{"id":"CVE-2025-4574","aliases":["AZL-61830","AZL-61835","AZL-61839","AZL-61845","AZL-61848","AZL-61855","DEBIAN-CVE-2025-4574","EUVD-2025-14635","GHSA-pg9f-39pc-qf8g","RUSTSEC-2025-0024","SUSE-SU-2025:01591-1","SUSE-SU-2026:20096-1","SUSE-SU-2026:23572-1","TROVE-2025-013","UBUNTU-CVE-2025-4574","openSUSE-SU-2025:15550-1","openSUSE-SU-2025:15551-1","openSUSE-SU-2026:12042-1","openSUSE-SU-2026:12355-1","openSUSE-SU-2026:20060-1","openSUSE-SU-2026:21689-1"],"status":"published","title":"Crossbeam-channel: crossbeam-channel vulnerable to double free on drop","description":"In crossbeam-channel rust crate, the internal `Channel` type's `Drop` method has a race condition which could, in some circumstances, lead to a double-free that could result in memory corruption.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00564,"percentile":0.47151,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-415"],"published":"2025-04-08T12:00:00Z","modified":"2026-11-05T21:15:31Z","fixes":[{"ecosystem":"crates.io","package":"crossbeam-channel","fixed_in":["0.5.15"],"sources":["ghsa","osv"]},{"ecosystem":"Azure Linux:3","package":"rust","fixed_in":["1.75.0-16","1.86.0-3"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"kata-containers-cc","fixed_in":["3.15.0.aks0-15"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"azl-compliance","fixed_in":["1.0.2-2"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"kata-containers","fixed_in":["3.18.0.kata0-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"rust-crossbeam-channel","fixed_in":["0.5.15-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"rust-crossbeam-channel","fixed_in":["0.5.15-1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"python-ruff","fixed_in":["0.16.10-1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"crossbeam-channel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.5.12"},{"fixed":"0.5.15"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.75.0-16"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"389-ds-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.1.1-12"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"kata-containers-cc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.15.0.aks0-15"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.85.0"},{"fixed":"1.86.0-3"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"azl-compliance","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2-2"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"kata-containers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.18.0.kata0-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"rust-crossbeam-channel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.15-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"rust-crossbeam-channel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.15-1"}]}]},{"source":"osv","ecosystem":"crates.io","package":"crossbeam-channel","ranges":[{"type":"SEMVER","events":[{"introduced":"0.5.12"},{"fixed":"0.5.15"}]}]},{"source":"osv","ecosystem":"crates.io","package":"crossbeam-channel","ranges":[{"type":"SEMVER","events":[{"introduced":"0.5.12-0"},{"fixed":"0.5.15"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"python-maturin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0-150600.3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"cargo-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.15-160000.1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"cargo-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.15-160000.1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"gstreamer-devtools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.7-160000.2.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"gstreamer-devtools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.7-160000.2.1"}]}],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"rust-crossbeam-channel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.3.9-2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"rust-crossbeam-channel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.4.4-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"rust-crossbeam-channel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.5.6-1","0.5.8-1","0.5.11-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"cargo-audit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21.2~git0.18e58c2-2.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"cargo-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.3~git0.ee7d7ef-4.