CVE-2025-9301
cmake cmForEachCommand.cxx ReplayItems assertion
A vulnerability was determined in cmake 4.1.20250725-gb5cce23. This affects the function cmForEachFunctionBlocker::ReplayItems of the file cmForEachCommand.cxx. This manipulation causes reachable assertion. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. Patch name: 37e27f71bc356d880c908040cd0cb68fa2c371b8. It is suggested to install a patch to address this issue.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
cmake cmForEachCommand.cxx ReplayItems assertion
A vulnerability was determined in cmake 4.1.20250725-gb5cce23. This affects the function cmForEachFunctionBlocker::ReplayItems of the file cmForEachCommand.cxx. This manipulation causes reachable assertion. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. Patch name: 37e27f71bc356d880c908040cd0cb68fa2c371b8. It is suggested to install a patch to address this issue.
- Record
CVE-2025-9301- CVSS 4.0
- 4.8 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P - CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C - CVSS 3.0
- 3.3 Low
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C - CVSS 2.0
- 1.7
AV:L/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:OF/RC:C - Weakness
- CWE-617
- Updated
- 2026-11-02
EUVDEUVD-2025-25423
A vulnerability was determined in cmake 4.1.20250725-gb5cce23. This affects the function cmForEachFunctionBlocker::ReplayItems of the file cmForEachCommand.cxx. This manipulation causes reachable assertion. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. Patch name: 37e27f71bc356d880c908040cd0cb68fa2c371b8. It is suggested to install a patch to address this issue.
- Record
EUVD-2025-25423- CVSS 4.0
- 4.8 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-mff3-m38v-mgv6
A vulnerability was determined in cmake 4.1.20250725-gb5cce23. This affects the function...
A vulnerability was determined in cmake 4.1.20250725-gb5cce23. This affects the function cmForEachFunctionBlocker::ReplayItems of the file cmForEachCommand.cxx. This manipulation causes reachable assertion. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. Patch name: 37e27f71bc356d880c908040cd0cb68fa2c371b8. It is suggested to install a patch to address this issue.
- Record
GHSA-mff3-m38v-mgv6- CVSS 4.0
- 1.9 Low
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-617
- Updated
- 2026-11-02
NVD
A vulnerability was determined in cmake 4.1.20250725-gb5cce23. This affects the function cmForEachFunctionBlocker::ReplayItems of the file cmForEachCommand.cxx. This manipulation causes reachable assertion. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. Patch name: 37e27f71bc356d880c908040cd0cb68fa2c371b8. It is suggested to install a patch to address this issue.
- Record
CVE-2025-9301- CVSS 4.0
- 1.9 Low
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L - CVSS 2.0
- 1.7 Low
AV:L/AC:L/Au:S/C:N/I:N/A:P - Weakness
- CWE-617
- Updated
- 2026-11-02
OSVBELL-CVE-2025-9301
- Record
BELL-CVE-2025-9301- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSV
cmake cmForEachCommand.cxx ReplayItems assertion
A vulnerability was determined in cmake 4.1.20250725-gb5cce23. This affects the function cmForEachFunctionBlocker::ReplayItems of the file cmForEachCommand.cxx. This manipulation causes reachable assertion. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. Patch name: 37e27f71bc356d880c908040cd0cb68fa2c371b8. It is suggested to install a patch to address this issue.
- Record
CVE-2025-9301- CVSS 4.0
- 1.9 Low
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P - Weakness
- CWE-617
- Updated
- 2026-11-02
Show 14 moreShow less
OSVDEBIAN-CVE-2025-9301
A vulnerability was determined in cmake 4.1.20250725-gb5cce23. This affects the function cmForEachFunctionBlocker::ReplayItems of the file cmForEachCommand.cxx. This manipulation causes reachable assertion. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. Patch name: 37e27f71bc356d880c908040cd0cb68fa2c371b8. It is suggested to install a patch to address this issue.
