-73p2 CVE-2026-63385	libevent	2.1.11 – 2.1.12, fixed in 2.1.13	Critical	2 months ago
Summary Libevent: HTTP header handling bugs create risk of access control bypass. Via libevent Affected ranges 2.1.11 – 2.1.12, fixed in 2.1.13 Fixed in 2.1.13 References Advisory: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63385.json, https://github.com/libevent/libevent/security/advisories/GHSA-jcwh-pvf2-73p2, https://nvd.nist.gov/vuln/detail/CVE-2026-63385 Fix: https://github.com/libevent/libevent/commit/758be0c0f69c1934ef9a84ab39e9f9e5fde2e6d0, https://github.com/libevent/libevent/commit/9170dd35e64714613e8d13b290587cfc28e258e2 Web: https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable, https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha
	Resolved in 2.1.13	GHSA-q39v-w2g7-gr8j CVE-2026-63382	libevent	2.1.11 – 2.1.12, fixed in 2.1.13	Critical	2 months ago
Summary libevent evhttp: Multiple HTTP Parser Bugs Enable Request Smuggling Via libevent Affected ranges 2.1.11 – 2.1.12, fixed in 2.1.13 Fixed in 2.1.13 References Advisory: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63382.json, https://github.com/libevent/libevent/security/advisories/GHSA-q39v-w2g7-gr8j, https://nvd.nist.gov/vuln/detail/CVE-2026-63382 Fix: https://github.com/libevent/libevent/commit/10abb34b8dc3e1184de315dd261ce4b77563cda6, https://github.com/libevent/libevent/commit/5119ceb00557bf007f9065709e852686f3c0bb6e, https://github.com/libevent/libevent/commit/83ba67373032334559b82409db035dd8c3cc1660, https://github.com/libevent/libevent/commit/ac38703b2d312200c4f967f02936af0118d384a0 Web: https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable, https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha
High (4)
	Status	IDs	Package	Version	Severity	Published
	Resolved in 2.1.13	GHSA-58rx-7448-jw47 CVE-2026-63387	libevent	2.1.11 – 2.1.12, fixed in 2.1.13	High: 7.0	2 months ago
Summary Libevent: Off-by-one stack buffer overflow in dnsname_to_labels via crafted DNS server response Via libevent Affected ranges 2.1.11 – 2.1.12, fixed in 2.1.13 Fixed in 2.1.13 CVSS vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H References Advisory: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63387.json, https://github.com/libevent/libevent/security/advisories/GHSA-58rx-7448-jw47, https://nvd.nist.gov/vuln/detail/CVE-2026-63387 Web: https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable, https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha
	Resolved in 2.1.13	GHSA-45c6-qx49-89m8 CVE-2026-63384	libevent	2.1.11 – 2.1.12, fixed in 2.1.13	High	2 months ago
Summary Libevent: `evtag_unmarshal_header()` decodes a wire `uint32` length into a signed `int` return value. Via libevent Affected ranges 2.1.11 – 2.1.12, fixed in 2.1.13 Fixed in 2.1.13 References Advisory: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63384.json, https://github.com/libevent/libevent/security/advisories/GHSA-45c6-qx49-89m8, https://nvd.nist.gov/vuln/detail/CVE-2026-63384 Fix: https://github.com/libevent/libevent/commit/109c16499282959d70f56ec3baf4c8b1e6646bda, https://github.com/libevent/libevent/commit/5e3c6ebe342b34c5a9bcf48e9a32ad6708b9c416 Web: https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable, https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha
	Resolved in 2.1.13	GHSA-fj29-64w6-73h6 CVE-2026-63383	libevent	2.1.11 – 2.1.12, fixed in 2.1.13	High	2 months ago