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-ruff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.16.10-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"zed","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.2-1.1"}]}],"bundled":11},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"cargo-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.15-160000.1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"gstreamer-devtools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.7-160000.2.1"}]}],"bundled":6}],"products":[{"vendor":"red hat","product":"red hat directory server 11"},{"vendor":"red hat","product":"red hat directory server 12"},{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat openshift ai (rhoai)"},{"vendor":"red hat","product":"red hat openshift container platform 4"},{"vendor":"red hat","product":"red hat satellite 6"},{"vendor":"red hat","product":"red hat trusted artifact signer"},{"vendor":"red hat","product":"red hat trusted profile analyzer"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2025-4574","tags":["vdb-entry","x_refsource_REDHAT","advisory","web","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2358890","tags":["issue-tracking","x_refsource_REDHAT","report","web"]},{"url":"https://github.com/advisories/GHSA-pg9f-39pc-qf8g","tags":["advisory"]},{"url":"https://github.com/crossbeam-rs/crossbeam/pull/1187","tags":["fix","web","report"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2025-0024.html","tags":["web","advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-4574","tags":["web","advisory"]},{"url":"https://access.redhat.com/downloads/content/package-browser/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/4xxx/CVE-2025-4574.json","tags":["advisory"]},{"url":"https://github.com/crossbeam-rs/crossbeam","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-4574","tags":["advisory"]},{"url":"https://crates.io/crates/crossbeam-channel","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202501591-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1242631","tags":["report"]},{"url":"https://bugzilla.suse.com/1243177","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-3416","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-4574","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620096-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1243179","tags":["report"]},{"url":"https://bugzilla.suse.com/1243851","tags":["report"]},{"url":"https://bugzilla.suse.com/1249012","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-12224","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58160","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623572-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1243178","tags":["report"]},{"url":"https://bugzilla.suse.com/1249015","tags":["report"]},{"url":"https://bugzilla.suse.com/1257914","tags":["report"]},{"url":"https://bugzilla.suse.com/1274306","tags":["report"]},{"url":"https://bugzilla.suse.com/1275209","tags":["report"]},{"url":"https://bugzilla.suse.com/1275210","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25541","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25727","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72813","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72814","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2025-4574","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-4574","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2024-39719","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-39720","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-39722","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-62518","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27204","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34941","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34942","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53600","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93600","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2025-4574","title":"Crossbeam-channel: crossbeam-channel vulnerable to double free on drop","description":"In crossbeam-channel rust crate, the internal `Channel` type's `Drop` method has a race condition which could, in some circumstances, lead to a double-free that could result in memory corruption.","status":"published","published":"2025-05-13T21:47:24.951Z","modified":"2026-11-05T15:46:51.006Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-415"],"updated_at":"2026-11-05T16:36:33.176634Z"}],"euvd":[{"id":"EUVD-2025-14635","description":"In crossbeam-channel rust crate, the internal `Channel` type's `Drop` method has a race condition which could, in some circumstances, lead to a double-free that could result in memory corruption.","status":"published","published":"2025-05-13T21:47:24Z","modified":"2026-11-05T15:46:51Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-05T18:00:59.460287Z"}],"ghsa":[{"id":"GHSA-pg9f-39pc-qf8g","title":"crossbeam-channel Vulnerable to Double Free on Drop","description":"The internal `Channel` type's `Drop` method has a race\nwhich could, in some circumstances, lead to a double-free.\nThis could result in memory corruption.