{"id":"CVE-2026-25727","aliases":["AZL-76821","AZL-76994","AZL-77030","AZL-77034","AZL-77087","AZL-77091","DEBIAN-CVE-2026-25727","EUVD-2026-5587","GHSA-r6v5-fh4h-64xc","RUSTSEC-2026-0009","SUSE-FU-2026:20990-1","SUSE-SU-2026:0452-1","SUSE-SU-2026:0453-1","SUSE-SU-2026:0470-1","SUSE-SU-2026:0505-1","SUSE-SU-2026:0506-1","SUSE-SU-2026:0514-1","SUSE-SU-2026:0582-1","SUSE-SU-2026:0620-1","SUSE-SU-2026:0806-1","SUSE-SU-2026:0816-1","SUSE-SU-2026:0819-1","SUSE-SU-2026:0860-1","SUSE-SU-2026:1361-1","SUSE-SU-2026:1599-1","SUSE-SU-2026:1750-1","SUSE-SU-2026:20526-1","SUSE-SU-2026:20534-1","SUSE-SU-2026:20575-1","SUSE-SU-2026:20661-1","SUSE-SU-2026:20684-1","SUSE-SU-2026:20723-1","SUSE-SU-2026:20744-1","SUSE-SU-2026:20748-1","SUSE-SU-2026:21275-1","SUSE-SU-2026:21377-1","SUSE-SU-2026:21794-1","SUSE-SU-2026:23572-1","SUSE-SU-2026:23643-1","SUSE-SU-2026:23659-1","SUSE-SU-2026:23983-1","SUSE-SU-2026:24014-1","SUSE-SU-2026:24127-1","SUSE-SU-2026:24223-1","SUSE-SU-2026:2441-1","SUSE-SU-2026:2831-1","SUSE-SU-2026:3022-1","SUSE-SU-2026:3992-1","UBUNTU-CVE-2026-25727","openSUSE-FU-2026:20453-1","openSUSE-SU-2026:10170-1","openSUSE-SU-2026:10172-1","openSUSE-SU-2026:10175-1","openSUSE-SU-2026:10179-1","openSUSE-SU-2026:10180-1","openSUSE-SU-2026:10181-1","openSUSE-SU-2026:10182-1","openSUSE-SU-2026:10184-1","openSUSE-SU-2026:10185-1","openSUSE-SU-2026:10202-1","openSUSE-SU-2026:10308-1","openSUSE-SU-2026:11656-1","openSUSE-SU-2026:20245-1","openSUSE-SU-2026:20326-1","openSUSE-SU-2026:20364-1","openSUSE-SU-2026:20377-1","openSUSE-SU-2026:20380-1","openSUSE-SU-2026:20610-1","openSUSE-SU-2026:20753-1","openSUSE-SU-2026:21689-1","openSUSE-SU-2026:21782-1","openSUSE-SU-2026:21982-1","openSUSE-SU-2026:22016-1","openSUSE-SU-2026:22079-1"],"status":"published","title":"time affected by a stack exhaustion denial of service attack","description":"time provides date and time handling in Rust. From 0.3.6 to before 0.3.47, when user-provided input is provided to any type that parses with the RFC 2822 format, a denial of service attack via stack exhaustion is possible. The attack relies on formally deprecated and rarely-used features that are part of the RFC 2822 format used in a malicious manner. Ordinary, non-malicious input will never encounter this scenario. A limit to the depth of recursion was added in v0.3.47. From this version, an error will be returned rather than exhausting the stack.","severity":{"version":"4.0","score":6.8,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00334,"percentile":0.27161,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-121"],"published":"2026-02-05T12:00:00Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"crates.io","package":"time","fixed_in":["0.3.47"],"sources":["ghsa","osv"]},{"ecosystem":"Azure Linux:2","package":"azl-compliance","fixed_in":["1.0.2-3"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"kata-containers","fixed_in":["3.19.1.kata2-6"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"rust","fixed_in":["1.75.0-27","1.90.0-6"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"rust-time","fixed_in":["0.3.9-1+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"rust-time","fixed_in":["0.3.37-1+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"rust-time","fixed_in":["0.3.47-1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"rust-keylime","fixed_in":["0.2.8+116-150400.3.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"rust-keylime","fixed_in":["0.2.8+116-150400.3.13.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"rust-keylime","fixed_in":["0.2.8+116-150500.3.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"cargo-auditable","fixed_in":["0.7.2~0-150500.12.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"cargo-auditable","fixed_in":["0.7.2~0-150500.12.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"cargo-auditable","fixed_in":["0.7.2~0-150500.12.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"cargo-auditable","fixed_in":["0.7.2~0-150500.12.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"cargo-auditable","fixed_in":["0.7.2~0-150500.12.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"cargo-auditable","fixed_in":["0.7.2~0-150500.12.6.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"cargo-auditable","fixed_in":["0.7.2~0-150500.12.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"cargo-auditable","fixed_in":["0.7.2~0-150700.3.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"cargo-auditable","fixed_in":["0.7.2~0-150300.7.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"cargo-auditable","fixed_in":["0.7.2~0-150300.7.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"cargo-auditable","fixed_in":["0.7.2~0-150300.7.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"cargo-auditable","fixed_in":["0.7.2~0-150300.7.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"snpguest","fixed_in":["0.3.2-150600.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"snpguest","fixed_in":["0.3.2-150600.3.9.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"snpguest","fixed_in":["0.3.2-150600.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"SLES16-Migration","fixed_in":["2.1.30-15.26.4"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"suse-migration-services","fixed_in":["2.1.30-150700.15.21.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"suse-migration-sle16-activation","fixed_in":["2.1.30-150700.15.13.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"wicked2nm","fixed_in":["1.4.1-150700.15.16.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for SAP Applications 15 SP7","package":"SLES16-SAP_Migration","fixed_in":["2.1.30-15.18.4"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"virtiofsd","fixed_in":["1.10.1-150600.4.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"virtiofsd","fixed_in":["1.10.1-150600.4.6.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"virtiofsd","fixed_in":["1.10.1-150600.4.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"virtiofsd","fixed_in":["1.12.0-150700.3.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"python-maturin","fixed_in":["1.4.0-150600.3.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"librsvg","fixed_in":["2.52.12-150400.3.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"librsvg","fixed_in":["2.52.12-150400.3.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"librsvg","fixed_in":["2.52.12-150400.3.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"librsvg","fixed_in":["2.52.12-150400.3.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"librsvg","fixed_in":["2.52.12-150400.3.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"librsvg","fixed_in":["2.52.12-150400.3.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"librsvg","fixed_in":["2.52.12-150400.3.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"librsvg","fixed_in":["2.52.12-150400.3.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"librsvg","fixed_in":["2.52.12-150400.3.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"librsvg","fixed_in":["2.52.12-150400.3.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"librsvg","fixed_in":["2.52.12-150400.3.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.0","package":"rust-keylime","fixed_in":["0.2.8+116-1.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.1","package":"rust-keylime","fixed_in":["0.2.8+116-slfo.1.1_1.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"wicked2nm","fixed_in":["1.4.1-160000.1.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"wicked2nm","fixed_in":["1.4.1-160000.1.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.1","package":"virtiofsd","fixed_in":["1.10.1-slfo.1.1_2.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.2","package":"virtiofsd","fixed_in":["1.12.0-160000.3.1","1.12.0-160000.4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.0","package":"virtiofsd","fixed_in":["1.10.1-2.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.2","package":"python-maturin","fixed_in":["1.8.7-160000.4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.2","package":"librsvg","fixed_in":["2.60.2-160000.2.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"virtiofsd","fixed_in":["1.12.0-160000.4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"virtiofsd","fixed_in":["1.12.0-160000.4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"rustup","fixed_in":["1.28.2~0-150600.10.10.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"rustup","fixed_in":["1.28.2~0-150600.10.10.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"rustup","fixed_in":["1.28.2~0-150600.10.10.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"rust-keylime","fixed_in":["0.2.8+116-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"wicked2nm","fixed_in":["1.4.1-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"cargo-audit","fixed_in":["0.22.1~git0.efcde93-2.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"python-maturin","fixed_in":["1.11.5-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"rustup","fixed_in":["1.28.2~0-3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"sccache","fixed_in":["0.13.0~1-2.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"snpguest","fixed_in":["0.10.0-2.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"cargo-auditable","fixed_in":["0.7.2~0-2.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"cargo-c","fixed_in":["0.10.15-2.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"himmelblau","fixed_in":["2.3.5+git0.9dd526c-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"virtiofsd","fixed_in":["1.13.2-2.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"wicked2nm","fixed_in":["1.4.1-160000.1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"virtiofsd","fixed_in":["1.12.0-160000.3.1","1.12.0-160000.4.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"python-maturin","fixed_in":["1.8.7-160000.4.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"snpguest","fixed_in":["0.10.0-160000.1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"librsvg","fixed_in":["2.60.2-160000.2.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"time","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.3.6"},{"fixed":"0.3.47"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"azl-compliance","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2-3"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"kata-containers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.19.1.kata2-6"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"librsvg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.58.1-5"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.72.0-14"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.75.0-27"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.85.0"},{"fixed":"1.90.0-6"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"rust-time","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.9-1+deb12u1"}]}],"versions":["0.3.9-1"]},{"source":"osv","ecosystem":"Debian:13","package":"rust-time","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.37-1+deb13u1"}]}],"versions":["0.3.37-1"]},{"source":"osv","ecosystem":"Debian:14","package":"rust-time","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.47-1"}]}],"versions":["0.3.37-1","0.3.39-1","0.3.44-1"]},{"source":"osv","ecosystem":"crates.io","package":"time","ranges":[{"type":"SEMVER","events":[{"introduced":"0.3.6"},{"fixed":"0.3.47"}]}]},{"source":"osv","ecosystem":"crates.io","package":"time","ranges":[{"type":"SEMVER","events":[{"introduced":"0.3.6"},{"fixed":"0.3.47"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"himmelblau","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.8+git0.dec3693-160000.1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"himmelblau","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.8+git0.dec3693-160000.1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"rust-keylime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.8+116-150400.3.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"rust-keylime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.8+116-150400.3.13.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"rust-keylime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.8+116-150500.3.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"cargo-auditable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.2~0-150500.12.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"cargo-auditable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.2~0-150500.12.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"cargo-auditable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.2~0-150500.12.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"cargo-auditable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.2~0-150500.12.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"cargo-auditable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.2~0-150500.12.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"cargo-auditable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.2~0-150500.12.6.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"cargo-auditable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.2~0-150500.12.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"cargo-auditable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.2~0-150700.3.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"cargo-auditable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.2~0-150300.7.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"cargo-auditable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.2~0-150300.7.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"cargo-auditable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.2~0-150300.7.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"cargo-auditable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.2~0-150300.7.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"snpguest","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.2-150600.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"snpguest","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.2-150600.3.9.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"snpguest","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.2-150600.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP7","package":"snpguest","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.0-150700.3.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"SLES16-Migration","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.30-15.26.4"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"suse-migration-services","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.30-150700.15.21.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"suse-migration-sle16-activation","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.30-150700.15.13.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"wicked2nm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.1-150700.15.16.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for SAP Applications 15 SP7","package":"SLES16-SAP_Migration","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.30-15.18.4"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"virtiofsd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.1-150600.4.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"virtiofsd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.1-150600.4.6.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"virtiofsd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.1-150600.4.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"virtiofsd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.0-150700.3.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"python-maturin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0-150600.3.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"himmelblau","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.9+git0.a9fd29b-150700.3.15.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"librsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.52.12-150400.3.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"librsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.52.12-150400.3.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"librsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.52.12-150400.3.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"librsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.52.12-150400.3.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"librsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.52.12-150400.3.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"librsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.52.12-150400.3.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"librsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.52.12-150400.3.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"librsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.52.12-150400.3.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"librsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.52.12-150400.3.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"librsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.52.12-150400.3.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"librsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.52.12-150400.3.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"rust-keylime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.8+116-1.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"rust-keylime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.8+116-slfo.1.1_1.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"wicked2nm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.1-160000.1.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"wicked2nm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.1-160000.1.