Summary Libevent: decode_tag_internal() can lead to out-of-bounds read Via libevent Affected ranges 2.1.11 – 2.1.12, fixed in 2.1.13 Fixed in 2.1.13 References Advisory: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63383.json, https://github.com/libevent/libevent/security/advisories/GHSA-fj29-64w6-73h6, https://nvd.nist.gov/vuln/detail/CVE-2026-63383 Fix: https://github.com/libevent/libevent/commit/91ed8745eebabdd27592a83d350338a8c4626321, https://github.com/libevent/libevent/commit/e1f9e21887c6b104e206a718385ba3ffc75180cb Web: https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable, https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha
	Resolved in 2.1.13	GHSA-cvq5-vrvr-j338 CVE-2026-63388	libevent	2.1.11 – 2.1.12, fixed in 2.1.13	High: 8.4	2 months ago
Summary Libevent: Heap out-of-bounds write in bufferevent_socket_set_conn_address_ reachable via AF_UNIX accept Via libevent Affected ranges 2.1.11 – 2.1.12, fixed in 2.1.13 Fixed in 2.1.13 CVSS vector CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References Advisory: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63388.json, https://github.com/libevent/libevent/security/advisories/GHSA-cvq5-vrvr-j338, https://nvd.nist.gov/vuln/detail/CVE-2026-63388 Fix: https://github.com/libevent/libevent/commit/52057cb33d0c20c0a0453fbabe6c0c96854931b9, https://github.com/libevent/libevent/commit/ef38f926e9cd1f082416c6fff13587bc1f431d72 Web: https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable, https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha
Medium (3)
	Status	IDs	Package	Version	Severity	Published
	Resolved in 2.1.13	GHSA-2gmv-p5m7-98p6 CVE-2026-63379	libevent	2.1.11 – 2.1.12, fixed in 2.1.13	Medium	2 months ago
Summary Libevent: HTTP Header smuggling Via libevent Affected ranges 2.1.11 – 2.1.12, fixed in 2.1.13 Fixed in 2.1.13 References Advisory: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63379.json, https://github.com/libevent/libevent/security/advisories/GHSA-2gmv-p5m7-98p6, https://nvd.nist.gov/vuln/detail/CVE-2026-63379 Fix: https://github.com/libevent/libevent/commit/87e8e44fa774e9677b089b1a5114ee68aefa1636, https://github.com/libevent/libevent/commit/b847071141b3827900d536594ec9045eb0a4c485 Web: https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable, https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha
	Under investigation	GHSA-3rpf-frgx-xq34 CVE-2026-63380	libevent	2.1.11 – 2.1.13	Medium	2 months ago
Summary Libevent: Null Pointer Dereference in `evws_new_session` Via libevent Affected ranges 2.1.11 – 2.1.13 References Advisory: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63380.json, https://github.com/libevent/libevent/security/advisories/GHSA-3rpf-frgx-xq34, https://nvd.nist.gov/vuln/detail/CVE-2026-63380 Fix: https://github.com/libevent/libevent/commit/825c18bd99f556b59d61200523237f264d5cc734 Web: https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha
	Resolved in 2.1.13	GHSA-c2pj-cg4r-88c8 CVE-2026-63381	libevent	2.1.11 – 2.1.12, fixed in 2.1.13	Medium	2 months ago
Summary Libevent: Dangling Pointer in `evbuffer_add_buffer_reference` Via libevent Affected ranges 2.1.11 – 2.1.12, fixed in 2.1.13 Fixed in 2.1.13 References Advisory: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63381.json, https://github.com/libevent/libevent/security/advisories/GHSA-c2pj-cg4r-88c8, https://nvd.nist.gov/vuln/detail/CVE-2026-63381 Fix: https://github.com/libevent/libevent/commit/5cb95ba2f804f8aff46f88d58391c71e1251cd1c, https://github.com/libevent/libevent/commit/9db091b04f569be3a700fa9860ef02f90b830af9 Web: https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable, https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha
Low (0)
	Status	IDs	Package	Version	Severity	Published
Unknown (0)
	Status	IDs	Package	Version	Severity	Published