\n\nQuoting from the\n[upstream description in merge request \\#1187](https://github.com/crossbeam-rs/crossbeam/pull/1187#issue-2980761131):\n\n\u003e The problem lies in the fact that `dicard_all_messages` contained two paths that could lead to `head.block` being read but only one of them would swap the value. This meant that `dicard_all_messages` could end up observing a non-null block pointer (and therefore attempting to free it) without setting `head.block` to null. This would then lead to `Channel::drop` making a second attempt at dropping the same pointer.\n\nThe bug was introduced while fixing a memory leak, in\nupstream [MR \\#1084](https://github.com/crossbeam-rs/crossbeam/pull/1084),\nfirst published in 0.5.12.\n\nThe fix is in\nupstream [MR \\#1187](https://github.com/crossbeam-rs/crossbeam/pull/1187)\nand has been published in 0.5.15","status":"published","published":"2025-04-10T14:30:39Z","modified":"2025-09-25T21:13:02Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-415"],"updated_at":"2026-11-02T14:38:58.965005Z"}],"nvd":[{"id":"CVE-2025-4574","description":"In crossbeam-channel rust crate, the internal `Channel` type's `Drop` method has a race condition which could, in some circumstances, lead to a double-free that could result in memory corruption.","status":"published","published":"2025-05-13T22:15:25.143Z","modified":"2026-11-05T16:17:18.877Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-415"],"updated_at":"2026-11-05T19:55:50.758755Z"}],"osv":[{"id":"CVE-2025-4574","title":"Crossbeam-channel: crossbeam-channel vulnerable to double free on drop","description":"In crossbeam-channel rust crate, the internal `Channel` type's `Drop` method has a race condition which could, in some circumstances, lead to a double-free that could result in memory corruption.","status":"published","published":"2025-05-13T21:47:24.951Z","modified":"2026-11-07T02:30:34.899008661Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"cwes":["CWE-415"],"updated_at":"2026-11-07T03:07:57.024029Z"},{"id":"DEBIAN-CVE-2025-4574","description":"In crossbeam-channel rust crate, the internal `Channel` type's `Drop` method has a race condition which could, in some circumstances, lead to a double-free that could result in memory corruption.","status":"published","published":"2025-05-13T22:15:25.143Z","modified":"2026-09-01T20:05:52.617599551Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:45:47.378563Z"},{"id":"GHSA-pg9f-39pc-qf8g","title":"crossbeam-channel Vulnerable to Double Free on Drop","description":"The internal `Channel` type's `Drop` method has a race\nwhich could, in some circumstances, lead to a double-free.\nThis could result in memory corruption.\n\nQuoting from the\n[upstream description in merge request \\#1187](https://github.com/crossbeam-rs/crossbeam/pull/1187#issue-2980761131):\n\n\u003e The problem lies in the fact that `dicard_all_messages` contained two paths that could lead to `head.block` being read but only one of them would swap the value. This meant that `dicard_all_messages` could end up observing a non-null block pointer (and therefore attempting to free it) without setting `head.block` to null. This would then lead to `Channel::drop` making a second attempt at dropping the same pointer.\n\nThe bug was introduced while fixing a memory leak, in\nupstream [MR \\#1084](https://github.com/crossbeam-rs/crossbeam/pull/1084),\nfirst published in 0.5.12.\n\nThe fix is in\nupstream [MR \\#1187](https://github.com/crossbeam-rs/crossbeam/pull/1187)\nand has been published in 0.5.15","status":"published","published":"2025-04-10T14:30:39Z","modified":"2026-09-10T03:50:57.409985647Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-415"],"updated_at":"2026-11-02T15:46:53.244788Z"},{"id":"UBUNTU-CVE-2025-4574","description":"In crossbeam-channel rust crate, the internal `Channel` type's `Drop` method has a race condition which could, in some circumstances, lead to a double-free that could result in memory corruption.","status":"published","published":"2025-05-13T22:15:00Z","modified":"2026-01-20T18:59:04.871895Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T16:55:50.31802Z"},{"id":"AZL-61830","title":"CVE-2025-4574 affecting package rust for versions less than 1.75.0-16","description":"In crossbeam-channel rust crate, the internal `Channel` type's `Drop` method has a race condition which could, in some circumstances, lead to a double-free that could result in memory corruption.","status":"published","published":"2025-05-13T22:15:25Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:21.518778Z"},{"id":"AZL-61835","title":"CVE-2025-4574 affecting package 389-ds-base 3.1.1-12","description":"In crossbeam-channel rust crate, the internal `Channel` type's `Drop` method has a race condition which could, in some circumstances, lead to a double-free that could result in memory