- Record
DEBIAN-CVE-2025-9301- CVSS 4.0
- 1.9 Low
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Updated
- 2026-11-02
OSVOESA-2025-2145
cmake security update
CMake is used to control the software compilation process using simple platform and compiler independent configuration files. CMake generates native makefiles and workspaces that can be used in the compiler environment of your choice. CMake is quite sophisticated: it is possible to support complex environments requiring system configuration, preprocessor generation, code generation, and template instantiation.
Security Fix(es):
A vulnerability was identified in cmake version 4.1.20250725-gb5cce23, affecting the cmForEachFunctionBlocker::ReplayItems function in the cmForEachCommand.cxx file. This vulnerability can lead to a reachable assertion error and requires local access to exploit. The exploit details have been publicly disclosed and may be utilized. It is recommended to apply patch 37e27f71bc356d880c908040cd0cb68fa2c371b8 to mitigate this issue.(CVE-2025-9301)
- Record
OESA-2025-2145- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSVOESA-2025-2146
cmake security update
CMake is used to control the software compilation process using simple platform and compiler independent configuration files. CMake generates native makefiles and workspaces that can be used in the compiler environment of your choice. CMake is quite sophisticated: it is possible to support complex environments requiring system configuration, preprocessor generation, code generation, and template instantiation.
Security Fix(es):
A vulnerability was identified in cmake version 4.1.20250725-gb5cce23, affecting the cmForEachFunctionBlocker::ReplayItems function in the cmForEachCommand.cxx file. This vulnerability can lead to a reachable assertion error and requires local access to exploit. The exploit details have been publicly disclosed and may be utilized. It is recommended to apply patch 37e27f71bc356d880c908040cd0cb68fa2c371b8 to mitigate this issue.(CVE-2025-9301)
- Record
OESA-2025-2146- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSVOESA-2025-2147
cmake security update
CMake is used to control the software compilation process using simple platform and compiler independent configuration files. CMake generates native makefiles and workspaces that can be used in the compiler environment of your choice. CMake is quite sophisticated: it is possible to support complex environments requiring system configuration, preprocessor generation, code generation, and template instantiation.
Security Fix(es):
A vulnerability was identified in cmake version 4.1.20250725-gb5cce23, affecting the cmForEachFunctionBlocker::ReplayItems function in the cmForEachCommand.cxx file. This vulnerability can lead to a reachable assertion error and requires local access to exploit. The exploit details have been publicly disclosed and may be utilized. It is recommended to apply patch 37e27f71bc356d880c908040cd0cb68fa2c371b8 to mitigate this issue.(CVE-2025-9301)
- Record
OESA-2025-2147- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSVOESA-2025-2148
cmake security update
CMake is used to control the software compilation process using simple platform and compiler independent configuration files. CMake generates native makefiles and workspaces that can be used in the compiler environment of your choice. CMake is quite sophisticated: it is possible to support complex environments requiring system configuration, preprocessor generation, code generation, and template instantiation.
Security Fix(es):
A vulnerability was identified in cmake version 4.1.20250725-gb5cce23, affecting the cmForEachFunctionBlocker::ReplayItems function in the cmForEachCommand.cxx file. This vulnerability can lead to a reachable assertion error and requires local access to exploit. The exploit details have been publicly disclosed and may be utilized. It is recommended to apply patch 37e27f71bc356d880c908040cd0cb68fa2c371b8 to mitigate this issue.(CVE-2025-9301)
- Record
OESA-2025-2148- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSVOESA-2025-2254
cmake security update
CMake is used to control the software compilation process using simple platform and compiler independent configuration files. CMake generates native makefiles and workspaces that can be used in the compiler environment of your choice. CMake is quite sophisticated: it is possible to support complex environments requiring system configuration, preprocessor generation, code generation, and template instantiation.
Security Fix(es):
A vulnerability was identified in cmake version 4.1.20250725-gb5cce23, affecting the cmForEachFunctionBlocker::ReplayItems function in the cmForEachCommand.cxx file. This vulnerability can lead to a reachable assertion error and requires local access to exploit. The exploit details have been publicly disclosed and may be utilized. It is recommended to apply patch 37e27f71bc356d880c908040cd0cb68fa2c371b8 to mitigate this issue.(CVE-2025-9301)
- Record
OESA-2025-2254- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSVUBUNTU-CVE-2025-9301
A vulnerability was determined in cmake 4.1.20250725-gb5cce23. This affects the function cmForEachFunctionBlocker::ReplayItems of the file cmForEachCommand.cxx. This manipulation causes reachable assertion. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. Patch name: 37e27f71bc356d880c908040cd0cb68fa2c371b8. It is suggested to install a patch to address this issue.