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"virtiofsd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.1-slfo.1.1_2.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"virtiofsd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.0-160000.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"virtiofsd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.1-2.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"rust-keylime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.8+116-160000.1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"python-maturin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.7-160000.4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"librsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.60.2-160000.2.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"gstreamer-devtools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.7-160000.2.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"gstreamer-devtools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.7-160000.2.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"aws-nitro-enclaves-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.0~git0.2950b36-160000.1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"aws-nitro-enclaves-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.0~git0.2950b36-160000.1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"aws-nitro-enclaves-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.0~git0.2950b36-160000.1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"aws-nitro-enclaves-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.0~git0.2950b36-160000.1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"sccache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.18.0~2-160000.1.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"sccache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.18.0~2-160000.1.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"rustup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.29.1~0-160000.1.1"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"rustup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.29.1~0-160000.1.1"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"virtiofsd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.0-160000.4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"virtiofsd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.0-160000.4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"virtiofsd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.0-160000.4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"rustup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.2~0-150600.10.10.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"rustup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.2~0-150600.10.10.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"rustup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.2~0-150600.10.10.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"rustup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.2~0-150400.3.13.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"rustup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.2~0-150400.3.13.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"rustup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.2~0-150400.3.13.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"rustup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.2~0-150400.3.13.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"rustup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.2~0-150400.3.13.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"rustup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.2~0-150400.3.13.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"rustup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.2~0-150400.3.13.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"rustup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.2~0-150400.3.13.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"sccache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.16.0~0-150600.10.11.1"}]}],"bundled":14},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"sccache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.16.0~0-150600.10.11.1"}]}],"bundled":14},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"sccache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.16.0~0-150600.10.11.1"}]}],"bundled":14},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP6","package":"aws-nitro-enclaves-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.0~git0.2950b36-150600.10.15.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP7","package":"aws-nitro-enclaves-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.0~git0.2950b36-150600.10.15.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"rust-time","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.1.42-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"rust-time","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.1.42-1","0.3.5-2","0.3.5-3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"rust-time","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.3.23-2","0.3.31-1","0.3.31-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"rust-time","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.3.37-1","0.3.39-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"rust-time","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.3.39-1","0.3.44-1","0.3.47-1"]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"himmelblau","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.8+git0.dec3693-160000.1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rust-keylime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.8+116-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"wicked2nm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.1-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"cargo-audit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.22.1~git0.efcde93-2.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-maturin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.5-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rustup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.2~0-3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"sccache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.13.0~1-2.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"snpguest","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.0-2.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"cargo-auditable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.2~0-2.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"cargo-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.15-2.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"himmelblau","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.5+git0.9dd526c-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"virtiofsd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.2-2.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"aws-nitro-enclaves-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.0~git0.2950b36-1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"wicked2nm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.1-160000.1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"virtiofsd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.0-160000.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"rust-keylime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.8+116-160000.1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"python-maturin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.7-160000.4.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"snpguest","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.0-160000.1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"librsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.60.2-160000.2.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"gstreamer-devtools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.7-160000.2.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"aws-nitro-enclaves-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.0~git0.2950b36-160000.1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"sccache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.18.0~2-160000.1.1"}]}],"bundled":19},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"rustup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.29.1~0-160000.1.1"}]}],"bundled":16},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"virtiofsd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.0-160000.4.1"}]}]}],"products":[{"vendor":"time-rs","product":"time"},{"vendor":"time_project","product":"time"}],"references":[{"url":"https://github.com/time-rs/time/security/advisories/GHSA-r6v5-fh4h-64xc","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory","web","report"]},{"url":"https://github.com/time-rs/time/commit/1c63dc7985b8fa26bd8c689423cc56b7a03841ee","tags":["x_refsource_MISC","Patch","fix","web","report"]},{"url":"https://github.com/time-rs/time/blob/main/CHANGELOG.md#0347-2026-02-05","tags":["x_refsource_MISC","Release Notes","web","report"]},{"url":"https://github.com/time-rs/time/releases/tag/v0.3.47","tags":["x_refsource_MISC","Product","Release Notes","web","report"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0009.html","tags":["web","advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25727","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-r6v5-fh4h-64xc","tags":["report"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25727.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-25727","tags":["advisory"]},{"url":"https://github.com/time-rs/time","tags":["package"]},{"url":"https://crates.io/crates/time","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement//suse-fu-202620990-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1247735","tags":["report"]},{"url":"https://bugzilla.suse.com/1249013","tags":["report"]},{"url":"https://bugzilla.suse.com/1257904","tags":["report"]},{"url":"https://bugzilla.suse.com/1258236","tags":["report"]},{"url":"https://bugzilla.suse.com/1259548","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-54882","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58160","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25727","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31979","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260452-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1257908","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260453-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260470-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260505-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1257906","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260506-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260514-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260582-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1257927","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260620-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1242601","tags":["report"]},{"url":"https://bugzilla.suse.com/1243869","tags":["report"]},{"url":"https://bugzilla.suse.com/1257877","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-12224","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-3416","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260806-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1257911","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260816-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1257912","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260819-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260860-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1257918","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261361-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1233949","tags":["report"]},{"url":"https://bugzilla.suse.com/1245437","tags":["report"]},{"url":"https://bugzilla.suse.com/1261324","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-11738","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-53013","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34397","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261599-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1257922","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261750-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620526-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620534-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620575-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620661-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620684-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620723-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620744-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1247193","tags":["report"]},{"url":"https://bugzilla.suse.com/1248006","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-55159","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58266","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620748-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621275-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621377-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621794-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1257930","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623572-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1243178","tags":["report"]},{"url":"https://bugzilla.suse.com/1249015","tags":["report"]},{"url":"https://bugzilla.suse.com/1257914","tags":["report"]},{"url":"https://bugzilla.suse.com/1274306","tags":["report"]},{"url":"https://bugzilla.suse.com/1275209","tags":["report"]},{"url":"https://bugzilla.suse.com/1275210","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-4574","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25541","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72813","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72814","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623643-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1257933","tags":["report"]},{"url":"https://bugzilla.suse.com/1270202","tags":["report"]},{"url":"https://bugzilla.suse.com/1274300","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41676","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623659-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623983-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1243868","tags":["report"]},{"url":"https://bugzilla.suse.com/1257923","tags":["report"]},{"url":"https://bugzilla.suse.com/1270206","tags":["report"]},{"url":"https://bugzilla.suse.com/1270512","tags":["report"]},{"url":"https://bugzilla.suse.com/1270559","tags":["report"]},{"url":"https://bugzilla.suse.com/1270693","tags":["report"]},{"url":"https://bugzilla.suse.com/1270736","tags":["report"]},{"url":"https://bugzilla.suse.com/1270869","tags":["report"]},{"url":"https://bugzilla.suse.com/1270938","tags":["report"]},{"url":"https://bugzilla.suse.com/1270948","tags":["report"]},{"url":"https://bugzilla.suse.com/1273881","tags":["report"]},{"url":"https://bugzilla.suse.com/1273884","tags":["report"]},{"url":"https://bugzilla.suse.com/1273886","tags":["report"]},{"url":"https://bugzilla.suse.com/1273888","tags":["report"]},{"url":"https://bugzilla.suse.com/1274146","tags":["report"]},{"url":"https://bugzilla.suse.com/1282211","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41677","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41678","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41681","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41898","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42327","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44662","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45784","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-66746","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-66754","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-67181","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-67182","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93599","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93600","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93601","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93602","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624014-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1230032","tags":["report"]},{"url":"https://bugzilla.suse.com/1243862","tags":["report"]},{"url":"https://bugzilla.suse.com/1249008","tags":["report"]},{"url":"https://bugzilla.suse.com/1257902","tags":["report"]},{"url":"https://bugzilla.suse.com/1270186","tags":["report"]},{"url":"https://bugzilla.suse.com/1270521","tags":["report"]},{"url":"https://bugzilla.suse.com/1270619","tags":["report"]},{"url":"https://bugzilla.suse.com/1270644","tags":["report"]},{"url":"https://bugzilla.suse.com/1270795","tags":["report"]},{"url":"https://bugzilla.suse.com/1270870","tags":["report"]},{"url":"https://bugzilla.suse.com/1270874","tags":["report"]},{"url":"https://bugzilla.suse.com/1270989","tags":["report"]},{"url":"https://bugzilla.suse.com/1274144","tags":["report"]},{"url":"https://bugzilla.suse.com/1282217","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624127-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1283239","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624223-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262441-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262831-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1203257","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263022-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1210346","tags":["report"]},{"url":"https://bugzilla.suse.com/1223238","tags":["report"]},{"url":"https://bugzilla.suse.com/1229955","tags":["report"]},{"url":"https://bugzilla.suse.com/1242611","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-26964","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-32650","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-43806","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263992-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-25727","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-25727","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-25727","title":"time