CVE-2025-4574

The internal Channel type's Drop method has a race which could, in some circumstances, lead to a double-free. This could result in memory corruption.

Quoting from the upstream description in merge request #1187:

The problem lies in the fact that dicard_all_messages contained two paths that could lead to head.block being read but only one of them would swap the value. This meant that dicard_all_messages could end up observing a non-null block pointer (and therefore attempting to free it) without setting head.block to null. This would then lead to Channel::drop making a second attempt at dropping the same pointer.

The bug was introduced while fixing a memory leak, in upstream MR #1084, first published in 0.5.12.

The fix is in upstream MR #1187 and has been published in 0.5.15

In crossbeam-channel rust crate, the internal Channel type's Drop method has a race condition which could, in some circumstances, lead to a double-free that could result in memory corruption.

In crossbeam-channel rust crate, the internal Channel type's Drop method has a race condition which could, in some circumstances, lead to a double-free that could result in memory corruption.

In crossbeam-channel rust crate, the internal Channel type's Drop method has a race condition which could, in some circumstances, lead to a double-free that could result in memory corruption.

In crossbeam-channel rust crate, the internal Channel type's Drop method has a race condition which could, in some circumstances, lead to a double-free that could result in memory corruption.

In crossbeam-channel rust crate, the internal Channel type's Drop method has a race condition which could, in some circumstances, lead to a double-free that could result in memory corruption.

In crossbeam-channel rust crate, the internal Channel type's Drop method has a race condition which could, in some circumstances, lead to a double-free that could result in memory corruption.

In crossbeam-channel rust crate, the internal Channel type's Drop method has a race condition which could, in some circumstances, lead to a double-free that could result in memory corruption.

These are all security issues fixed in the cargo-audit-0.21.2~git0.18e58c2-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the cargo-c-0.10.3~git0.ee7d7ef-4.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python313-ruff-0.16.10-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the zed-1.24.2-1.1 package on the GA media of openSUSE Tumbleweed.

This update for cargo-c fixes the following issues:

• CVE-2025-4574: crossbeam-channel: Fixed double-free on drop in Channel::discard_all_messages (bsc#1243179)
• CVE-2025-58160: tracing-subscriber: Fixed log pollution (bsc#1249012)
• CVE-2024-12224: idna: Fixed improper validation of Punycode labels (bsc#1243851)

Other fixes:

• Fixed _service file to have proper versioning
• Update to version 0.10.15~git0.3e178d5:
  • Bump actions/download-artifact from 4 to 5
  • Update implib requirement from 0.3.5 to 0.4.0
  • Add rlib to the targets when building tests
  • Allow disabling emission of library version constants in header files
  • Bump to cargo 0.90
  • Fix static_libraries swallowing sequence of -framework flags
  • Fix non-POSIX paths in Libdir under Windows
  • Bump actions-rs-plus/clippy-check from 2.2.1 to 2.3.0
  • Fix clippy lints
  • Bump cargo-0.89, object-0.37.1, cbindgen-0.29

This update for gstreamer-devtools fixes the following issues:

• CVE-2025-4574: crossbeam-channel: internal Channel type's Drop method has a race condition that can lead to a double-free and memory corruption (bsc#1243178).
• CVE-2025-58160: tracing-subscriber: untrusted user input containing ANSI escape sequences can be injected into terminal output when logged and lead to terminal manipulation (bsc#1249015).
• CVE-2026-25541: bytes: integer overflow in BytesMut:reserve can lead to undefined behavior and crashes (bsc#1274306).
• CVE-2026-25727: time: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion (bsc#1257914).
• CVE-2026-72813: actix-files: empty Range header in GET requests for static files can lead to a process crash (bsc#1275210).
• CVE-2026-72814: actix-files: non-existing folders passed as an argument to the actix_files::Files::new() method can lead to information disclosure (bsc#1275209).

The internal Channel type's Drop method has a race which could, in some circumstances, lead to a double-free. This could result in memory corruption.

Quoting from the upstream description in merge request #1187:

The problem lies in the fact that dicard_all_messages contained two paths that could lead to head.block being read but only one of them would swap the value. This meant that dicard_all_messages could end up observing a non-null block pointer (and therefore attempting to free it) without setting head.block to null. This would then lead to Channel::drop making a second attempt at dropping the same pointer.

The bug was introduced while fixing a memory leak, in upstream MR #1084, first published in 0.5.12.

The fix is in upstream MR #1187 and has been published in 0.5.15

This update for python-maturin fixes the following issues:

• CVE-2025-3416: openssl: use-after-free in Md::fetch and Cipher::fetch when Some(...) value passed as properties argument to either function (bsc#1242631).
• CVE-2025-4574: crossbeam-channel: double-free leading to possible memory corruption in Channel::drop when dropping a channel (bsc#1243177).

This update for cargo-c fixes the following issues:

• CVE-2025-4574: crossbeam-channel: Fixed double-free on drop in Channel::discard_all_messages (bsc#1243179)
• CVE-2025-58160: tracing-subscriber: Fixed log pollution (bsc#1249012)
• CVE-2024-12224: idna: Fixed improper validation of Punycode labels (bsc#1243851)

Other fixes:

• Fixed _service file to have proper versioning
• Update to version 0.10.15~git0.3e178d5:
  • Bump actions/download-artifact from 4 to 5
  • Update implib requirement from 0.3.5 to 0.4.0
  • Add rlib to the targets when building tests
  • Allow disabling emission of library version constants in header files
  • Bump to cargo 0.90
  • Fix static_libraries swallowing sequence of -framework flags
  • Fix non-POSIX paths in Libdir under Windows
  • Bump actions-rs-plus/clippy-check from 2.2.1 to 2.3.0
  • Fix clippy lints
  • Bump cargo-0.89, object-0.37.1, cbindgen-0.29

This update for gstreamer-devtools fixes the following issues:

• CVE-2025-4574: crossbeam-channel: internal Channel type's Drop method has a race condition that can lead to a double-free and memory corruption (bsc#1243178).
• CVE-2025-58160: tracing-subscriber: untrusted user input containing ANSI escape sequences can be injected into terminal output when logged and lead to terminal manipulation (bsc#1249015).
• CVE-2026-25541: bytes: integer overflow in BytesMut:reserve can lead to undefined behavior and crashes (bsc#1274306).
• CVE-2026-25727: time: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion (bsc#1257914).
• CVE-2026-72813: actix-files: empty Range header in GET requests for static files can lead to a process crash (bsc#1275210).
• CVE-2026-72814: actix-files: non-existing folders passed as an argument to the actix_files::Files::new() method can lead to information disclosure (bsc#1275209).