- Record
UBUNTU-CVE-2025-9301- CVSS 4.0
- 1.9 Low
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P - CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSVAZL-66554 No score
CVE-2025-9301 affecting package cmake for versions less than 3.21.4-19
A vulnerability was determined in cmake 4.1.20250725-gb5cce23. This affects the function cmForEachFunctionBlocker::ReplayItems of the file cmForEachCommand.cxx. This manipulation causes reachable assertion. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. Patch name: 37e27f71bc356d880c908040cd0cb68fa2c371b8. It is suggested to install a patch to address this issue.
- Record
AZL-66554- Updated
- 2026-11-02
OSVAZL-66557 No score
CVE-2025-9301 affecting package cmake for versions less than 3.30.3-9
A vulnerability was determined in cmake 4.1.20250725-gb5cce23. This affects the function cmForEachFunctionBlocker::ReplayItems of the file cmForEachCommand.cxx. This manipulation causes reachable assertion. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. Patch name: 37e27f71bc356d880c908040cd0cb68fa2c371b8. It is suggested to install a patch to address this issue.
- Record
AZL-66557- Updated
- 2026-11-05
OSVMGASA-2026-0069 No score
Updated cmake packages fix security vulnerability
cmake cmForEachCommand.cxx ReplayItems assertion. (CVE-2025-9301
- Record
MGASA-2026-0069- Updated
- 2026-11-02
OSVSUSE-SU-2025:02975-1 No score
Security update for cmake3
This update for cmake3 fixes the following issues:
- CVE-2025-9301: Fixed assertion failure due to improper validation (bsc#1248461)
- Record
SUSE-SU-2025:02975-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:02976-1 No score
Security update for cmake3
This update for cmake3 fixes the following issues:
- CVE-2025-9301: Fixed assertion failure due to improper validation (bsc#1248461)
- Record
SUSE-SU-2025:02976-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:03281-1 No score
Security update for cmake
This update for cmake fixes the following issues:
- CVE-2025-9301: Fixed assertion failure due to improper validation (bsc#1248461)
- Record
SUSE-SU-2025:03281-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:3812-1 No score
Security update for cmake
This update for cmake fixes the following issues:
- CVE-2025-9301: Fixed assertion failure due to improper validation (bsc#1248461)
- Record
SUSE-SU-2025:3812-1- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
cmakeAzure Linux:2 |
before 3.21.4-19 | 3.21.4-19 |
cmakeAzure Linux:3 |
before 3.30.3-9 | 3.30.3-9 |
cmakeAlpaquita:23 |
3.24.3-r0 and later | None known |
cmakeAlpaquita:25 |
3.31.7-r0 and later | None known |
cmakeAlpaquita:stream |
3.26.4-r1 and later | None known |
cmakeDebian:12 |