affected by a stack exhaustion denial of service attack","description":"time provides date and time handling in Rust. From 0.3.6 to before 0.3.47, when user-provided input is provided to any type that parses with the RFC 2822 format, a denial of service attack via stack exhaustion is possible. The attack relies on formally deprecated and rarely-used features that are part of the RFC 2822 format used in a malicious manner. Ordinary, non-malicious input will never encounter this scenario. A limit to the depth of recursion was added in v0.3.47. From this version, an error will be returned rather than exhausting the stack.","status":"published","published":"2026-02-06T19:20:56.298Z","modified":"2026-02-06T20:22:58.488Z","cvss":[{"version":"4.0","score":6.8,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H","level":"medium","assessor":"cna"}],"cwes":["CWE-121"],"updated_at":"2026-11-02T13:41:19.694734Z"}],"euvd":[{"id":"EUVD-2026-5587","description":"time provides date and time handling in Rust. From 0.3.6 to before 0.3.47, when user-provided input is provided to any type that parses with the RFC 2822 format, a denial of service attack via stack exhaustion is possible. The attack relies on formally deprecated and rarely-used features that are part of the RFC 2822 format used in a malicious manner. Ordinary, non-malicious input will never encounter this scenario. A limit to the depth of recursion was added in v0.3.47. From this version, an error will be returned rather than exhausting the stack.","status":"published","published":"2026-02-06T19:20:56Z","modified":"2026-02-06T20:22:58Z","cvss":[{"version":"4.0","score":6.8,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H","level":"medium"}],"updated_at":"2026-11-02T19:48:42.836553Z"}],"ghsa":[{"id":"GHSA-r6v5-fh4h-64xc","title":"time vulnerable to stack exhaustion Denial of Service attack","description":"### Impact\n\nWhen user-provided input is provided to any type that parses with the RFC 2822 format, a denial of service attack via stack exhaustion is possible. The attack relies on formally deprecated and rarely-used features that are part of the RFC 2822 format used in a malicious manner. Ordinary, non-malicious input will never encounter this scenario.\n\n### Patches\n\nA limit to the depth of recursion was added in v0.3.47. From this version, an error will be returned rather than exhausting the stack.\n\n### Workarounds\n\nLimiting the length of user input is the simplest way to avoid stack exhaustion, as the amount of the stack consumed would be at most a factor of the length of the input.\n\nAlternatively, avoiding the format altogether would also ensure that the vulnerability is not encountered. To do this, add\n\n```toml\ndisallowed-types = [\"time::format_description::well_known::Rfc2822\"]\n```\n\nto your `clippy.toml` file. This will trigger the `clippy::disallowed_types` lint, which is warn-by-default and can be explicitly denied.","status":"published","published":"2026-02-05T17:57:55Z","modified":"2026-02-23T22:34:25Z","cvss":[{"version":"4.0","score":6.8,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H","level":"medium"}],"cwes":["CWE-121"],"updated_at":"2026-11-02T14:39:26.881079Z"}],"nvd":[{"id":"CVE-2026-25727","description":"time provides date and time handling in Rust. From 0.3.6 to before 0.3.47, when user-provided input is provided to any type that parses with the RFC 2822 format, a denial of service attack via stack exhaustion is possible. The attack relies on formally deprecated and rarely-used features that are part of the RFC 2822 format used in a malicious manner. Ordinary, non-malicious input will never encounter this scenario. A limit to the depth of recursion was added in v0.3.47. From this version, an error will be returned rather than exhausting the stack.","status":"published","published":"2026-02-06T20:16:11.86Z","modified":"2026-06-17T10:25:07.083Z","cvss":[{"version":"4.0","score":6.8,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"}],"cwes":["CWE-121"],"updated_at":"2026-11-02T14:12:05.52517Z"}],"osv":[{"id":"CVE-2026-25727","title":"time affected by a stack exhaustion denial of service attack","description":"time provides date and time handling in Rust. From 0.3.6 to before 0.3.47, when user-provided input is provided to any type that parses with the RFC 2822 format, a denial of service attack via stack exhaustion is possible. The attack relies on formally deprecated and rarely-used features that are part of the RFC 2822 format used in a malicious manner. Ordinary, non-malicious input will never encounter this scenario. A limit to the depth of recursion was added in v0.3.47. From this version, an error will be returned rather than exhausting the stack.","status":"published","published":"2026-02-06T19:20:56.298Z","modified":"2026-10-28T02:30:26.178831315Z","cvss":[{"version":"4.0","score":6.8,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H","level":"medium"}],"cwes":["CWE-121"],"updated_at":"2026-11-02T15:44:59.438965Z"},{"id":"DEBIAN-CVE-2026-25727","description":"time provides date and time handling in Rust. From 0.3.6 to before 0.3.47, when user-provided input is provided to any type that parses with the RFC 2822 format, a denial of service attack via stack exhaustion is possible. The attack relies on formally deprecated and rarely-used features that are part of the RFC 2822 format used in a malicious manner. Ordinary, non-malicious input will never encounter this scenario. A limit to the depth of recursion was added in v0.3.47. From this version, an error will be returned rather than exhausting the stack.","status":"published","published":"2026-02-06T20:16:11.86Z","modified":"2026-10-01T03:03:09.001247038Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:53.877573Z"},{"id":"GHSA-r6v5-fh4h-64xc","title":"time vulnerable to stack exhaustion Denial of Service attack","description":"### Impact\n\nWhen user-provided input is provided to any type that parses with the RFC 2822 format, a denial of service attack via stack exhaustion is possible. The attack relies on formally deprecated and rarely-used features that are part of the RFC 2822 format used in a malicious manner. Ordinary, non-malicious input will never encounter this scenario.\n\n### Patches\n\nA limit to the depth of recursion was added in v0.3.47. From this version, an error will be returned rather than exhausting the stack.\n\n### Workarounds\n\nLimiting the length of user input is the simplest way to avoid stack exhaustion, as the amount of the stack consumed would be at most a factor of the length of the input.\n\nAlternatively, avoiding the format altogether would also ensure that the vulnerability is not encountered. To do this, add\n\n```toml\ndisallowed-types = [\"time::format_description::well_known::Rfc2822\"]\n```\n\nto your `clippy.toml` file. This will trigger the `clippy::disallowed_types` lint, which is warn-by-default and can be explicitly denied.","status":"published","published":"2026-02-05T17:57:55Z","modified":"2026-09-10T03:50:35.583241382Z","cvss":[{"version":"4.0","score":6.8,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H","level":"medium"}],"cwes":["CWE-121"],"updated_at":"2026-11-02T15:46:55.480549Z"},{"id":"RUSTSEC-2026-0009","title":"Denial of Service via Stack Exhaustion","description":"## Impact\n\nWhen user-provided input is provided to any type that parses with the RFC 2822 format, a denial of\nservice attack via stack exhaustion is possible. The attack relies on formally deprecated and\nrarely-used features that are part of the RFC 2822 format used in a malicious manner. Ordinary,\nnon-malicious input will never encounter this scenario.\n\n## Patches\n\nA limit to the depth of recursion was added in v0.3.47. From this version, an error will be returned\nrather than exhausting the stack.\n\n## Workarounds\n\nLimiting the length of user input is the simplest way to avoid stack exhaustion, as the amount of\nthe stack consumed would be at most a factor of the length of the input.","status":"published","published":"2026-02-05T12:00:00Z","modified":"2026-02-06T09:17:04.230802Z","cvss":[{"version":"4.0","score":6.8,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H","level":"medium"}],"updated_at":"2026-11-02T15:53:40.430679Z"},{"id":"UBUNTU-CVE-2026-25727","description":"time provides date and time handling in Rust. From 0.3.6 to before 0.3.47, when user-provided input is provided to any type that parses with the RFC 2822 format, a denial of service attack via stack exhaustion is possible. The attack relies on formally deprecated and rarely-used features that are part of the RFC 2822 format used in a malicious manner. Ordinary, non-malicious input will never encounter this scenario. A limit to the depth of recursion was added in v0.3.47. From this version, an error will be returned rather than exhausting the stack.","status":"published","published":"2026-02-06T20:16:00Z","modified":"2026-05-20T16:24:47.086140738Z","cvss":[{"version":"4.0","score":6.8,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H","level":"medium"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:56:08.726452Z"},{"id":"AZL-76821","title":"CVE-2026-25727 affecting package azl-compliance for versions less than 1.0.2-3","description":"time provides date and time handling in Rust. From 0.3.6 to before 0.3.47, when user-provided input is provided to any type that parses with the RFC 2822 format, a denial of service attack via stack exhaustion is possible. The attack relies on formally deprecated and rarely-used features that are part of the RFC 2822 format used in a malicious manner. Ordinary, non-malicious input will never encounter this scenario. A limit to the depth of recursion was added in v0.3.47. From this version, an error will be returned rather than exhausting the stack.","status":"published","published":"2026-02-06T20:16:11Z","modified":"2026-04-21T04:34:04.862152Z","updated_at":"2026-11-02T15:28:09.747541Z"},{"id":"AZL-76994","title":"CVE-2026-25727 affecting package kata-containers for versions less than 3.19.1.kata2-6","description":"time provides date and time handling in Rust. From 0.3.6 to before 0.3.47, when user-provided input is provided to any type that parses with the RFC 2822 format, a denial of service attack via stack exhaustion is possible. The attack relies on formally deprecated and rarely-used features that are part of the RFC 2822 format used in a malicious manner. Ordinary, non-malicious input will never encounter this scenario. A limit to the depth of recursion was added in v0.3.47. From this version, an error will be returned rather than exhausting the stack.","status":"published","published":"2026-02-06T20:16:11Z","modified":"2026-08-28T17:46:31.970454682Z","updated_at":"2026-11-02T15:28:09.747541Z"},{"id":"AZL-77030","title":"CVE-2026-25727 affecting package librsvg2 2.58.1-5","description":"time provides date and time handling in Rust. From 0.3.6 to before 0.3.47, when user-provided input is provided to any type that parses with the RFC 2822 format, a denial of service attack via stack exhaustion is possible. The attack relies on formally deprecated and rarely-used features that are part of the RFC 2822 format used in a malicious manner. Ordinary, non-malicious input will never encounter this scenario. A limit to the depth of recursion was added in v0.3.47. From this version, an error will be returned rather than exhausting the stack.","status":"published","published":"2026-02-06T20:16:11Z","modified":"2026-04-21T04:34:09.685929Z","updated_at":"2026-11-02T15:28:09.747541Z"},{"id":"AZL-77034","title":"CVE-2026-25727 affecting package rust 1.72.0-14","description":"time provides date and time handling in Rust. From 0.3.6 to before 0.3.47, when user-provided input is provided to any type that parses with the RFC 2822 format, a denial of service attack via stack exhaustion is possible. The attack relies on formally deprecated and rarely-used features that are part of the RFC 2822 format used in a malicious manner. Ordinary, non-malicious input will never encounter this scenario. A limit to the depth of recursion was added in v0.3.47. From this version, an error will be returned rather than exhausting the stack.","status":"published","published":"2026-02-06T20:16:11Z","modified":"2026-04-21T04:34:09.827888Z","updated_at":"2026-11-02T15:28:09.747541Z"},{"id":"AZL-77087","title":"CVE-2026-25727 affecting package rust for versions less than 1.75.0-27","description":"time provides date and time handling in Rust. From 0.3.6 to before 0.3.47, when user-provided input is provided to any type that parses with the RFC 2822 format, a denial of service attack via stack exhaustion is possible. The attack relies on formally deprecated and rarely-used features that are part of the RFC 2822 format used in a malicious manner. Ordinary, non-malicious input will never encounter this scenario. A limit to the depth of recursion was added in v0.3.47. From this version, an error will be returned rather than exhausting the stack.","status":"published","published":"2026-02-06T20:16:11Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:24.626116Z"},{"id":"AZL-77091","title":"CVE-2026-25727 affecting package rust for versions less than 1.90.0-6","description":"time provides date and time handling in Rust. From 0.3.6 to before 0.3.47, when user-provided input is provided to any type that parses with the RFC 2822 format, a denial of service attack via stack exhaustion is possible. The attack relies on formally deprecated and rarely-used features that are part of the RFC 2822 format used in a malicious manner. Ordinary, non-malicious input will never encounter this scenario. A limit to the depth of recursion was added in v0.3.47. From this version, an error will be returned rather than exhausting the stack.","status":"published","published":"2026-02-06T20:16:11Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:24.626116Z"},{"id":"openSUSE-FU-2026:20453-1","title":"Feature update for himmelblau","description":"This update for himmelblau fixes the following issues:\n\nUpdate to himmelblau 2.3.8 (jsc#PED-14511):\n\nSecurity issues:\n\n- CVE-2025-54882: world readable cloud TGT token (bsc#1247735).\n- CVE-2025-58160: tracing-subscriber: Tracing log pollution (bsc#1249013).\n- CVE-2026-25727: time: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion\n  (bsc#1257904).\n- CVE-2026-31979: race condition when accessiung /tmp/krb5cc_\u003cuid\u003e (bsc#1259548).\n\nNon security issues:\n\n- Fix SELinux module packaging to use standard policy macros (bsc#1258236).\n\nChangelog:\n\nVersion 2.3.8:\n\n * Add PrivateTmp back to Tasks Daemon\n * Drop dead code\n * Drop krb5 ccache dir code\n * Add a TODO comment\n * Drop non working packaged krb5 snippet file\n * Write kerberos config snippet\n * Extend resolver interface to return kerberos config together with TGTs\n * Backport SELinux fixes from main\n * Use libkrimes to store TGTs\n\nVersion 2.3.7:\n\n * cargo vet\n * Fix AWS-LC has PKCS7_verify Certificate Chain Validation Bypass\n * Revert dependency change which broke the nightly build\n * gen_dockerfiles: only himmelblaud has tpm feature, fix all others\n * fix(build): gen_dockerfiles.py mutates shared features list mid-loop\n\nVersion 2.3.5:\n\n * Better handle Intune API version\n * Update make vet from main branch\n * pam_himmelblau: call split_username once in chauthtok\n * pam_himmelblau: return PAM_IGNORE in chauthtok for local users\n * Don't attempt a DAG when Hello fails with SSPR demand\n\nVersion 2.3.4:\n\n * deps(rust): bump the all-cargo-updates group across 1 directory with 8 updates\n * Revert sketching update (which breaks SLE16 build)\n\nVersion 2.3.3:\n\n * /var/cache/private/himmelblaud should not be created tmpfiles\n * Updatee python vers for dataclasses dep\n * deps(rust): bump the all-cargo-updates group across 1 directory with 3 updates\n * Generate pin init service file systemd \u003c 250\n * Checkin missing himmelblaud.if file for SELinux\n * Resolve typos in selinux package commands\n\nVersion 2.3.2:\n\n * Compile SELinux policy at install time for cross-distro compatibility\n * Improve PAM configuration on openSUSE/SLE\n * Fix SELinux policy\n * Add a git hook to ensure selinux policy is tested\n * Ignore generated himmelblau-hsm-pin-init service file\n * Refactor SELinux policy for cross-distro compatibility\n * Fix NSS lookup for mapped local users\n * Skip OS version compliance checks when min/max values are empty\n\nVersion 2.3.1:\n\n * Remove references to qrcodegen (these are 3.x features)\n * QR Greeter compatibility for old GNOME\n * Enable QR greeter automatically\n * ci: Use latest cargo-vet from git to fix CI\n * Fix HSM pin migration failure on Debian/Ubuntu upgrades from v1.4.x\n\nVersion 2.3.0:\n\n * Autostart the daemons on fresh install or upgrade\n * Restart sshd when installing the ssh config\n * Allow tasks daemon to write krb ccache\n * Do not enumerate mapped users in NSS\n * Update libhimmelblau to latest version\n * Fix Tumbleweed build\n\nVersion 2.2.0:\n\n * Update libhimmelblau to 0.8.x series\n * deps(rust): bump the all-cargo-updates group with 17 updates\n * Only use OpenSSH bug workaround for ssh service\n * Fix debug noise from removing user from sudo group\n * systemd: install files to /usr/lib/, not /etc/\n\nVersion 2.1.0:\n\n * Fix nightly