corruption.","status":"published","published":"2025-05-13T22:15:25Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:21.518778Z"},{"id":"AZL-61839","title":"CVE-2025-4574 affecting package kata-containers-cc for versions less than 3.15.0.aks0-15","description":"In crossbeam-channel rust crate, the internal `Channel` type's `Drop` method has a race condition which could, in some circumstances, lead to a double-free that could result in memory corruption.","status":"published","published":"2025-05-13T22:15:25Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:21.518778Z"},{"id":"AZL-61845","title":"CVE-2025-4574 affecting package rust for versions less than 1.86.0-3","description":"In crossbeam-channel rust crate, the internal `Channel` type's `Drop` method has a race condition which could, in some circumstances, lead to a double-free that could result in memory corruption.","status":"published","published":"2025-05-13T22:15:25Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:21.518778Z"},{"id":"AZL-61848","title":"CVE-2025-4574 affecting package azl-compliance for versions less than 1.0.2-2","description":"In crossbeam-channel rust crate, the internal `Channel` type's `Drop` method has a race condition which could, in some circumstances, lead to a double-free that could result in memory corruption.","status":"published","published":"2025-05-13T22:15:25Z","modified":"2026-04-21T04:31:52.155509Z","updated_at":"2026-11-02T15:28:07.805289Z"},{"id":"AZL-61855","title":"CVE-2025-4574 affecting package kata-containers for versions less than 3.18.0.kata0-1","description":"In crossbeam-channel rust crate, the internal `Channel` type's `Drop` method has a race condition which could, in some circumstances, lead to a double-free that could result in memory corruption.","status":"published","published":"2025-05-13T22:15:25Z","modified":"2026-04-21T04:56:14.253906Z","updated_at":"2026-11-02T15:28:07.805289Z"},{"id":"openSUSE-SU-2025:15550-1","title":"cargo-audit-0.21.2~git0.18e58c2-2.1 on GA media","description":"These are all security issues fixed in the cargo-audit-0.21.2~git0.18e58c2-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-09-14T00:00:00Z","modified":"2026-03-23T04:53:55.838638Z","updated_at":"2026-11-02T16:58:37.810934Z"},{"id":"openSUSE-SU-2025:15551-1","title":"cargo-c-0.10.3~git0.ee7d7ef-4.1 on GA media","description":"These are all security issues fixed in the cargo-c-0.10.3~git0.ee7d7ef-4.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-09-14T00:00:00Z","modified":"2026-03-23T04:53:55.790067Z","updated_at":"2026-11-02T16:58:37.810934Z"},{"id":"openSUSE-SU-2026:12042-1","title":"python313-ruff-0.16.10-1.1 on GA media","description":"These are all security issues fixed in the python313-ruff-0.16.10-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-04T00:00:00Z","modified":"2026-10-05T10:15:32.043469232Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:12355-1","title":"zed-1.24.2-1.1 on GA media","description":"These are all security issues fixed in the zed-1.24.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-29T00:00:00Z","modified":"2026-10-31T18:00:05.930167365Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"openSUSE-SU-2026:20060-1","title":"Security update for cargo-c","description":"This update for cargo-c fixes the following issues:\n\n- CVE-2025-4574: crossbeam-channel: Fixed double-free on drop in Channel::discard_all_messages (bsc#1243179)\n- CVE-2025-58160: tracing-subscriber: Fixed log pollution (bsc#1249012)\n- CVE-2024-12224: idna: Fixed improper validation of Punycode labels (bsc#1243851)\n\nOther fixes:\n- Fixed _service file to have proper versioning\n- Update to version 0.10.15~git0.3e178d5:\n  * Bump actions/download-artifact from 4 to 5\n  * Update implib requirement from 0.3.5 to 0.4.0\n  * Add rlib to the targets when building tests\n  * Allow disabling emission of library version constants in header files\n  * Bump to cargo 0.90\n  * Fix static_libraries swallowing sequence of -framework flags\n  * Fix non-POSIX paths in Libdir under Windows\n  * Bump actions-rs-plus/clippy-check from 2.2.1 to 2.3.0\n  * Fix clippy lints\n  * Bump cargo-0.89, object-0.37.1, cbindgen-0.29\n","status":"published","published":"2026-01-19T10:42:10Z","modified":"2026-03-23T04:54:42.715661Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"openSUSE-SU-2026:21689-1","title":"Security update for gstreamer-devtools","description":"This update for gstreamer-devtools fixes the following issues:\n\n- CVE-2025-4574: crossbeam-channel: internal `Channel` type's `Drop` method has a race condition that can lead to a\n  double-free and memory corruption (bsc#1243178).\n- CVE-2025-58160: tracing-subscriber: untrusted user input containing ANSI escape sequences can be injected into\n  terminal output when logged and lead to terminal manipulation (bsc#1249015).