All versions, plus listed versions 3.25.1-13.26.4-13.26.4-23.26.4-33.26.4-4 Show 45 moreShow less3.26.4-4~bpo12+13.27.0-13.27.0-23.27.0~rc4-13.27.0~rc4-23.27.0~rc4-33.27.0~rc5-13.27.1-13.27.1-23.27.2-13.27.2-1~bpo12+13.27.3-13.27.4-13.27.4-1~bpo12+13.27.5-13.27.5-1~bpo12+13.27.6-13.27.6-1~bpo12+13.27.7-13.27.7-1~bpo12+13.27.8-13.27.8-1~bpo12+13.27.9-13.27.9-1~bpo12+13.28.0-13.28.1-13.28.1-1~bpo12+13.28.2-13.28.3-13.28.3-1~bpo12+13.29.2-13.29.2-23.29.2-2~bpo12+13.29.3-13.29.3-1~bpo12+13.29.4-13.29.4-1~bpo12+13.29.5-13.29.5-1~bpo12+13.29.6-13.29.6-1~bpo12+13.30.0-13.30.1-13.30.2-13.30.2-2 |
None known |
cmakeDebian:13 |
All versions, plus listed versions 3.31.6-24.0.0-14.0.1-14.0.2-14.0.3-1 Show 31 moreShow less4.1.0-14.1.1+really3.31.6-14.1.1+really3.31.6-24.1.1+really4.1.1-14.1.1-14.1.1-24.1.2-14.2.0-14.2.0-24.2.1-14.2.1-24.2.2-14.2.2-24.2.3-14.2.3-1~bpo13+14.2.3-24.2.3-2~bpo13+14.3.0-14.3.0-24.3.0-34.3.0~rc3-14.3.1-14.3.1-1~bpo13+14.3.2-14.3.2-1~bpo13+14.3.3-14.3.3-1~bpo13+14.3.4-14.3.4-1~bpo13+14.4.0-14.4.2-1 |
None known |
cmakeDebian:14 |
All versions, plus listed versions 3.31.6-24.0.0-14.0.1-14.0.2-14.0.3-1 Show 31 moreShow less4.1.0-14.1.1+really3.31.6-14.1.1+really3.31.6-24.1.1+really4.1.1-14.1.1-14.1.1-24.1.2-14.2.0-14.2.0-24.2.1-14.2.1-24.2.2-14.2.2-24.2.3-14.2.3-1~bpo13+14.2.3-24.2.3-2~bpo13+14.3.0-14.3.0-24.3.0-34.3.0~rc3-14.3.1-14.3.1-1~bpo13+14.3.2-14.3.2-1~bpo13+14.3.3-14.3.3-1~bpo13+14.3.4-14.3.4-1~bpo13+14.4.0-14.4.2-1 |
None known |
cmakeMageia:9 |
before 3.26.4-1.1.mga9 | 3.26.4-1.1.mga9 |
cmakeopenEuler:22.03-LTS-SP3 |
before 3.22.0-11.oe2203sp3 | 3.22.0-11.oe2203sp3 |
Show 22 moreShow less
| Package | Affected | Fixed |
|---|---|---|
cmakeopenEuler:22.03-LTS-SP4 |
before 3.22.0-11.oe2203sp4 | 3.22.0-11.oe2203sp4 |
cmakeopenEuler:24.03-LTS-SP1 |
before 3.27.9-8.oe2403sp1 | 3.27.9-8.oe2403sp1 |
cmakeopenEuler:24.03-LTS-SP2 |
before 3.27.9-8.oe2403sp2 | 3.27.9-8.oe2403sp2 |
cmakeopenEuler:24.03-LTS |
before 3.27.9-7.oe2403 | 3.27.9-7.oe2403 |
cmake3openSUSE:Leap 15.6 |
before 3.20.0-150200.6.6.1 | 3.20.0-150200.6.6.1 |
cmake3-fullopenSUSE:Leap 15.6 |
before 3.20.0-150200.6.6.1 | 3.20.0-150200.6.6.1 |
cmake3-uiopenSUSE:Leap 15.6 |
before 3.17.0-150000.1.9.1 | 3.17.0-150000.1.9.1 |
cmakeSUSE:Linux Enterprise Module for Basesystem 15 SP6 |
before 3.28.3-150600.3.3.1 | 3.28.3-150600.3.3.1 |
cmake-fullSUSE:Linux Enterprise Module for Basesystem 15 SP6 |
before 3.28.3-150600.3.3.1 | 3.28.3-150600.3.3.1 |
cmakeSUSE:Linux Enterprise Module for Basesystem 15 SP7 |
before 3.28.3-150600.3.3.1 | 3.28.3-150600.3.3.1 |
cmake-fullSUSE:Linux Enterprise Module for Basesystem 15 SP7 |
before 3.28.3-150600.3.3.1 | 3.28.3-150600.3.3.1 |
cmakeopenSUSE:Leap 15.6 |