authselect build failure\n * Generate the authselect profiles for each distro\n * Improve pam config handling in aad-tool\n * Make `aad-tool configure-pam` detect location of pam files\n\nVersion 2.0.5:\n\n * /var/lib/private/himmelblaud should be owned by root\n * Use tmpfiles.d to create himmelblaud private data directory\n * deps(rust): bump the all-cargo-updates group with 13 updates\n\nVersion 2.0.4:\n\n * Update kanidm_build_profiles mask version\n * Utilize cargo vet from main\n * Add policies cache patch via systemd-tmpfiles\n\n * Fix man page comments about change idmap_range\n * Stub picky-krb for osc build\n * Stub a kanidm_build_profiles which builds in osc\n * Ensure nss cache is created on Ubuntu/Debian\n * Request a user token if NSS hasn't been called\n\nVersion 2.0.3:\n\n * Add nss cache patch via systemd-tmpfiles\n\nVersion 2.0.2:\n\n * Recommend `patch` with the pam package\n * Fix passwordless FIDO authentication not being used when available\n * Git workflow updates for stable-2.x\n * Only warn on Intune failure\n\nVersion 2.0.1:\n\n * Force o365 desktop files to always rebuild\n * Always rebuild the o365 apps\n * Add restart on-failure to systemd services\n * Clarify `domain` SHOULD match login domain\n * Remove warning about `domain` himmelblau.conf opt\n * Pseudo eliminate multi-tenant and domains section\n * Revert \"Fix Hello PIN lookup when an alias domain\"\n * Comment out `KbdInteractiveAuthentication on` in sshd conf\n * Check the nxset sooner, to avoid unwanted errors\n * Recommend oddjob_mkhomedir with authselect\n * Pin libhimmelblau to 0.7.x\n * Deprecate Fedora 41\n * deps(rust): bump the all-cargo-updates group with 11 updates\n * Bump github/codeql-action from 4.30.8 to 4.31.2\n * Bump cachix/install-nix-action from 31.8.1 to 31.8.2\n * Bump actions/upload-artifact from 4.6.2 to 5.0.0\n * cargo clippy and rebase fix\n * fixup! add extra debug output to NotFound error code\n * force error output to show up in CI logs\n * wrap repeated sources of IdpError::NotFound in helper functions\n * add extra debug output to NotFound error code\n * use direnv for loading the nix devshell\n * We should still encourage mapping by name\n * Add support for Fedora 43\n * Provide a offline 'breakglass' mode\n * cargo clippy\n * Add warning about incorrect nsswitch configuration\n * Distinguish between online and offline token fail\n * Ensure user token uses original name\n * Fix alias domain in auth result causing failure\n * Resolve cargo clippy warnings\n * Only map on cn name for the primary domain\n * Install systemd in build scripts for gen service\n * Fix systemd version parsing\n * Update libhimmelblau to 0.7.19\n * Resolve SELinux build failures in nightly (part 2)\n * Rocky container image updates were failing\n * Warn instead of error when no idmap_range specified\n * deps(rust): bump the all-cargo-updates group across 1 directory with 7 updates\n * Trim whitespace from local group names\n * Fix borrowing error\n * Fix reference to local_sudo_group in condition\n * Only run sudo_groups if local_groups does not contain local_sudo_group\n * Leave SELinux in permissive mode for Himmelblau\n * Resolve SELinux build failures in nightly\n * nix: add join_type option to nixos-module settings\n * Build host configuration changes\n * Ensure that hsm_pin isn't present decrypted\n * Document Soft HSM changes to TPM bound\n * Disable SELinux by default on NixOS\n * sh doesn't have `source`\n * Encrypt hsm-pin using systemd-creds\n * Recommend uuid id mapping\n * Improve himmelblau.conf man page formatting\n * Implement Local User Mapping\n * Add o365 dependency for jq\n * Add selinux rules for gdm login\n * Narrow the scope of selinux policy with audit2allow\n * Generate the systemd service files\n * Fix selinux build for SLE16\n * Resolve SLE16 build dependency failure\n * Fix the rawhide build\n * Mask the sshkey-attest package\n * Bump cachix/install-nix-action from 31.7.0 to 31.8.1\n * cargo vet dependency updates\n * deps(rust): bump the all-cargo-updates group across 1 directory with 13 updates\n * Bump actions/dependency-review-action from 4.8.0 to 4.8.1\n * Bump cachix/install-nix-action from 31.7.0 to 31.8.0\n * Bump github/codeql-action from 3.30.5 to 4.30.8\n * Bump ossf/scorecard-action from 2.4.2 to 2.4.3\n * SELinux improvements\n * Fix a typo in package gen scripts\n * cargo fmt\n * Permit NSS response for mapped primary fake group\n * Fix Nix Error With Fuzz\n * Decrease CI fuzzer setup time\n * Document join types\n * Support for Entra registered devices\n * Run `cargo test` in a container\n * Bump cachix/install-nix-action from 31.6.2 to 31.7.0\n * deps(rust): bump the all-cargo-updates group across 1 directory with 2 updates\n * Bump github/codeql-action from 3.30.4 to 3.30.5\n * Use pastey crate instead of unmaintained paste\n * Pin unmaintained serde_cbor dep to serde_cbor_2\n * Resolve tower-http `cargo audit` warning\n * Replace unmaintained fxhash with own version\n * Resolve warning about workflow top level write permissions\n * Remove dependabot automerge\n * Resolve division by 0 in idmap code\n * [StepSecurity] ci: Harden GitHub Actions\n * Only idmap against initialized domains\n * Resolve invalid init of idmap with same domain\n * Add fuzzing of idmap code\n * Add basic fuzzing of the config options\n * Resolve error found by fuzzing\n * cargo vet prune\n * deps(rust): bump regex in the all-cargo-updates group\n * Bump actions/dependency-review-action from 4.7.3 to 4.8.0\n * Bump actions/checkout from 3.6.0 to 5.0.0\n * Bump cachix/cachix-action from 14 to 16\n * Bump ossf/scorecard-action from 2.4.0 to 2.4.2\n * Bump cachix/install-nix-action from 25 to 31\n * Add the OpenSSF Best Practices badge\n * Add scorecard badge\n * [StepSecurity] Apply security best practices\n * Fix group static mapping\n * Move aad-tool idmap cache clear to the idmap cmd\n * Resolve errant \"Hello key missing.\" messages\n * Update flake.nix\n * Slow the dependabot update frequency\n * Audit dependabot updates\n * deps(rust): bump the all-cargo-updates group across 1 directory with 11 updates\n * feat: Add support for aarch64 on Debian-based distributions\n * Resolve possible invalid pointer dereferences\n * Avoid revealing account ids in debug log\n * Cause doc links to open in the correct apps\n * Permit opening multiple instances of Word/Excel\n * Modify systray and app close behavior\n * Don't use questionably licensed icons for o365\n * Resolve NixOS CI failure\n * Fix building w/out deprecated interactive feature\n * Update himmelblau.conf.5 sudo_groups example\n * Entra group based sudo access\n * Audited the cargo updates\n * deps(rust): bump the all-cargo-updates group with 6 updates\n * Vet libhimmelblau\n * Add `make vet` command\n * Update deny.toml\n * Remove incompatible licenses from deps\n * Fix RHEL8 package signing\n * Add SBOM generation\n * Add an IRP checklist for security incidents\n * Run the nixos build/release on the correct version\n * Add crate dependency auditing on MR\n * Add some exceptions\n * Initialize cargo vet\n * Remove in-tree kanidm dependencies\n * Fix Hello PIN lookup when an alias domain\n * Raise maximum group lookup from 100 to 999\n * Always work with lowercase account names\n * Modify FUNDING.yml for funding sources\n * Remove glib dependency\n * deps(rust): bump the all-cargo-updates group with 10 updates\n * Add CI check for licenses\n * Update dependabot.yml to target all stable branches\n * Add authselect module for Rocky/Fedora\n * Recommend packages, instead of require\n * Add a Contributing document\n * Add a Code of Conduct\n * add withSelinux flag to nix build, brings SELinux binaries into the build environment.\n * deps(rust): bump tracing-subscriber in the cargo group\n * Don't overwrite the himmelblau.conf on rpm upgrade\n * Add help output to the Makefile\n * Fix building packages with docker in root mode\n * Update to latest libhimmelblau and identity_dbus_broker\n * Make PRT SSO cookie via broker work as well for Edge\n * Make broker work for Edge\n * Generate Office 365 desktop apps\n * Update README\n * Add `make uninstall` command\n * Remove the deprecated tests suite\n * Himmelblau no longer has git submodules\n * Make install using packages\n * Add Debian 13 packages\n * Generate Dockerfiles automatically\n * Add SELinux configuration\n * Himmelblau daemon requires system tss user\n * Add cron dependency for Intune scripts\n * Do not mangle /usr/etc configuration files\n * deps(rust): bump the all-cargo-updates group with 7 updates\n * Add SLE16 (beta) build target\n * Automatically append to nsswitch.conf in postinst\n * Correct the RPM postinst script syntax\n * Fix Kerberos credential cache permissions\n * Set file owner and group before writing its content\n * Create SECURITY.md\n * Rev the dev version to 2.0.0\n * Ensure alias domains match when checking Intune device id\n * Debian 12 doesn't support ConditionPathExists and notify-reload\n * Write scripts policy to a readable directory\n * Apply Intune policies right after enrollment\n * Add more debug instrumentation\n * Provide device_id to Intune enrollment if not cached\n * Ensure nss cache directory is created during install\n * Remove /var/cache/himmelblaud access from tasks daemon\n * Resolve daemon startup absolute path warnings\n * Delay Intune enrollment on Device Auth fail\n * Do not leak the Intune IW service token in the logs\n\nVersion 1.4.2:\n\n * Revert libhimmelblau unstable update\n\nVersion 1.4.1:\n\n * Update Intune to use app version 1.2511.7\n\nVersion 1.4.0:\n\n * Resolve build failures\n * deps(rust): bump the all-cargo-updates group across 1 directory with 6 updates\n\nVersion 1.3.0:\n\n * Revert the self-hosted runner name\n * deps(rust): bump the all-cargo-updates group with 23 updates\n * Include latest branch in CI\n * Self hosted runners\n\nVersion 1.1.0:\n\n * Fix policy application\n * Add remaining Linux password compliance policies\n * Add custom compliance enforcement\n * deps(rust): bump the all-cargo-updates group with 3 updates\n * deps(rust): bump the all-cargo-updates group with 5 updates\n * Add SLE15SP7 build target\n * Add RHEL 10 build target\n * Fix Intermittent auth issue AADSTSError 16000\n * Remove old utf8proc dependency\n * Add `fedora42` build target\n * Handle PRT expiration and tie to offline auth\n * Correctly delete the Hello keys on bad pin count\n * Add ability to disable Hello PIN per-service\n * Update NixOS support to 25.05\n * Handle disabled device by attempting re-enrollment\n * Always attempt confidential client creds for aad-tool\n * Include HSM option defs in himmelblau.conf man page\n * Improve the aad-tool cache-clear command\n * Add `mfaSshWorkaroundFlag` configuration option to Nix Flake.\n * Add the ability to remove confidential client creds\n * If bad PIN count is exceeded, delete the Hello key\n * deps(rust): bump the all-cargo-updates group with 4 updates\n * Add instructions for creating developer builds\n * Fix GDM3 first time login password prompt\n * Default HsmType should be soft\n * Add himmelblaud to tss group for TPM startup\n * Enforce strict order for the systemd units\n * Update libhimmelblau and compact_jwt\n * Fix builds w/tpm\n * aad-tool Authentication flow improvements\n * Filter out irrelevant debug in aad-tool\n * Create a unified login experience for aad-tool\n * Utilize confidential creds for aad-tool enumerate\n * himmelblau should get posix attributes w/out delegate user access\n * Always use the Object Id for mapping Group to GID\n * Update enhancement-request.md for SPI donations\n * Update bug_report.md with SPI donation\n * Update build requires in README.md\n * Update FUNDING.yml with SPI Paypal donation button\n * Don't break from tasks loop when policies fail\n * Enroll in Intune as soon as it is enabled\n * Implement `decoupled hello` behavior\n * Cache encrypted PRT to disk for offline login SSO\n * Update to latest hsm-crypto\n * Enable tpm functionality\n * Allow altering the password and PIN prompt messages\n * Ensure Hello PIN lockout happens when online\n * Cache the build target output to improve build times\n * Easier build selection w/ Makefile\n * Revert mistaken removal from Makefile\n * Make the user wait longer with each incorrect PIN\n * Make the bad PIN count configurable\n * Improve aad-tool manpage\n * aad-tool fails if the user has FIDO2 enabled\n * Offline auth permits authentication with invalid Hello PIN\n * PIN complexity to match Windows\n * Update to latest SSSD idmap code\n * Add aad-tool options for setting posix attrs\n * Add scopes and redirect uris aad-tool application create\n * Add aad-tool commands for managaging extension attrs\n * Utilize the sidtoname call for object id mapping\n * Add commands for listing/creating App registrations\n * Potential fix for code scanning alert no. 2: Workflow does not contain permissions\n * Potential fix for code scanning alert no. 4: Workflow does not contain permissions\n * Potential fix for code scanning alert: Workflow does not contain permissions\n * Never write the app_id to the server config\n * Disable passwordless Fido by default\n * Stop using deprecated `users` crate\n * When group membership lookup fails, use cached groups\n * aad-tool command for enumerating users and groups\n * Name-Based Group Matching in `pam_allow_groups` Leads to Potential Security Bypass\n * Add the configure-pam option to aad-tool man page\n * Add static idmap cache for on-prem to cloud migration\n * Update bug_report.md with request for himmelblau.conf\n * deps(rust): bump the all-cargo-updates group with 2 updates\n * Update crates in a group\n * Update crate bumps\n * Utilize new Intune compliance enforcement via libhimmelblau\n * Correct the README regarding Intune policy compliance\n * Disable Chromium policy\n * Re-enable Intune policy and add scripts and compliance policies\n * himmelblau.conf alias `domain` as `domains`\n * Support Fido auth in pam passwd\n * Add TAP support to himmelblaud and pam passwd\n * Mixed case names should properly identify Hello Key\n * Update linux-entra-sso to latest version\n * Fix group lookup for Entra Id group name\n * Fix mixed case name lookup from PRT cache\n * Crate updates\n * Fix tasks daemon debug output\n * Remove write locks where unecessary\n * Fix deadlock in nss\n * systemd notify fixes\n * Console\n * Address Feedback\n * Order services before gdb/nss-user-target\n * deps(rust): bump rpassword from 7.3.1 to 7.4.0\n * deps(rust): bump tokio from 1.44.2 to 1.45.0\n * deps(rust): bump sha2 from 0.10.8 to 0.10.9\n * deps(rust): bump systemd-journal-logger from 2.2.0 to 2.2.2\n * deps(rust): bump clap from 4.5.31 to 4.5.38\n * Update notify-debouncer-full\n * Update opentelemetry\n * Update dependencies\n * deps(rust): bump time from 0.3.39 to 0.3.41\n * Replace source filter that blacklists files with filter that whitelists files.\n * Mark himmelblau.conf as config in rpm\n * Update README.md\n * Ensure only the base URL is printed to log\n * If unix_user_get fails, wait, and try again\n * Supplying a PRT cookie to SSO doesn't require network\n * Don't send a password prompt if the network is down\n * Auth via MFA if Hello PIN fails 3 times\n * Improve Hello PIN failed auth error\n * Fix rocky9 build\n * deps(rust): bump anyhow from 1.0.96 to 1.0.98\n * deps(rust): bump libc from 0.2.170 to 0.2.172\n * deps(rust): bump cc from 1.2.16 to 1.2.19\n * deps(rust): bump tokio from 1.43.0 to 1.44.2\n * deps(rust): bump openssl from 0.10.71 to 0.10.72 in the cargo group\n * deps(rust): bump reqwest from 0.12.12 to 0.12.15\n * Update libhimmelblau in Cargo.lock\n * Fix nss and offline checks for domain aliases\n * Report error when MS Authenticator denies authorization\n * Bail out of invalid offline auth\n * Handle AADSTS errors from BeginAuth response\n * Never dump failed reqwests to the log\n * Update sccache-action version to use new cache service\n * Permit daemon to start when network is down\n * Add an nss cache for when daemon is down\n * Additional pam info cues\n * Proceed with Hello auth even with net down\n * Indicate to the user what the password and PIN are\n * Ensure pam messages are seen\n * Display the minimum PIN length during Hello setup\n * PAM should loop, not die on error\n * Ensure prompt msg remains for confirmation\n * Update bug_report.md\n * Ignore demands for setting up MS Authenticator\n * Login fails if Entra is configured to recommend MS authenticator\n * Add pam configure command to aad-tool\n * Update README.md with pam passwd instructions\n * aad-tool authtest needs to map names\n * Update demo video in README.md\n * Sign RPM packages\n * Ensure the pam module is installed correctly for SLE\n * Improve pam error handling and messaging\n * Only push cachix builds for stable releases\n * Terminate linux-entra-sso when browser terminates\n * On deb, push pam config after install\n * Increase priority of deb PAM passwd for Himmelblau\n * Improve offline state handling\n * Specify request for Entra Id password in PAM\n * QR Greeter also supports gnome-shell 47\n * Fix profile photo loading\n * Clarify pam_allow_groups in himmelblau.conf man page\n * Don't hide debug for pam_allow_groups miss\n * Handle failures in passwordless auth\n * build all root packages\n * split config options that can be defined per-domain from those which are global only\n * configure cachix signing and upload in ci\n * deps(rust): bump serde_json from 1.0.138 to 1.0.140\n * deps(rust): bump serde from 1.0.218 to 1.0.219\n * deps(rust): bump time from 0.3.37 to 0.3.39\n * deps(rust): bump bytes from 1.10.0 to 1.10.1\n * deps(rust): bump pkg-config from 0.3.31 to 0.3.32\n * Entra Id is case insensitive, cache lookup must match\n * deps(rust): bump ring from 0.17.9 to 0.17.13 in the cargo group\n * Support CompanionAppsNotification mfa method\n * QR code for gnome-shell greeter\n * Allow tasks to start if AccountsService dir missing\n * Remove invalid python dependency from sso package\n * Fixes https://github.com/himmelblau-idm/himmelblau/issues/397\n * Clear server config when clearing cache\n * Update version in the Cargo.lock\n * deps(rust): bump async-trait from 0.1.86 to 0.1.87\n * deps(rust): bump chrono from 0.4.39 to 0.4.40\n * Fix himmelblau.conf man page cn_name_mapping entry\n * deps(rust): bump pem from 3.0.4 to 3.0.5\n * deps(rust): bump serde from 1.0.217 to 1.0.218\n\nVersion 1.0.0:\n\n * deps(rust): bump cc from 1.2.15 to 1.2.16\n * Update workflow versions\n","status":"published","published":"2026-04-01T09:26:05Z","modified":"2026-04-03T07:45:28.189462Z","updated_at":"2026-11-02T16:58:30.39372Z"},{"id":"openSUSE-SU-2026:10170-1","title":"keylime-ima-policy-0.2.8+116-1.1 on GA media","description":"These are all security issues fixed in the keylime-ima-policy-0.2.8+116-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-02-10T00:00:00Z","modified":"2026-03-23T04:54:31.883037Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"openSUSE-SU-2026:10172-1","title":"wicked2nm-1.4.1-1.1 on GA media","description":"These are all security issues fixed in the wicked2nm-1.4.