\n- CVE-2026-25541: bytes: integer overflow in `BytesMut:reserve` can lead to undefined behavior and crashes\n  (bsc#1274306).\n- CVE-2026-25727: time: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion\n  (bsc#1257914).\n- CVE-2026-72813: actix-files: empty `Range` header in GET requests for static files can lead to a process crash\n  (bsc#1275210).\n- CVE-2026-72814: actix-files: non-existing folders passed as an argument to the `actix_files::Files::new()` method can\n  lead to information disclosure (bsc#1275209).\n","status":"published","published":"2026-08-30T14:39:29Z","modified":"2026-08-31T18:15:04.209335775Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"RUSTSEC-2025-0024","title":"crossbeam-channel: double free on Drop","description":"The internal `Channel` type's `Drop` method has a race\nwhich could, in some circumstances, lead to a double-free.\nThis could result in memory corruption.\n\nQuoting from the\n[upstream description in merge request \\#1187](https://github.com/crossbeam-rs/crossbeam/pull/1187#issue-2980761131):\n\n\u003e The problem lies in the fact that `dicard_all_messages` contained two paths that could lead to `head.block` being read but only one of them would swap the value. This meant that `dicard_all_messages` could end up observing a non-null block pointer (and therefore attempting to free it) without setting `head.block` to null. This would then lead to `Channel::drop` making a second attempt at dropping the same pointer.\n\nThe bug was introduced while fixing a memory leak, in\nupstream [MR \\#1084](https://github.com/crossbeam-rs/crossbeam/pull/1084),\nfirst published in 0.5.12.\n\nThe fix is in\nupstream [MR \\#1187](https://github.com/crossbeam-rs/crossbeam/pull/1187)\nand has been published in 0.5.15","status":"published","published":"2025-04-08T12:00:00Z","modified":"2025-10-28T06:29:00.070713Z","updated_at":"2026-11-02T15:53:39.971022Z"},{"id":"SUSE-SU-2025:01591-1","title":"Security update for python-maturin","description":"This update for python-maturin fixes the following issues:\n\n- CVE-2025-3416: openssl: use-after-free in `Md::fetch` and `Cipher::fetch` when `Some(...)` value passed as\n  `properties` argument to either function (bsc#1242631).\n- CVE-2025-4574: crossbeam-channel: double-free leading to possible memory corruption in `Channel::drop` when dropping\n  a channel (bsc#1243177).\n","status":"published","published":"2025-05-19T21:24:46Z","modified":"2026-02-04T04:11:20.209839Z","updated_at":"2026-11-02T15:53:56.123059Z"},{"id":"SUSE-SU-2026:20096-1","title":"Security update for cargo-c","description":"This update for cargo-c fixes the following issues:\n\n- CVE-2025-4574: crossbeam-channel: Fixed double-free on drop in Channel::discard_all_messages (bsc#1243179)\n- CVE-2025-58160: tracing-subscriber: Fixed log pollution (bsc#1249012)\n- CVE-2024-12224: idna: Fixed improper validation of Punycode labels (bsc#1243851)\n\nOther fixes:\n- Fixed _service file to have proper versioning\n- Update to version 0.10.15~git0.3e178d5:\n  * Bump actions/download-artifact from 4 to 5\n  * Update implib requirement from 0.3.5 to 0.4.0\n  * Add rlib to the targets when building tests\n  * Allow disabling emission of library version constants in header files\n  * Bump to cargo 0.90\n  * Fix static_libraries swallowing sequence of -framework flags\n  * Fix non-POSIX paths in Libdir under Windows\n  * Bump actions-rs-plus/clippy-check from 2.2.1 to 2.3.0\n  * Fix clippy lints\n  * Bump cargo-0.89, object-0.37.1, cbindgen-0.29\n","status":"published","published":"2026-01-19T10:38:15Z","modified":"2026-03-23T04:52:36.037677Z","updated_at":"2026-11-02T15:54:01.610851Z"},{"id":"SUSE-SU-2026:23572-1","title":"Security update for gstreamer-devtools","description":"This update for gstreamer-devtools fixes the following issues:\n\n- CVE-2025-4574: crossbeam-channel: internal `Channel` type's `Drop` method has a race condition that can lead to a\n  double-free and memory corruption (bsc#1243178).\n- CVE-2025-58160: tracing-subscriber: untrusted user input containing ANSI escape sequences can be injected into\n  terminal output when logged and lead to terminal manipulation (bsc#1249015).\n- CVE-2026-25541: bytes: integer overflow in `BytesMut:reserve` can lead to undefined behavior and crashes\n  (bsc#1274306).\n- CVE-2026-25727: time: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion\n  (bsc#1257914).\n- CVE-2026-72813: actix-files: empty `Range` header in GET requests for static files can lead to a process crash\n  (bsc#1275210).\n- CVE-2026-72814: actix-files: non-existing folders passed as an argument to the `actix_files::Files::new()` method can\n  lead to information disclosure (bsc#1275209).\n","status":"published","published":"2026-08-30T14:39:08Z","modified":"2026-09-29T18:23:09.296200538Z","updated_at":"2026-11-02T15:54:03.991985Z"}]}}