before 3.28.3-150600.3.3.1 | 3.28.3-150600.3.3.1 |
cmake-fullopenSUSE:Leap 15.6 |
before 3.28.3-150600.3.3.1 | 3.28.3-150600.3.3.1 |
cmake-uiopenSUSE:Leap 15.6 |
before 3.28.3-150600.3.3.1 | 3.28.3-150600.3.3.1 |
cmakeUbuntu:16.04:LTS |
All versions, plus listed versions 3.2.2-2ubuntu33.2.2-2ubuntu43.3.2-1ubuntu13.3.2is3.2.2-0ubuntu13.3.2is3.2.2-0ubuntu2 Show 8 moreShow less3.3.2is3.2.2-0ubuntu43.3.2is3.2.2-0ubuntu53.5.0-1ubuntu13.5.0-1ubuntu23.5.0-1ubuntu33.5.1-1ubuntu13.5.1-1ubuntu23.5.1-1ubuntu3 |
None known |
cmakeUbuntu:18.04:LTS |
All versions, plus listed versions 3.9.1-13.9.3-13.9.5-13.10.2-13.10.2-1build1 Show 4 moreShow less3.10.2-1ubuntu13.10.2-1ubuntu23.10.2-1ubuntu2.18.04.13.10.2-1ubuntu2.18.04.2 |
None known |
cmakeUbuntu:20.04:LTS |
All versions, plus listed versions 3.13.4-1build13.15.4-13.15.4-1ubuntu23.15.4-1ubuntu33.16.3-1ubuntu13.16.3-1ubuntu1.20.04.1 |
None known |
cmakeUbuntu:22.04:LTS |
All versions, plus listed versions 3.18.4-2ubuntu23.21.4-1ubuntu23.22.1-1ubuntu13.22.1-1ubuntu1.22.04.13.22.1-1ubuntu1.22.04.2 |
None known |
cmakeUbuntu:24.04:LTS |
All versions, plus listed versions 3.27.4-13.27.7-13.27.8-13.27.8-1build13.28.1-1 Show 4 moreShow less3.28.3-13.28.3-1build53.28.3-1build63.28.3-1build7 |
None known |
cmakeUbuntu:25.10 |
All versions, plus listed versions 3.31.6-1ubuntu13.31.6-2ubuntu13.31.6-2ubuntu33.31.6-2ubuntu43.31.6-2ubuntu53.31.6-2ubuntu6 |
None known |
cmakeUbuntu:26.10 |
All versions, plus listed versions 4.2.3-2ubuntu24.3.2-1ubuntu14.3.4-1ubuntu1 |
None known |
cmakeUbuntu:26.04:LTS |
All versions, plus listed versions 3.31.6-2ubuntu64.1.1+really3.31.6-2ubuntu14.2.3-2ubuntu14.2.3-2ubuntu2 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-9301 is a medium vulnerability (CVSS 4.8) in cmake, published August 21, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.15%, the 4th percentile. Fixed in cmake 3.21.4-19.
References
vuldb.com?id.320906
gitlab.kitware.com/cmake/cmake/-/issues/27135
drive.google.com/file/d/1TerUqQB8_lzJTwIBCBmE94zn7n-gOz4f/view?usp=sharing
Show 21 moreShow less
nvd.nist.gov/vuln/detail/CVE-2025-9301
github.com/advisories/GHSA-mff3-m38v-mgv6
docs.bell-sw.com/security/cves/CVE-2025-9301
security-tracker.debian.org/tracker/CVE-2025-9301
advisories.mageia.org/MGASA-2026-0069.html
bugs.mageia.org/show_bug.cgi?id=35263
lists.fedoraproject.org/archives/list/[email protected]/message/LRYGBCSAOIXW3H7GXSATU2RXSYBKTGFL
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2025-2145
suse.com/support/update/announcement/2025/suse-su-202502975-1
bugzilla.suse.com/1248461
ubuntu.com/security/CVE-2025-9301
cve.org/CVERecord?id=CVE-2025-9301
Left out here: 58 versions. The JSON record has them.