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-02-10T00:00:00Z","modified":"2026-03-23T04:54:32.191208Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"openSUSE-SU-2026:10175-1","title":"cargo-audit-0.22.1~git0.efcde93-2.1 on GA media","description":"These are all security issues fixed in the cargo-audit-0.22.1~git0.efcde93-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-02-11T00:00:00Z","modified":"2026-03-23T04:54:32.353974Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"openSUSE-SU-2026:10179-1","title":"python311-maturin-1.11.5-1.1 on GA media","description":"These are all security issues fixed in the python311-maturin-1.11.5-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-02-11T00:00:00Z","modified":"2026-03-23T04:54:32.401477Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"openSUSE-SU-2026:10180-1","title":"rustup-1.28.2~0-3.1 on GA media","description":"These are all security issues fixed in the rustup-1.28.2~0-3.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-02-11T00:00:00Z","modified":"2026-03-23T04:54:32.494688Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"openSUSE-SU-2026:10181-1","title":"sccache-0.13.0~1-2.1 on GA media","description":"These are all security issues fixed in the sccache-0.13.0~1-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-02-11T00:00:00Z","modified":"2026-03-23T04:54:32.571803Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"openSUSE-SU-2026:10182-1","title":"snpguest-0.10.0-2.1 on GA media","description":"These are all security issues fixed in the snpguest-0.10.0-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-02-11T00:00:00Z","modified":"2026-03-23T04:54:32.43177Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"openSUSE-SU-2026:10184-1","title":"cargo-auditable-0.7.2~0-2.1 on GA media","description":"These are all security issues fixed in the cargo-auditable-0.7.2~0-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-02-12T00:00:00Z","modified":"2026-03-23T04:54:32.507101Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"openSUSE-SU-2026:10185-1","title":"cargo-c-0.10.15-2.1 on GA media","description":"These are all security issues fixed in the cargo-c-0.10.15-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-02-12T00:00:00Z","modified":"2026-03-23T04:54:32.744509Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"openSUSE-SU-2026:10202-1","title":"himmelblau-2.3.5+git0.9dd526c-1.1 on GA media","description":"These are all security issues fixed in the himmelblau-2.3.5+git0.9dd526c-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-02-14T00:00:00Z","modified":"2026-03-23T04:54:34.391232Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"openSUSE-SU-2026:10308-1","title":"virtiofsd-1.13.2-2.1 on GA media","description":"These are all security issues fixed in the virtiofsd-1.13.2-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-03-07T00:00:00Z","modified":"2026-03-08T15:45:06.946585Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"openSUSE-SU-2026:11656-1","title":"aws-nitro-enclaves-binaryblobs-upstream-1.5.0~git0.2950b36-1.1 on GA media","description":"These are all security issues fixed in the aws-nitro-enclaves-binaryblobs-upstream-1.5.0~git0.2950b36-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-01T00:00:00Z","modified":"2026-09-02T11:15:03.856852178Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:20245-1","title":"Security update for wicked2nm","description":"This update for wicked2nm fixes the following issues:\n\n- Update to version 1.4.1\n- CVE-2026-25727: time: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion (bsc#1257908).\n","status":"published","published":"2026-02-17T14:08:05Z","modified":"2026-03-23T04:54:48.269686Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"openSUSE-SU-2026:20326-1","title":"Security update for virtiofsd","description":"This update for virtiofsd fixes the following issue:\n\n- CVE-2026-25727: time: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion\n  (bsc#1257912).\n","status":"published","published":"2026-03-05T14:23:19Z","modified":"2026-03-23T04:54:50.860455Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"openSUSE-SU-2026:20364-1","title":"Security update for rust-keylime","description":"This update for rust-keylime fixes the following issues:\n\n- Update to version 0.2.8+116:\n- CVE-2026-25727: Update vendored crates to fix a date parser can lead to stack exhaustion in Time. (bsc#1257908)\n","status":"published","published":"2026-03-16T15:31:12Z","modified":"2026-03-23T04:54:51.222394Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"openSUSE-SU-2026:20377-1","title":"Security update for python-maturin","description":"This update for python-maturin fixes the following issue:\n\n- CVE-2026-25727: time: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion\n  (bsc#1257918).\n","status":"published","published":"2026-03-17T12:51:10Z","modified":"2026-03-26T17:23:49.732889Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"openSUSE-SU-2026:20380-1","title":"Security update for snpguest","description":"This update for snpguest fixes the following issues:\n\n- CVE-2026-25727: time: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion (bsc#1257927).\n- Update to version 0.10.0 (bsc#1257877):\n  * chore: updating tool version to 0.10.0\n  * refactor(certs): remove redundant branch in file-write logic\n  * Docs: Adding verify measure, host-data, report-data to docs\n  * verify: verify measurent, host data, and report data attributes from the attestation report.\n  * library: Updating sev library to 7.1.0\n  * ci: replace deprecated gh actions\n  * feat: multi-format integer parsing for key subcommand arguments\n  * chore(main): remove unused import `clap::arg`\n  * feat(fetch): add fetch crl subcommand\n  * .github/lint: Bump toolchain version to 1.86\n  * Bump rust version to 1.86\n  * feat: bumping tool to version 0.9.2\n  * fix(verify): silence mismatched_lifetime_syntaxes in SnpOid::oid\n  * feat: support SEV-SNP ABI Spec 1.58 (bump sev to v6.3.0)\n  * docs: restore and clarify Global Options section\n  * doc: fix CL argument orders + address recent changes\n  * fix(hyperv): downgrade VMPL check from error to warning\n  * fix(report.rs): remove conflict check between --random flag and Hyper-V\n  * fix(report.rs): Decouple runtime behavior from hyperv build feature\n  * refactor: clarify --platform error message\n  * docs: add Azure/Hyper-V build note for --platform\n  * docs: Update README.md\n  * report: Writing Req Data as Binary (#101)\n  * deps: bump virtee/sev to 6.2.1 (fix TCB-serialization bug) (#99)\n","status":"published","published":"2026-03-17T15:51:45Z","modified":"2026-03-26T17:23:49.570115Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"openSUSE-SU-2026:20610-1","title":"Security update for librsvg","description":"This update for librsvg fixes the following issue:\n\n- CVE-2026-25727: time: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion (bsc#1257922).\n","status":"published","published":"2026-04-22T10:52:20Z","modified":"2026-04-24T08:16:10.961789Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"openSUSE-SU-2026:20753-1","title":"Security update for agama","description":"This update for agama fixes the following issue\n\n- CVE-2026-25727: time: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion\n  (bsc#1257930).\n\nChanges for agama:\n\n- Update \"time\" crate to version 0.3.47.\n","status":"published","published":"2026-05-14T15:28:26Z","modified":"2026-05-19T18:23:48.117510047Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"openSUSE-SU-2026:21689-1","title":"Security update for gstreamer-devtools","description":"This update for gstreamer-devtools fixes the following issues:\n\n- CVE-2025-4574: crossbeam-channel: internal `Channel` type's `Drop` method has a race condition that can lead to a\n  double-free and memory corruption (bsc#1243178).\n- CVE-2025-58160: tracing-subscriber: untrusted user input containing ANSI escape sequences can be injected into\n  terminal output when logged and lead to terminal manipulation (bsc#1249015).\n- CVE-2026-25541: bytes: integer overflow in `BytesMut:reserve` can lead to undefined behavior and crashes\n  (bsc#1274306).\n- CVE-2026-25727: time: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion\n  (bsc#1257914).\n- CVE-2026-72813: actix-files: empty `Range` header in GET requests for static files can lead to a process crash\n  (bsc#1275210).\n- CVE-2026-72814: actix-files: non-existing folders passed as an argument to the `actix_files::Files::new()` method can\n  lead to information disclosure (bsc#1275209).\n","status":"published","published":"2026-08-30T14:39:29Z","modified":"2026-08-31T18:15:04.209335775Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"openSUSE-SU-2026:21782-1","title":"Security update for aws-nitro-enclaves-cli","description":"This update for aws-nitro-enclaves-cli fixes the following issues:\n\n- CVE-2026-25541: bytes: integer overflow in 'BytesMut:reserve' can lead to undefined behavior and crashes\n  (bsc#1274300).\n- CVE-2026-25727: time: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion\n  (bsc#1257933).\n- CVE-2026-41676: openssl: `Deriver:derive` and `PkeyCtxRef:derive` can overflow short buffers on OpenSSL 1.1.1\n  (bsc#1270202).\n\nChanges for aws-nitro-enclaves-cli:\n\n- Update to version 1.5.0\n","status":"published","published":"2026-09-07T10:17:39Z","modified":"2026-09-09T10:00:05.697108577Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"openSUSE-SU-2026:21982-1","title":"Security update for sccache","description":"This update for sccache fixes the following issues:\n\n- CVE-2024-12224: idna: idna accepts Punycode labels that do not produce any non-ASCII when decoded (bsc#1243868).\n- CVE-2026-25541: bytes: integer overflow in 'BytesMut:reserve' can lead to undefined behavior and crashes\n  (bsc#1274146).\n- CVE-2026-25727: time: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion\n  (bsc#1257923).\n- CVE-2026-41676: openssl: `Deriver:derive` and `PkeyCtxRef:derive` can overflow short buffers on OpenSSL 1.1.1\n  (bsc#1270206).\n- CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length in rust-\n  openssl crate (bsc#1270559).\n- CVE-2026-41678: openssl: incorrect bounds assertion in aes key wrap in rust-openssl crate (bsc#1270693).\n- CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check in rust-openssl crate\n  (bsc#1270736).\n- CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent\n  memory in rust-openssl crate (bsc#1270869).\n- CVE-2026-42327: openssl: arbitrary code execution via specially crafted certificate in rust-openssl crate\n  (bsc#1270512).\n- CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding in rust-openssl crate\n  (bsc#1270938).\n- CVE-2026-45784: openssl: out-of-bounds write in `CipherCtxRef::cipher_update_inplace` for AES-KW-PAD ciphers in rust-\n  openssl crate (bsc#1270948).\n- CVE-2026-66746: rouille: HTTP Response Splitting via Unvalidated Response Header Values (bsc#1273881).\n- CVE-2026-66754: rouille: remove_prefix function that allows remote unauthenticated attackers to crash the server by\n  sending a crafted percent-encoded URL (bsc#1273884).\n- CVE-2026-67181: rouille: HTTP Request Smuggling via Transfer-Encoding Desynchronization (bsc#1273886).\n- CVE-2026-67182: rouille: HTTP Request Smuggling Enables Front-End Access Control Bypass (bsc#1273888).\n- CVE-2026-93599: rustls-webpki: panic via empty BIT STRING (bsc#1282211).\n- CVE-2026-93600: rustls-webpki: name constraints URI validation bypass (bsc#1282211).\n- CVE-2026-93601: rustls-webpki: name constraint bypass (bsc#1282211).\n- CVE-2026-93602: rustls-webpki: CRL revocation check bypass (bsc#1282211).\n\nChanges for sccache:\n\nUpdate to version 0.18.0~2:\n * Add experimental concurrent cache support\n * chore: Remove dependency status badge (#2856)\n * Don't hand the jobserver to children that can't use it\n * dist: refuse to trim rlibs from crates that also emit a cdylib\n * fix(cache): avoid duplicate multilevel reads\n * Strip basedirs from the compiler arguments too\n * tests/integration: replace MinIO with Silo\n * ci: dump sccache logs on integration failures\n * multilevel: a chain with any writable level is writable\n * Fix parsing of #line directives\n * Release 0.18.0\n * daemonize: use an allow-list approach to inherited FDs\n * gcc, clang: make the assembler part of the cache key\n * support cl.exe /openmp:llvm\n * support all current /fsanitize*, /fsanitize-coverage*, and /fno-sanitize* args\n * support MSVC /feature argument\n * msvc: support lots of flags (#2832)\n * Update shlex dependency to version 2 (#2836)\n * gcc: mark flags as TooHard if need to cache something else (#2833)\n * clang: support more CLI options (#2834)\n * msvc: support arm64EC and fastfail flags (#2830)\n * chore: fix typo in comment (#2829)\n * nvcc: accept the --diag-error/--diag-suppress/--diag-warn family (#2816)\n * cache: allow skipping capability checks (#2822)\n * Bump opendal to 0.58.1 and fix fallout (fixes local GCS cache usage) (#2715)\n * nvcc (Windows): protect escaped quotes in dryrun lines before flattening backslashes (#2811)\n * Add an agent (#2812)\n * Add support for d20bforceinline. (#2807)\n * feat: add Microsoft Entra ID (passwordless) auth for the Azure Blob backend (#2802)\n * Bump MSRV to 1.91.0 (#2793)\n * Fix `nvcc` dryrun parsing for CUDA 13.3 (#2722)\n * test: Fixed hardcoded binary path in test\n * Release 0.17.0\n * tests: pin libc in the dist test crate\n * doc: clarify server-side outputs and drop 'recommended mode' claim\n * doc: document SCCACHE_CLIENT_SIDE env var\n * doc: document client-side and direct modes in Architecture.md\n * Fix description of Unix socket-based Redis connection\n * server: remove redundant async block in start_compile_task\n * server: simplify bind() request loops with ? instead of manual match arms\n * Add support for arg files in Rust (#2782)\n * feat: support S3 SSE-KMS with AWS-managed and customer-managed keys (#2770)\n * abort compile tasks and associated subprocesses when a client disconnects\n * treat -ivfsoverlay as a preprocessor-only argument\n * gcc: refine response-file tokenizer visibility and whitespace handling\n * integration: convert cmake 4.x modules XFAIL test to a passing test\n * gcc/clang: cache and distribute builds using quoted @response files\n * fix: Fix ToolchainPackager cfg gate to build on ppc64le/s390x\n * fix: make gcc diagnostics color output work the same as for rustc\n * implement client-side mode\n * split handle_compile_response so that the compilation result can be handled separately\n * implement IpcStorage -- Storage backend over IPC\n * extend wire protocol with storage RPCs\n * implement AddAssign for ServerStats and related types\n * add Storage::get_path for direct file access\n * implement get_raw/put_raw on MultiLevelStorage\n * add client_side_mode config flag (SCCACHE_CLIENT_SIDE)\n * Extract new_client_runtime() helper to DRY up client runtime creation\n * Clarify single-threaded runtime rationale comment (grammar)\n * fix: use single-threaded tokio runtime in sccache dist-client\n * fix: use single-threaded tokio runtime in sccache client\n * fix: handle disabled cache backend features in multilevel chain\n * Fix ldd output parsing: remove .exists() check that failed on systems where the symlink source path does not exist locally (e.g. aarch64)\n * Fix cfg guard for PanicToolchainPackager to also cover non-x86_64 Linux architectures (e.g. aarch64)\n * Release 0.16.0\n * fix: strip SCCACHE_BASEDIRS from escaped-backslash paths on Windows (#2736)\n * Ignore empty-set environment values (#2639)\n * feat: all backends support making them as read-only (#2705)\n * Enable RE on Linux-aarch64 (#2668)\n * Slightly improve logging (#2734)\n * chore: encode jwt key and cert digest with base64 in logs (#2712)\n * chore: make clippy happy (#2727)\n * feat: avoid sccache wrapper when resolving compiler (#2720)\n * Fall back to direct cache write if tempfile creation on the same fs fails (#2369)\n * remove too noisy bench\n * feat(nvcc): support argument: `--dependency-output` (#2708)\n * fix: add newline when printing dist-status to stdout\n * Revert \"Classify .s files as AssemblerToPreprocess so #include/#ifdef are hon...