Build provenance

For the signed record of what the build used, see the Provenance tab.

49 components

Software Bill of Materials — every package this build depends on
Packages	Version	Repository	License
tmuxROOT	3.7	github.com/tmux/tmux	ISC
acl	2.4.0	https://storage.googleapis.com/minimal-staging-archives/acl-2.4.0.tar.xzMIRROR	(GPL-2.0-only AND LGPL-2.1-only)
attr	2.6.0	https://storage.googleapis.com/minimal-staging-archives/attr-2.6.0.tar.gzMIRROR	(GPL-2.0-only AND LGPL-2.1-only)
autoconf	2.73	www.gnu.org/software/autoconf	GPL-3.0-or-later WITH Autoconf-exception-3.0
automake	1.18.1	www.gnu.org/software/automake	GPL-2.0-only
bash	5.3	www.gnu.org/software/bash	GPL-3.0-only
bash-bootstrap	5.3	www.gnu.org/software/bash	GPL-3.0-only
binutils	2.47	www.gnu.org/software/binutils	(GPL-2.0-only AND GPL-3.0-only AND LGPL-2.0-only)
bison	3.8.2	www.gnu.org/software/bison	GPL-3.0-only
bzip2	1.0.8	github.com/libarchive/bzip2	bzip2-1.0.6
coreutils	9.12	www.gnu.org/software/coreutils	GPL-3.0-only
diffutils	3.12	www.gnu.org/software/diffutils	GPL-3.0-only
expat	2.9.0	github.com/libexpat/libexpat	MIT
file	5.48	https://storage.googleapis.com/minimal-staging-archives/file-5.48.tar.gzMIRROR	BSD-2-Clause-Darwin
findutils	4.11.0	www.gnu.org/software/findutils	GPL-3.0-only
flex	2.6.4	github.com/westes/flex	BSD-3-Clause-flex
gawk	5.4.1	www.gnu.org/software/gawk	GPL-3.0-only
gawk-bootstrap	5.4.1	www.gnu.org/software/gawk	GPL-3.0-only
gcc	15.2.0	www.gnu.org/software/gcc	(GPL-2.0-only AND GPL-3.0-only AND LGPL-2.1-only)
gdbm	1.26	www.gnu.org/software/gdbm	GPL-3.0-only
glibc	2.44	www.gnu.org/software/glibc	(GPL-2.0-only AND LGPL-2.1-only)
gmp	6.3.0	www.gnu.org/software/gmp	LGPL-3.0-or-later OR GPL-2.0-or-later
grep	3.12	www.gnu.org/software/grep	GPL-3.0-only
gzip	1.15	www.gnu.org/software/gzip	GPL-3.0-only
libcap	2.78	https://storage.googleapis.com/minimal-staging-archives/libcap-2.78.tar.xzMIRROR	BSD-3-Clause OR GPL-2.0-only
libevent	2.1.13-stable	github.com/libevent/libevent	BSD-3-Clause
libffi	3.8.0	github.com/libffi/libffi	MIT
linux_headers	6.12.43	github.com/torvalds/linux	GPL-2.0-only WITH Linux-syscall-note
lz4	1.10.0	github.com/lz4/lz4	BSD-2-Clause AND GPL-2.0-or-later
m4	1.4.21	www.gnu.org/software/m4	GPL-3.0-only
make	4.4.1	www.gnu.org/software/make	GPL-3.0-only
mpc	1.4.1	www.gnu.org/software/mpc	LGPL-3.0-or-later
mpfr	4.2.2	www.gnu.org/software/mpfr	GPL-3.0-only
ncurses	6.6	www.gnu.org/software/ncurses	X11-distribute-modifications-variant
openssl	3.6.5	github.com/openssl/openssl	Apache-2.0
patch	2.8	www.gnu.org/software/patch	GPL-3.0-only
pcre2	10.49	github.com/PCRE2Project/pcre2	BSD-3-Clause WITH PCRE2-exception
perl	5.44.0	github.com/Perl/perl5	Artistic-1.0-Perl OR GPL-1.0-or-later
pkgconf	3.0.5	github.com/pkgconf/pkgconf	ISC
python	3.14.8	github.com/python/cpython	Python-2.0.1
readline	8.3	www.gnu.org/software/readline	GPL-3.0-only
sed	4.10	www.gnu.org/software/sed	GPL-3.0-only
sqlite	3.54.0	github.com/sqlite/sqlite	blessing
tar	1.35	www.gnu.org/software/tar	GPL-3.0-only
tzdata	2026e	github.com/eggert/tz	LicenseRef-Public-Domain
util-linux	2.42.4	github.com/util-linux/util-linux	GPL-2.0-or-later AND LGPL-2.1-or-later AND BSD-3-Clause
xz	5.8.4	github.com/tukaani-project/xz	(0BSD AND GPL-2.0-only AND GPL-3.0-only AND LGPL-2.1-only)
zlib	1.3.2	github.com/madler/zlib	Zlib
zstd	1.5.7	github.com/facebook/zstd	BSD-3-Clause OR GPL-2.0-only

tmux

Install package

OpenSSF Score

What is "tmux"?

How to use this package

Quick install

Declare as a task dependency in minimal.toml

Build-time vs runtime

Dependencies (12)

Dependency changes

Summary

Via

Affected ranges

Fixed in

References

Summary

Via

Affected ranges

Fixed in

References

Summary

Via

Affected ranges

Fixed in

CVSS vector

References

Summary

Via

Affected ranges

Fixed in

References

Summary

Via

Affected ranges

Fixed in

References

Summary

Via

Affected ranges

Fixed in

CVSS vector

References

Summary

Via

Affected ranges

Fixed in

References

Summary

Via

Affected ranges

References

Summary

Via

Affected ranges

Fixed in

References

Build provenance

Build provenance

Build provenance

49 components