\"\n * Don't wait depfiles for gcc/clang preprocessed inputs\n * Classify .s files as AssemblerToPreprocess so #include/#ifdef are honored\n * prepare release 0.15.0\n * Add cargo-binstall metadata for prebuilt binary installation\n * Fix coverage\n * fix: handle directories in dep-info source file hashing\n * docs(Rust.md): Add caveats from README\n * Add retry for dists docker image build\n * ci: set crt-static for riscv64 musl targets\n * feat: Add loongarch64 support\n * feat: Implement multi-tier caching with fallback and backfilling (#2581)\n * msvc: add support for Y-, YI, Zf flags\n * Group tests logging in CI\n * Add failing test for cmake-modules + cmake 4 version\n * Unfold ninja output in the test\n * Add a comment for maintaining integration tests\n * Move cmake-modules to integration tests\n * fix: exclude CARGO_ENCODED_RUSTFLAGS from env var hash (#2651)\n * chore(deps): update rust crate quinn-proto to v0.11.14\n * Fix sync GCS initialization\n * clippy: fix from_iter_instead_of_collect lint\n * fix: add Win32_Security feature to windows-sys dependency\n * build(deps): bump actions/download-artifact from 5 to 8\n * msvc: Append the default .pdb extension for the /Fd argument (#2621)\n * build(deps): bump actions/upload-artifact from 4 to 7\n * clippy: fix ref_option lint\n * ci: install grcov from prebuilt binary instead of cargo install\n * ci: use default toolchain to install grcov\n * ci: fix artifact_failure action when target dir does not exist\n * Remove benchmark normalize_win_path_utf8 (#2634)\n * Revert \"actions: add security audit workflow (#2594)\" (#2603)\n * partial c++20 module support (#2516)\n * clippy: fix ptr_as_ptr lint (#2611)\n * Add support for `d1nodatetime` \u0026 `await:strict` MSVC flags (#2617)\n * chore: switch thirtyfour_sync to thirtyfour (#2613)\n * clippy: fix manual_string_new lint (#2609)\n * clippy: fix unnecessary_semicolon lint (#2615)\n * clippy: fix explicit_into_iter_loop lint (#2616)\n * Avoid double-caching when ccache is installed in PATH (#2524)\n * clippy: fix cloned_instead_of_copied lint (#2605)\n * clippy: fix semicolon_if_nothing_returned lint (#2601)\n * Move PreprocessorCacheModeConfig to src/config.rs (#2604)\n * clippy: fix cloned_ref_to_slice_refs lint (#2602)\n * prepare the new release (#2600)\n * chore: update to toml 0.9 (#2599)\n * ci: Add coverage to integration tests, report it to Codecov.io (#2598)\n * Preparation for multilevel caching (#2597)\n * Add sccache-dist to flake.nix (#2579)\n * fixup! cargo fmt\n * fixup! rustfmt update\n * Extract FileObjectSource, CacheRead and CacheWrite to cache_io.rs\n * chore: update to nix 0.30\n * Add a helper method to get a correct backend name\n * Add cos feature gate to RemoteStorage\n * Simplify profiles for integration tests\n * clippy: fix implicit_clone lint (#2584)\n * actions: add security audit workflow (#2594)\n * docs: fix examples showing an xz-compress toolchain archive (#2587)\n * add benches for normalize_win_path strip_basedirs (#2588)\n * snap: update to core24 (#2570)\n * Add .rustfmt.toml for consistent style between `rustfmt` and `cargo fmt` (#2582)\n * add comments about auth token requirements (#2583)\n * chore: update to tokio-serde 0.9 (#2585)\n * ci: update freebsd to 15.0 (#2586)\n * distributed compilation support for asm \u0026 preprocessor outputs (#2557)\n * remove unused declaration (#2577)\n * Extract LazyDiskCache to a separated file (#2573)\n * Revert \"ci: show diff for toml_format\" (#2578)\n * Open Add SCCACHE_BASEDIRS support\n * ci: show diff for toml_format\n * chore: update to syslog 7\n * refactor: use matrix to reduce deduplication\n * fix: remove outdated `analysis` mode\n * Unbreak the s390x CI\n * ci: add macos-15-intel for prebuilt binary (#2555)\n * Integration tests (#2564)\n * Fix code review.\n * Impl for COS.\n * build(deps): bump opendal from 0.54.0 to 0.55.0\n * Move integration tests related stuff to subdir\n * Add Objective C Header for consistency\n * github action: fix the syntax - fails in the ci\n * sccache: prepare a new release\n * msvc: add msbuild support test\n * msvc: fix detect_showincludes_prefix with MSBuild\n * chore: update to gzp 2\n * build(deps): bump rsa from 0.9.6 to 0.9.10\n * codspeed: evaluate the memory benchmarking\n * remove too quick benchmarks\n * codspeed: move to simulation mode\n * Add realistic LRU cache access pattern benchmarks\n * Add compression characteristics benchmarks\n * Add build workflow simulation benchmarks\n * Add hash computation scenario benchmarks\n * Add batch cache entry benchmarks\n * Add cache artifact serialization benchmarks\n * Add /etc/ld.so.conf.d (if present) to compiler package\n * Assembly language support\n * fix(ci): pin serde_json to avoid zmij dependency\n * fix(ci): update zmij to fix s390x cross-compilation\n * Fix the run of the CI\n * run the benchmark in the ci\n * add benchmarks\n * dedup some code\n * Fix hash logging prefix\n * Add support for C preprocessor output\n * Add GCC pipe flag support\n * Improve save-temps gcc flags detection\n * MSVC: support forward slash as an output dir marker\n * add clang -fplugin=x regression test\n * canbeconcatenated is not accounted for in cmp\n * Reversed the order for looking `rustc`, added comment\n * Fix failing test_rlib_dep_reader_call for omit CARGO_HOME\n * fix: don't hash -parallel-jobs in Clang\n * docs: add installation steps for nix (#2523)\n * Support clang -fexperimental-assignment-tracking option (#2517)\n * add a nix flake (#2518)\n * Switch from the unmaintained daemonize crate to a maintained fork\n * chore: update to fs-err 3\n * Fix grammar of error message\n * Add server name info to stderr of remote jobs that ran, but failed\n * Remove another pointless destructuring\n * try to unbreak the ci\n * fix s390x build error\n * Add riscv64 support\n * fix: make aarch64-pc-windows-msvc also zip not tar.gz\n * Free up disk space in CI\n * MSVC on Windows only\n * Avoid 'No space left on device' errors in CI\n * GitHub dropped macos-13 runners\n * Proper function pointer to int cast\n * Avoid unused structs with dist-server disabled\n * no check cfg (#2507)\n * chore: switch once_cell crate to standard library (#2499)\n * Avoid unreliable assert_cmd::cargo::cargo_bin (#2489)\n * Fix build on macOS which doesn't have separate 32-bit dirent (#2492)\n * Fix Clippy warnings (#2490)\n * docs: bump MSRV to 1.85.0\n * msvc: handle '/FoRelease\\' command-line argument\n * chore: drop tower dependency\n * chore: update to itertools 0.14\n * Use generator in CMAKE_MSVC_DEBUG_INFORMATION_FORMAT in README\n * Update directories to 6.0\n * Configuration.md - note logging env variables\n * chore: update to env_logger 0.11\n * deps: update blake3\n * prepare version 0.12.0\n * Update README with winget installation instructions\n * Skip CARGO_BUILD_JOBS in hash keys\n * build(deps): bump object from 0.36.7 to 0.37.1\n * Adjust tests after the rust update\n * Fix CI by adding cargo-features and updating coverage test to use modern -Cinstrument-coverage\n * Fix more clippy warnings\n * bump rustc in the ci too\n * Fix rustc 1.85 clippy warnings\n * bump to rustc 1.85 / edition 2024. mandatory for reqsign-core and run rustfmt with the version\n * fix clippy warnings\n * bump opendal to 0.54.0 \u0026 reqsign to 0.18.0\n * github action: when creating a release, make it as draft before (#2458)\n * prepare version 0.11.0 (#2457)\n * document SCCACHE_LOG_MILLIS (#2456)\n * logging: add a option to log milliseconds (Closes: #2454) (#2455)\n * feat: handle human size prefixes (#2405)\n * fix: in stats, Compare values AND keys to have a fully deterministic order (#2403)\n * Add --diagnostic-width to test for args ignored in hash\n * Ignore --diagnostic-width argument when computing hash\n * build(deps): bump actions/checkout from 4 to 5\n * build(deps): bump actions/download-artifact from 4 to 5\n * build(deps): bump actions/github-script from 7 to 8\n * Fix rustfmt\n * Fix comments on request\n * Fix clippy and rustfmt\n * Add test for count toolchain and use Determenistic for create tar archive\n * Fix mtime for reproducable toolchains\n * build(deps): bump chrono from 0.4.41 to 0.4.42\n * fix typo in an environment variable name\n * Fix documentation of azure configuration\n * Account for clippy-driver having extra prefix `rustc`\n * Fix build on Android (in Termux)\n * add support for s390x build\n * chore: replace retry crate with backon\n * Remove or replace \"Windows 2019\" CI config\n * Needs another result unwrapping, it seems\n * Test: invoking symlink \"compiler\" to \"sccache\" invokes \"compiler\"\n * Add a comment about the problem with symlinks and current_exe()\n * Fix symbolic links to sccache on linux\n * Allow the CI configuration to disable clang++ for CUDA testing\n * Don't run tests using clang++ as CUDA compiler on Windows\n * add description to sccache-dist commands\n * Display a more user-friendly error when compiling on Linux/arm64\n * Clarify documentation about \"the hash\" (aka cache key)\n * Remove stray ')'\n * Remove documentation for removed limitations of preprocessor cache mode\n * Fix preprocessor cache mode when the compiler outputs a dep file\n * Partially revert \"Don't cache dep file (#2322)\"\n * Do not disable preprocessor cache mode if there is a dep file\n * Fix preprocessor cache mode with distributed builds (#2173)\n * Change self of generate_hash_key() from Box\u003cSelf\u003e to \u0026mut Self\n * Remove a few IMO pointless indirections / aliases\n * Remove workaround for #2173\n * Add test for bug #2173\n * chore: fix some minor issues in comments\n * build(deps): bump chrono from 0.4.40 to 0.4.41\n * build(deps): bump memchr from 2.7.1 to 2.7.5\n * check if we can use a specific version of rust to build grcov\n * Move comment that hadn't moved with its corresponding code\n * Rework direct mode documentation some more\n * Explain what preprocessor cache mode really does\n * Reword and correct the preprocessor cache mode documentation\n * chore: Remove not working mozilla code\n * Add support for -fsanitize-ignorelist\n * github storage: adjust the doc\n * github storage: ACTIONS_CACHE_URL =\u003e ACTIONS_RESULTS_URL\n * github storage: force version 2\n * Update codecov badge in README.md\n * Expand tests for dist-server\n * ci: Consolidate testing, coverage\n * ci: Update ubuntu-20.04 runners to ubuntu-22.04\n * chore: fix some comments\n * Give the --dist-status user some information about when a retry will happen.\n * Add support for Xclang flag '-mrelax-all'\n * Add support for Xclang flag '-mconstructor-aliases'\n * feat(utils): Add support for object \u003e= 0.33\n * fix(tests): Remove executable bit from oauth.rs\n * build(deps): bump openssl from 0.10.64 to 0.10.72\n * build(deps): bump tokio from 1.41.0 to 1.43.1\n * Improve the CARGO_INCREMENTAL checking (#2364)\n * build(deps): bump chrono from 0.4.38 to 0.4.40\n * build(deps): bump clap from 4.4.18 to 4.5.13\n * build(deps): bump ring from 0.17.7 to 0.17.13\n * Bail on `nvcc -time` and `nvcc -fdevice-time-trace` flags\n * test hip with librandomize_readdir\n * Add randomize_readdir test utility\n * fix non-strict HIP device lib order\n * Create config during testing to collect coverage data\n * Extend coverage to distributed tests\n * chore: replace num_cpus crate with available_parallelism in standard library (#2342)\n * Update CI coverage: grcov/codecov\n","status":"published","published":"2026-09-30T17:58:26Z","modified":"2026-10-01T17:30:06.785984892Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"openSUSE-SU-2026:22016-1","title":"Security update for rustup","description":"This update for rustup fixes the following issues:\n\n- CVE-2024-12224: idna: idna accepts Punycode labels that do not produce any non-ASCII when decoded (bsc#1243862).\n- CVE-2025-58160: tracing-subscriber: Tracing log pollution (bsc#1249008).\n- CVE-2026-25541: bytes: integer overflow in 'BytesMut:reserve' can lead to undefined behavior and crashes\n  (bsc#1274144).\n- CVE-2026-25727: time: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion\n  (bsc#1257902).\n- CVE-2026-41676: openssl: `Deriver:derive` and `PkeyCtxRef:derive` can overflow short buffers on OpenSSL 1.1.1\n  (bsc#1270186).\n- CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length in rust-\n  openssl crate (bsc#1270619).\n- CVE-2026-41678: openssl: incorrect bounds assertion in aes key wrap in rust-openssl crate (bsc#1270644).\n- CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check in rust-openssl crate\n  (bsc#1270795).\n- CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent\n  memory in rust-openssl crate (bsc#1270870).\n- CVE-2026-42327: openssl: arbitrary code execution via specially crafted certificate in rust-openssl crate\n  (bsc#1270521).\n- CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding in rust-openssl crate\n  (bsc#1270874).\n- CVE-2026-45784: openssl: out-of-bounds write in `CipherCtxRef::cipher_update_inplace` for AES-KW-PAD ciphers in rust-\n  openssl crate (bsc#1270989).\n- CVE-2026-93599: rustls-webpki: panic via empty BIT STRING (bsc#1282217).\n- CVE-2026-93600: rustls-webpki: name constraints URI validation bypass (bsc#1282217).\n- CVE-2026-93601: rustls-webpki: name constraint bypass (bsc#1282217).\n- CVE-2026-93602: rustls-webpki: CRL revocation check bypass (bsc#1282217).\n- rust-shlex: Multiple issues involving quote API (RUSTSEC-2024-0006, GHSA-r7qv-8r2h-pg27) (bsc#1230032).\n\nChanges for rustup:\n\n- Update to version 1.29.1~0:\n * dist(rustup-init/sh): update commit shasum in help string\n * style(bin/rustup-init): reformat code\n * docs(changelog): update for v1.29.1 stable release\n * warn how to switch away from the deprecated complete profile\n * fix(cli/help): fix wording in `rustup run --help`\n * ci(docker/android): stop building OpenSSL\n * refactor(cli/docs): use tracing for docs opening status messages\n * refactor(self-update): rename Windows uninstall registry helpers\n * feat(test): isolate Windows registry state per test\n * docs(dev-guide): mention how to support new compilation targets\n * Fix funding link\n * chore(deps): lock file maintenance\n * refactor(cli/self-update): move `current_install_opts()` to `InstallOpts::display()`\n * refactor(cli/self-update): move `process` out of `InstallOpts`\n * fix(cli/self-update): postpone initialization of `Cfg` in `setup_mode`\n * refactor(cli/self-update): take `Process` in `check_existence_of_settings_file()`\n * fix(settings): prevent creating new file with `SettingsFile::read_settings()`\n * test(cli-inst-interactive): test file creation on cancelled installation\n * refactor(toolchain/names): inline `validate()` aliases into `FromStr`\n * refactor(toolchain/names): rename `validate()` to `normalize_name()`\n * fix minor typos\n * www: align copy icon\n * refactor(toolchain/names)!: remove `try_from_str!()`\n * refactor(toolchain/names)!: remove `from_variant!()`\n * Add `rustup doc --serve` to serve docs over local HTTP\n * Move doc() and man() into a new docs module\n * chore(github): comment out instructions in PR template\n * docs(dev-guide): reapply abandoned changes from #4970\n * Add riscv64 unknown linux musl support\n * fix(deps): update rust crate enum-map to v3\n * refactor(cli/self-update)!: rename `install()` to `InstallOpts::install()`\n * refactor(cli/self-update)!: rename `maybe_install_rust()` to `InstallOpts::install_rust()`\n * refactor(cli/self-update)!: rename `InstallOpts::install()` to `InstallOpts::select_toolchain()`\n * refactor(toolchain/names)!: make more clones during conversions explicit\n * refactor(cli/self-update): move message templates to `mod msg`\n * style(cli/self-update): reorganize imports\n * Add pull request template linking to the dev guide\n * doc: add AI policy to the dev guide\n * ci(dist): ensure pushing to `dev-static` on `stable` update\n * test(toolchain): add a test case for `rustup toolchain install --override`\n * feat(toolchain): add `--default` flag to `rustup toolchain install`\n * fix(toolchain): inline use of `set_override`\n * Add Enzyme to the list of rustup components\n * fix: repair toolchains without an installed manifest\n * refactor: expose the installed manifest path\n * Docs: Remove i686 `set default-host` example\n * fix(self-update): only remove complete profile lines\n * chore(deps): bump `platforms` to 4.1.0\n * chore(deps): remove pinned `openssl-src`\n * refactor: replace `cfg_if!{}` with `cfg_select!{}`\n * fix: Lock state file updates\n * Fix Rust 1.97 clippy warnings\n * uninstalls toolchains prior to deleting the rustup home folder\n * Take semver-compatible dependency updates\n * Upgrade platforms to 4\n * docs: update `CHANGELOG` for v1.29.1\n * Lock file maintenance\n * Remove Windows special case from `can_run`\n * diskio: drop unnecessary constructor wrapper\n * diskio: rename _IncrementalFileState to FileState\n * diskio: inline IncrementalFileState type alias\n * Minimize API visibility\n * toolchain: streamline validate() implementations\n * toolchain: avoid internal cloning\n * dist: drop unused conversion impl\n * dist: keep impls with type definitions\n * Don't hide allocations inside From impls\n * toolchain: drop impls for \u0026String\n * Warn on clippy::or_fun_call\n * Warn on clippy::needless_by_ref_mut\n * Warn on clippy::redundant_clone\n * Warn on clippy::manual_let_else\n * Warn on clippy::use_self\n * errors: box ToolchainDesc in RustupError variants\n * errors: box Manifest in RequestedComponentsUnavailable variant\n * No (more) need to allow clippy::arc_with_non_send_sync\n * Replace use of FnMut trait objects with custom trait\n * test(cli/self-upd): use direct arg0 override for `as_rustup_setup()`\n * chore(deps): update actions/cache action to v6\n * ci(windows): add support for aarch64-pc-windows-gnullvm target\n * ci(windows): refine MSVC/MINGW job step predicates\n * chore(deps): update actions/checkout action to v7\n * fix(deps): update rust crate itertools to 0.15\n * fix(progress): use the `prefix` placeholder instead of `msg` for component name\n * rustup: warn when no toolchain or default is configured\n * errors: extract default stable hint\n * feat(toolchain): make the \"installed\" text of a toolchain install green\n * Add aarch64-unknown-freebsd\n * chore: address linter warnings\n * chore(deps): bump to semver-compatible versions\n * Add funding links\n * ci(docker/freebsd): bump `clang` version to `freebsd14`\n * ci(freebsd): use FreeBSD 14.0 for full CI\n * chore(deps): update `curl`\n * feat(cli/rustup-mode): warn about auto-installation in some subcommands\n * refactor(config): accept `Cfg` in `EnsureInstalled::warn_auto_install()`\n * test(cli/rustup-mode): test auto-installation on to-be-deprecated subcommand\n * dist: move display_name() before other methods that it calls\n * chore(gitignore): add .cargo/config.windows-cross.toml to gitignore\n * docs(dev-guide): update platform-specific code guidance\n * docs(dev-guide): mention rust-analyzer support for Windows-specific code on Unix\n * docs(dev-guide): mention how to lint Windows-specific code on Unix\n * chore(config): add example config for cross checking and rust-analyzer\n * chore: add rust-analyzer example config\n * Display the full names of targets not matching the host target tuple\n * docs(dev-guide/tips-and-tricks): mention the `RUSTUP_FORCE_ARG0='rustup'` cargo alias\n * build(cargo): add `cargo` alias for `RUSTUP_FORCE_ARG0='rustup'`\n * docs: rename the repath helper variable\n * Remove double buffering when extracting archives\n * refactor(toolchain/distributable): return `EnsureInstalled\u003c\u003e` from `DistributableToolchain::install()`\n * docs(dev-guide/coding-standards): adapt style guide from rustls\n * fix(deps): update opentelemetry\n * feat(config): warn user if auto-install is enabled\n * refactor(config): return `EnsureInstalled\u003c\u003e` from more functions\n * refactor(config): extract `EnsureInstalled\u003c\u003e` wrapper type\n * test: make tests agnostic to external `RUSTUP_AUTO_INSTALL` and `RUST_RECURSION_COUNT`\n * test(dist): fail v2 manifest update when manifest disagrees with .sha256\n * fix(dist): propagate v2 manifest checksum failure instead of reporting \"unchanged\"\n * Align shell setup comments in install message\n * feat(cli/self-update): refine wording of \"already installed Rust\" warning\n * chore(settings): rename default_host_triple to default_host_tuple and alias old name\n * chore(settings): add test to parse default_host_triple in toml\n * test(download): also scrub `HTTP_PROXY` in `scrub_env()`\n * chore: document legacy default host setting\n * chore: rename internal tuple constants\n * chore: rename partially \"Triple\" to \"Tuple\" to reflect the new terminology\n * fix(cli/rustup-mode)!: complete `rustup show` if active toolchain is not installed\n * refactor(cli/rustup-mode): postpone eval of `active_toolchain_targets` in `show()`\n * refactor(cli/rustup-mode): postpone eval of `active_toolchain` in `show()`\n * refactor(cli/rustup-mode): reduce rightward drift in `show()`\n * refactor(cli/rustup-mode): refine usage of `stdout` term and locks in `show()`\n * feat(config): add `Cfg` field to force-disable auto-installation\n * Provide --yes alias for -y flag consistently\n * refactor(tests): rename triple to tuple\n * refactor: bulk rename triple to ruple\n * refactor: rename get_default_host_triple to default_host_tuple\n * test(download): support more feature flag combinations\n * docs: fix the FileBuffer::clear doc comment wording\n * docs: fix plural of VM in coding standards\n * fix(dist): bulk rename triple to tuple for variables and messages\n * refactor(dist): rename PartialTargetTriple to PartialTargetTuple\n * refactor(dist): rename triple module to target_tuple\n * refactor: remove PartialToochainDesc::has_triple() in favor to PartialTargetTriple::is_empty()\n * refactor(dist): rename TargetTriple to TargetTuple\n * fix(self-update): rename triple to tuple in self_update\n * dist: bump `rustup` version to v1.29.1\n * ci(linux/x64-musl): install missing libc dependencies\n * fix(tests): rename HOST_TRIPLE placeholder to HOST_TUPLE\n * fix(tests): rename this_host_triple() to this_host_tuple()\n * fix(init): rename triple to tuple to reflect the new terminology\n * fix(docs): rename triple to tuple to reflect the new terminology\n * chore(deps): update ubuntu docker tag to v26\n * Improve error message for incomplete toolchains\n * chore(deps): update bwoodsend/setup-winlibs-action action to v1.16\n * test(dist/manifest): use the reordered fixture in `manifest_serialized_with_sorted_keys`\n * docs: fix \"initial\" spelling in stylesheet variable\n * ci: powerpc64-unknown-linux-musl is now stable\n * style(cli/rustup-mode): address clippy warnings\n * docs(dev-guide): update release process with new backporting flow\n * docs: fix actions template README typo\n * Only show post-install instructions for currently installed shells\n * docs: fix Windows MSVC guide typo\n * Upgrade to rustls-platform-verifier 0.7\n * Make component removal best-effort and preserve single-error behavior\n * Use `cc-rs` to detect the default linker, instead of assuming `cc`\n * ci(test): add `workflow_dispatch` trigger on par with `schedule`\n * ci: fix incorrect `contains()` predicate\n * fix(dist/manifestation): fix log format when installing exactly 2 components\n * Allow rustup component add to install multiple components in one update #4787\n * fix(docs): correct link to `no-self-update` feature\n * ci: enable on all PR target branches\n * ci(backport): rename backport branches to `release/*`\n * feat(toolchain): run a pre-check before updating all toolchains\n * feat(install): accept an optional pre-fetched manifest when installing\n * fix(toolchain): extract manifest fetching out of `show_dist_version()`\n * fix(manifest): aggregate a manifest and its hash in a `ManifestWithHash` struct\n * fix: Reduce flickering by using `set_move_cursor`\n * ci(backport): add support for backporting\n * fix: install message misalignment.\n * refactor: extracted `progress_style` method for DownloadStatus\n * fix(deps): update rust crate sha2 to 0.11\n * chore(doc): Added comments for clarify the usage of `Component::name` `Manifest::name` and the `short_name` funcc accordingly.\n * refactor: Rename `Component`'s `name_in_manifest` to `name` and `short_name` accordingly\n * self_update: show path to executable in case of updater failure\n * Revert \"fix(ci/freebsd): install ca certs to prevent certificate-related issues\"\n * ci: don't install protoc\n * Update to mdbook 0.5\n * ci(all-features): bump protoc version\n * fix(dist/manifestation): use full toolchain name in `Update::unavailable_components()`\n * style(dist/manifestation): merge imports\n * Fix zsh completion showing all PATH entries for +toolchain arg\n * fix(cli/proxy-mode): stop enforcing `quiet: true`\n * chore(deps/freebsd): downgrade `libz-sys` to v1.1.24\n * fix(ci/freebsd): install ca certs to prevent certificate-related issues\n * fix(rustup-init/sh): prevent passing `--default-host` twice\n * Avoid warning about the existence of a `settings.toml` on a fresh install\n * use tuple instead of triple for env overrides\n * Take platforms 3.9.0\n * Unpin tracing-subcriber\n * chore(deps): update `aws-lc-rs` and `aws-lc-sys`\n * docs(changelog): update release date for v1.29.0\n * docs(dev-guide/release-process): mention the CfT blog post\n * docs(changelog): update for v1.29.0 stable release\n * fix(cli): Style CLI errors in init mode\n * test: Add unknown arg init test\n * chore(deps): update actions/upload-artifact action to v7\n * refactor(www): simplify instruction css selector\n * feat(www): make copy button dark mode-aware\n * feat(www): move feedback text out of copy button\n * fix(www): apply filter to rust logo\n * feat(www): add dark mode\n * refactor(www): extract css variables\n * fix(cli/self-update): enforce a newline after `check_updates()`\n * refactor(cli/self-update): extract `has_progress_bars` in `check_updates()`\n * fix(cli/self-update): unify `check_*update*()`'s message formats\n * docs(downloads): fix the default number of `RUSTUP_CONCURRENT_DOWNLOADS`\n * feat(toolchain): add `--override` to override toolchain as soon as installed\n * fix(toolchain): improve logs when recovering from an interrupted installation\n * chore(deps): downgrade `openssl-src` to 300.5.4+3.5.4\n * style(download): clean up imports\n * fix(diskio): fall back to single-threaded unpacking when `ram_budget` \u003c 512MB to avoid OOM on memory-constrained systems\n * test(downloads): check if an error is thrown if the server does not honor range\n * fix(downloads): check correct response when resuming from partial (reqwest)\n * fix(downloads): check correct response when resuming from partial (curl)\n * fix(deps): update rust crate toml to v1\n * fix(dist/manifest): sort keys when serializing `Manifest`\n * hack(ci/linux): disable BuildKit when building local images\n * chore(ci): use more distinctive local image names\n * Upgrade rand to 0.10\n * Upgrade snapbox to 1\n * Upgrade to anstream 1\n * fix(downloads): adjust error message for partial files in network failures\n * test(downloads): ensure that partial files are not removed when network fails\n * feat(downloads): do not delete partial download when network fails\n * fix(downloads): substitute `DEK` alias for `DownloadError`\n * chore(deps): update aws-actions/configure-aws-credentials action to v6\n * cli: introduce semantic exit code constants for rustup check\n * Add missing Windows SDK instructions\n * Add winget instructions to MSVC install page\n * Remove nu-string-interpolation `$`\n * Replace $nu.home-path with ~\n * feat(cli/rustup-mode): add \"Exit status\" section to `rustup check --help`\n * Add common commands section in help text\n * fix(cli/rustup-mode): improve exit code of `rustup check`\n * refactor(test)!: pass status code directly to `SanitizedOutput`\n * Add powerpc64-unknown-linux-musl support\n * fix: add copy_file_symlink_to_source for self-installation\n * fix: preserve symlinks in copy_dir instead of following them\n * feat(cli/rustup-mode): add `doc --rustc-docs` to open rustdoc for Rust internals\n * Remove the mixed singular/plural phrasing as \"component(s)\" instead, use \"components\" or \"component\".\n   In the singular case also add the name of the component for more consistent messaging style with\n   other info! outputs about single components.\n * fix(cli/rustup-mode): `check` for self updates for `SelfUpdateMode::CheckOnly`\n * test: Add test for sequential multi-toolchain uninstall\n * fix: directory removal race condition in toolchain uninstall\n * test(cli_v2): test error when missing many components on install\n * fix(dist): adjust printed newlines in `components_missing_msg()`\n * unified nightly disclaimer wording/styling; preserved distinct messages per scenario\n * Upgrade to reqwest 0.13\n * change test name to match new terminology\n * rename file to match new terminology\n * change 'target triple' to 'target tuple'\n * fix(toolchain): forbid toolchain names starting with +\n * cli: add `doc --releases` to open release notes\n * chore(deps): update actions/upload-artifact action to v6\n * chore(deps): update actions/cache action to v5\n * dist: use more concise API in helper function\n * dist: inline more logic into helper function\n * dist: give helper function a more meaningful name\n * dist: move helper function closer to usage site\n * docs(dev-guide): mention snapshot updating in release process\n * fix(toolchain): avoid unwrapping when parsing a toolchain name\n * fix(toolchain): change regex to reject leading zeros in toolchain name\n * docs(changelog): update for v1.29.0 beta release\n * dist: bump `rustup` version to v1.29.0\n * docs(changelog): add missing link references\n * test(static-roots): use a more compact syntax for raw binaries\n * test(static-roots): return `Result` from `store_static_roots()`\n * download: statically bundle relevant trust anchors\n * Added xonsh support\n * refactor(dist/manifestation): remove redundant redeclarations\n * docs(dist/download): remove outdated note on concurrent download progress reporting\n * fix(dist/download): align `total_bytes` fields in progress reporting UI\n * fix: default to GNU host in Cygwin/MSYS/MinGW environments (#4221)\n * chore(config): remove redundant imports\n * fix(dist/manifestation): print \"downloading component\" only on `InstallEvents`\n * fix(utils): downgrade panic to warning in `delete_dir_contents_following_links()`\n * chore(deps): update actions/checkout action to v6\n * Prepare for mdbook 0.5 migration\n * dist: make installation asynchronous\n * dist: make installations 'static\n * dist: take ownership of Manifestation\n * dist: store owned temp::Context in Transaction\n * dist: store temp::Context in DownloadCfg\n * dist: align progress bar elements\n * dist: track progress during unpacking\n * utils: drop unused reader tracking\n * process: fix refresh rate for progress bars\n * process: reduce duplication in ProgressDrawTarget setup\n * Yield references from Manifest::short_name()\n * Move Component name helpers to Manifest\n * dist: simplify ComponentBinary construction\n * dist: hoist creation of io_executor some more\n * Move unpack_ram() from dist to diskio\n * dist: hoist Executor creation up\n * dist: inline effective RAM limit calculation\n * dist: hoist environment variable extraction\n * dist: use logging for missing parent warnings\n * dist: clarify dependency on unpack RAM budget\n * diskio: clarify dependency on I/O thread count\n * dist: transfer ownership of component values\n * dist: take ownership of existing Components\n * dist: take ownership of toolchain name in update()\n * dist: take ownership of manifest in update()\n * dist: derive trivial initialization for Update\n * dist: rename Update::build_update() to new()\n * dist: linearize for-loop in Update::build_update()\n * dist: inline single-use function\n * dist: inline trivial helper function\n * dist: inline single-use tranaction change helpers\n * dist: store specific config bit in Transaction\n * chore(config): migrate config .github/renovate.json\n * dist: attach manifest download functions to DownloadCfg\n * rustup: unhide top-level install/uninstall commands\n * dist: move update_from_dist() to DistOptions::install_into()\n * Be more consistent about aliases for different subcommands\n * test: add test for `rustup toolchain install --no-update`\n * feat(rustup-mode): add `no_update` flag to `rustup toolchain install`\n * cli: prepare DistOptions in advance\n * dist: inline trivial wrapper function\n * cli: inline single-use update_all_channels() helper\n * config: simplify update_all_channels()\n * dist: deduplicate DistOptions initialization\n * dist: avoid recomputing dist root URL\n * dist: simplify tracing instrumentation\n * install: take ownership in InstallMethod::install()\n * dist: move DistributableToolchain::install() up\n * dist: clarify when update_hash is available\n * cli: avoid dropped temporary\n * Take semver-compatible dependencies\n * dist: install while downloading\n * dist: store more context in ComponentBinary\n * dist: yield self when download is complete\n * dist: move URL alteration logic into DownloadCfg method\n * Apply suggestions from clippy 1.91\n * refactor(check): Consolidate use_colors checks\n * fix(check): Use Cargo's colors\n * refactor(check): Make calls more consistent\n * dist: drop another layer of abstraction\n * dist: store package directory once\n * dist: inline short single-use function\n * dist: discard unnecessary abstraction layer\n * chore(deps): update actions/upload-artifact action to v5\n * fix(cli/rustup-mode): add missing self-update in `rustup toolchain install`\n * refactor(cli/self-update): move `self_update()` to `SelfUpdateMode::update()`\n * refactor(cli/rustup-mode): pass self-update predicates into `self_update()`\n * refactor(cli/self-update): import `utils::ExitCode`\n * rustup: tweak update check output style\n * fix(list): Match show command's styling\n * test(list): Add UI test\n * fix(toolchain): Have 'list' match 'show's styling\n * refactor(toolchain): Order logic by display order\n * refactor(toolchain): Use string interpolation\n * test(toolchain): Show list's behavior\n * fix(update): Match 'cargo update's colors\n * refactor(update): Centralize style knowledge\n * test: Cover different show_channel_update cases\n * fix(check): Subject check to RUSTUP_TERM_COLOR\n * test(check): Show current style\n * fix: Use HEADER styling in 'rustup show'\n * chore: Update clap-cargo\n * test: Demonstrate show's behavior\n * test(process): Allow forcing color on\n * test(process): Ensure non-locked writes are stripped of ANSI escape codes\n * cli: update `uninstall_removes_source_from_rcs` to mirror `uninstall_doesnt_modify_rcs_with_no_modify_path`\n * cli: add tests for `rustup self uninstall --no-modify-path`\n * cli: add `rustup self uninstall --no-modify-path`\n * cli: add help text for `rustup self uninstall -y`\n * fix(cli/help): change indentation of discussions to 2 spaces\n * fix(cli/help): adjust help text for `rustup install`\n * feat(cli/help): add toolchain install tips to `rustup update`'s discussion\n * feat(cli/help): discuss `rustup toolchain install`\n * style: Remove wildcard imports\n * progress: modify progress bar's states to be column-aligned\n * installations: handle installation of components through progress bars\n * feat(cli): Add a sub-heading style for 'completion' Help Discussion\n * feat(cli): Have Help Discussions match rest of CLI Help\n * feat(cli): Add color to clap help/errors\n * refactor(cli): Switch help text to functions\n * cli: propagate ActiveSource from the top\n * cli: upgrade error events to ERROR level\n * cli: inline Cfg::active_rustc_version()\n * cli: extract display_version() from rustup main()\n * cli: inline Cfg::resolve_local_toolchain()\n * cli: inline Cfg::resolve_toolchain()\n * config: extract setting of toolchain override in rustup help mode\n * cli: avoid Cfg construction indirection\n * config: privatize some Cfg fields\n * config: drop trivial Cfg setters\n * Expand `RUSTUP_TOOLCHAIN_SOURCE`'s documentation\n * refactor(installation): extract installation of a component into a separate function\n * bin: clean up imports\n * cli: rename CLIError to CliError\n * config: rename OverrideDB to OverrideDb\n * dist: clean up unnecessary qualification\n * test: Replace trycmd with snapbox\n * chore: Update snapbox\n * Update the default Windows SDK version\n * refactor(log): Single source RUSTUP_TERM_COLOR\n * style: Encourage using existing imports\n * process: avoid fine-grained locking for logs\n * process: discard unnecessary layer of synchronization\n * process: inline TerminalInnerLocked\n * process: replace unsafe code with safe equivalent\n * process: extract color_choice() method\n * process: extract is_a_tty value\n * process: inline StreamSelector::is_a_tty()\n * process: inline TestWriterLock\n * Implement `RUSTUP_TOOLCHAIN_SOURCE` with new `Display` impl\n * Move `Display` impl to `to_reason()`\n * Rename `ActiveReason` to `ActiveSource`\n * dist: simplify DownloadStatus setup\n * dist: decentralize download status\n * dist: postpone creation of ComponentBinary values\n * dist: extract DownloadStatus type\n * dist: call DownloadTracker methods directly\n * dist: drop unnecessary Notifier layer\n * dist: replace PackageContext with DownloadCfg\n * refactor: Directly apply styling\n * refactor: Don't bother grabbing lock for tests\n * refactor: Replace termcolor with anstream\n * refactor: Move style building out of ColorableTerminal\n * refactor: Migrate to anstyle for color definitions\n * fix(www): removes www subdomain from all rust-lang.org urls\n * dist: move Notification into dist::download\n * notifications: remove unused Display impl\n * dist: move Notifier into DownloadCfg\n * cli: build Cfg earlier in setup mode\n * dist: reuse existing DownloadCfg in update_v1()\n * dist: move dist_root out of DownloadCfg\n * dist: drop unused Clone derives\n * dist: drop Copy derive from DownloadCfg\n * dist: move Notifier and DownloadTracker into dist::download\n * dist: inline DownloadCfg test setup\n * download: move File items down\n * download: extract DownloadCfg initialization from Cfg\n * config: discard pointless method argument\n * cli: rename DownloadTracker::new_with_display_progress() to new()\n * notifications: log directly from DownloadTracker\n * notifications: log directly on bad download checksums\n * notifications: log directly when reusing downloaded files\n * notifications: log directly on buffer size changes\n * Update platforms to 3.7.0\n * notifications: log directly on duplicate toolchain files\n * notifications: log directly on metadata upgrades that remove toolchains\n * notifications: log directly when reading metadata version\n * notifications: log directly when metadata upgrade is not needed\n * notifications: log directly when upgrading metadata version\n * notifications: log directly when uninstalling toolchains\n * notifications: log directly when toolchain is up to date\n * notifications: log directly when toolchain has been installed\n * notifications: log directly when installing toolchains\n * notifications: log the toolchain directory directly\n * notifications: log directly when using existing toolchains\n * notifications: log directly when looking for toolchains\n * notifications: log directly when setting auto-self-update mode\n * notifications: log directly when setting profile\n * notifications: log directly when setting overrides\n * notifications: use human-friendly log format for temp file deletions\n * notifications: use human-friendly log format for directory deletions\n * notifications: use human-friendly log format for retrying renames\n * notifications: use human-friendly log format for path canonicalization\n * cli: drop unnecessary generics\n * process: import instead of qualifying ColorableTerminal\n * process: hide internal structure\n * process: don't re-export external items\n * process: rename terminalsource to terminal_source\n * process: rename filesource to file_source\n * process: re-order items in terminalsource module\n * feat(cli/self-update): add support for PowerShell on Unix systems\n * refactor: Remove unused traits\n * refactor: Directly use ColorableTerminal\n * refactor: Simplify working with ColorableTerminal\n * fix(process): Ensure stdout/stderr lock is held across calls\n * refactor(process): Centralize Write bookkeeping\n * docs(changelog): describe default profile change during auto-install\n * Fix typo in clitools.rs comment\n * ci(docs): fix local doc branch name\n * Move the default branch from `master` to `main`\n * Upgrade opentelemetry dependencies\n * ci: use macOS Intel runners\n * notifications: log directly when setting the default toolchain\n * notifications: log directly when setting auto install mode\n * notifications: log directly when resuming partial downloads\n * notifications: log directly when downloading files\n * notifications: log directly when removing stray hash files\n * notifications: log directly when skipping components\n * notifications: log directly on missing components\n * notifications: log directly when downloading legacy manifests\n * notifications: log directly for downloaded manifests\n * notifications: log directly for manifest downloads\n * notifications: log directly when removing components\n * notifications: log directly when installing components\n * notifications: log directly after failing to determine memory limit\n * notifications: log directly when hash file not found\n * notifications: log directly when failing to update hash file\n * notifications: log directly when component is already installed\n * notifications: log directly for valid checksums\n * notifications: log directly when using download backends\n * chore: avoid trailing whitespace in error message\n * refactor: Switch logging to anstyle\n * refactor: Remove unused ColorableTerminal::carriage_return\n * notifications: privatize Notification type\n * notifications: log directly on creating temp files\n * notifications: log directly on temp root creation\n * notifications: log directly on file deletions\n * notifications: log directly on directory deletions\n * notifications: log directly about non-fatal errors\n * notifications: log directly about rolling back changes\n * notifications: log directly for retrying renames\n * notifications: log directly when removing directories\n * notifications: log directly when copying directories\n * notifications: log directly when linking directories\n * notifications: log directly when path canonicalization fails\n * notifications: log directly when creating directories\n * tests: use DistContext for dist::components tests\n * tests: move DistContext into library\n * tests: deduplicate distribution installation tests\n * notifications: tweak style\n * Inline utils Notification variants into top-level Notification\n * Inline dist Notification variants into top-level Notification\n * Inline dist::temp::Notification variants into top-level Notification\n * dist: remove temp::Notification variant from dist::Notification\n * dist: extract URL alteration from download() method\n * dist: detach download_component() from Manifestation\n * dist: introduce ComponentBinary type\n * dist: avoid passing through arguments\n * dist: avoid unnecessary type annotations\n * dist: avoid cloning components Vec\n * refactor: remove redundant references\n * dist: simpify casting to trait object\n * dist: deduplicate decompression setup code\n * cli: move more self update logic into self_update module\n * refactor(dist/manifestation): remove redundant `.to_string()`\n * Remove unneeded paranthesees\n * Fix link in the bug reporting template\n * ci(all-features/windows): update `OPENSSL_LIB_DIR` for OpenSSL v3 compatibility\n * docs(dev-guide): improve suggestion for overriding arg0\n * docs(dev-guide): mention the arg0 override trick on welcome page\n * docs(README): link CI status badge to GitHub Actions panel\n * feat(dist/manifestation): adjust default concurrent downloads when installing toolchains\n * feat(cli/rustup-mode): check updates for all channels unless `RUSTUP_CONCURRENT_DOWNLOADS` is set to 1\n * refactor: rename `num_channels` to `concurrent_downloads`\n * fix: fix hang by preventing `stream.buffered(0)` in concurrent downloads\n * test(dist/manifestation): extract `TestContext::*with_env()`\n * refactor(download): use `NonZero` instead of `NonZeroU64`\n * refactor(process): remove redundant `.context()` in `Process::concurrent_downloads()`\n * chore(deps/renovate): group version bumps for `windows-rs` crates\n * Upgrade windows crates\n * fix(cli/rustup_mode): use ASCII-compatible spinner\n * chore(deps): update aws-actions/configure-aws-credentials action to v5\n * feat(install): warn if default linker (cc) is missing; add respective test case\n * Remove hardcoded dependency to the master branch\n * feat(downloads): delay the reappearance of the progress bar when retrying a download\n * fix(downloads): correct faulty behavior when a download fails\n * fix(downloads): correct faulty output when retrying a download\n * feat(self_update): add tcsh shell support to cli #3413\n * Replace non_empty_env_var() with Process::var_opt()\n * fix(downloads): report real elapsed time of a component downloads instead of cumulative\n * Treat empty environment variables as unset\n * fix(downloads): honor the RUSTUP_CONCURRENT_DOWNLOADS by always having \"n\" concurrent downloads\n * chore(deps): disable default features for zstd\n * feat(downloads): introduce `RUSTUP_CONCURRENT_DOWNLOADS` to control concurrency\n * ci(check): make installation of `taplo-cli` faster\n * fix(notifications): delete unnecessary Download(Pop/Push)Unit notifications\n * fix(downloads): extract closure for downloading a component into a separate function\n * feat(downloads): concurrently download components\n * fix(downloads): add a comment to justify the unwrap on `.get()` of `OnceLock`\n * chore(deps): update actions/checkout action to v5\n * fix(download_timeout): introduce RUSTUP_DOWNLOAD_TIMEOUT for overriding download timeout\n * fix(downloads): substitute the LazyLock for a OnceLock\n * feat(rustup_mode): revise help message\n * feat: improve error message for `rustup which`\n * test: detach snapshots from component installation order\n * feat(download_tracker): refactor in favor of `indicatif`\n * feat(process): create a `ProgressDrawTarget` (for `indicatif`) inside the `Process`\n * fix(rustup-init/sh): avoid `hw.optional.*: 1` stdout in macOS arch check\n * hack(cli/common): suppress host emulation warnings in rustup's own CI\n * fix(test/clitools): pass `RUSTUP_CI` to in-process tests\n * ci(macos): run x64 workflows with Rosetta 2\n * docs(user-guide/environment-variables): clarify the unit of `RUSTUP_UNPACK_RAM`\n * docs(user-guide/environment-variables): unify description style\n * docs(user-guide/environment-variables): update description of `RUSTUP_IO_THREADS`\n * Limit Tokio worker threads to I/O thread count\n * Use manual Tokio runtime setup\n * Attach io_thread_count() to Process\n * Always consider RUSTUP_IO_THREADS as input for thread count\n * utils: express io_thread_count() in a simpler way\n * opt(err): show renaming file error source\n * Set a maximum thread limit for remove_dir_all\n * fix(toolchain/distributable): refine handling of known targets with no prebuilt artifacts\n * fix(ci/fetch-rust-docker): update comments\n * fix(ci/docker): update `CC` name for `powerpc64le-unknown-linux-gnu`\n * Extract self_update() from update_all_channels()\n * Show channel updates even if self update is not permitted\n * Remove Cargo feature indirection\n * Move Cfg::get_self_update_mode() to SelfUpdateMode::from_cfg()\n * Replace trivial enum with bool\n * feat(updates): introduce `RUSTUP_TERM_WIDTH` to override terminal width\n * feat(updates): introduce `RUSTUP_TERM_PROGRESS_WHEN` to toggle the progress bars\n * Limit the default number of I/O threads\n * Bump `toml` to 0.9\n * feat(updates): check for updates concurrently\n * feat(terminal): implement the `TermLike` trait for `ColorableTerminal`\n * chore: use match ergonomics in favor of explicit `ref`s\n * refactor(download/curl): use early returns in `download()`\n * chore(cli/rustup_mode): merge `std` imports\n * chore(cli/rustup-mode): import `std::io`\n * chore: fix new `clippy` warnings\n * fix(ci/run): specify target triple for `bindgen-cli` installation\n * feat(www): improve \"copy\" button style compatibility with Chromium\n * ci(run): install `codegen-cli` with `cargo-binstall`\n * docs: replace Discord links\n * Block broken snap curl\n * Upgrade to windows-sys 0.60\n * Emphasize that `llvm-tools` dist component is not subject to compiler stability guarantees\n * docs(README): update CI status badge\n * Fix rustup-init.sh cputype check for sparcv9\n * add Solaris support\n * test(clitools)!: remove all deprecated `.expect_*()` APIs\n * test(clitools)!: privatize `Config::run()`\n * test: migrate remaining uses of `.run()` to `.expect()` APIs\n * test(clitools): extract `Assert::redact()`\n * test: simplify `.display().to_string()` in `.extend_redactions()`\n * test(cli_misc): bring back missing assertions\n * Update help.rs: bash completions instructions (#1)\n * docs(user-guide): fix typo\n * docs(dev-guide): update the section on `clippy` lints\n * docs(dev-guide): mention test helpers and `Assert`\n * docs(test/clitools): add docs for `Assert`\n * Upgrade to rustls-platform-verifier 0.6\n * test(cli-v2): migrate to `.expect()` APIs\n * test(cli-misc): migrate to `.expect()` APIs\n * fix(toolchain): fix proxy fallback notification format on Windows\n * test(cli-v1): migrate to `.expect()` APIs\n * test(download): serialize tests with proxy-sensitive URLs\n * test(cli-rustup): migrate to `.expect()` APIs\n * test(clitool): add `Assert::remove_redactions()`\n * test(clitools): allow `OsStr`-like args in `Config::expect*()`\n * Fix CI image names for downloading ARM and PowerPC artifacts\n * Update platforms to 3.6\n * test(cli-exact): migrate to `.expect()` APIs\n * Avoid swallowing errors in show()\n * Simplify target processing logic\n * Inline returned bindings\n * Increase Windows main thread stack size to 2mb\n * test(cli-inst-interactive): migrate to `.expect()` APIs\n * Unset RUSTUP_AUTO_INSTALL for tests\n * test(cli-paths): migrate to `.expect()` APIs\n * test(cli-exact): use the new `[CURRENT_VERSION]` redaction\n * test(cli-self-upd): migrate to `.expect()` APIs\n * Tweak list_items() docstring\n * Leverage bool::then_some() to simplify some code\n * Avoid intermediate allocation in listing\n * test(custom-toolchains): `target list` now can display the installed targets\n * feat(custom-toolchains): `target` and `component list` working on custom toolchains\n * Skip manifest loading if there are no components/targets to check\n * fix(deps): update rust crate opener to 0.8.0\n * rustup check: set exit status based on available updates\n * rustup check: adopt no-self-update logic\n * feat(self_update): add proxy sanity checks\n * style(test): qualify uses of `snapbox::str![]`\n * refactor(test): migrate some tests to `.expect()` APIs\n * chore(test): deprecated old APIs overlapping with the new ones\n * refactor(test): add new `.expect()`-based testing APIs\n * test(custom-toolchains): using `show` on a custom toolchain without a `components` file\n * test(custom-toolchains): add test to showcase that the issue was solved\n * feat(custom-toolchains): `rustup show` now reporting installed targets\n * tests: print diffs on test failures\n * Log versions during self updates\n * Fix cargo lints on Windows\n * toolchain: hoist binary name conditionals out of fallback functions\n * refactor(test): replace `TempDir::into_path()` with `TempDir::keep()`\n * refactor(test/clitools): use globally-defined `tempdir_in_with_prefix()`\n * feat(toolchain): notify the user when proxy fallback is activated\n * feat(toolchain): consider external `rust-analyzer` when calling a proxy\n * refactor(toolchain): move predicates into `Toolchain::maybe_do_cargo_fallback()`\n * refactor(toolchain): privatize `Toolchain::maybe_do_cargo_fallback()`\n * deps: update aws-lc-rs to 1.13.1\n * docs(changelog): mirror changes from the release announcement, take 2\n * Deprecate native-tls as well\n * Enable HTTP/2 support for reqwest download backend\n * Emit tracing events from log facade calls\n * download: show Debug representation for errors\n * Avoid repeated globals in tracing events\n * Log original download errors immediately\n * feat(cli/rustup-mode): add aliases to `rustup component remove`\n * Switch flate2 to use the zlib-rs backend\n * Hardlink proxies if symlinks aren't reachable\n * Add powerpc64le-unknown-linux-musl support\n * Add toolchain_name to not installed bail msg\n * Warn about using curl\n * Drop workspace indirection\n * Fold download crate back into rustup\n * download: merge integration test files\n * Test CARGO environment replacement\n * Update CARGO env var if it is a rustup proxy\n * Tweak toolchain subcommand help text\n * Move toolchain and default commands first\n * show toolchain paths in rustup show -v output\n * refactor(cli/self-update): save allocations in `Nu::rcfiles()`\n * fix(cli/self-update)!: stop appending to `env.nu` due to deprecation\n * fix(cli/self-update): consider Windows paths in Nushell suggestions\n * refactor(cli/self-update): use `path add` in `env.nu` template\n * fix(cli/self-update): use interpolated string in `env.nu` template\n * Upgrade dependencies\n * docs(user-guide/environment-variables): document `RUSTUP_VERSION`\n * feat(rustup-init/sh): allow setting `RUSTUP_VERSION` during installation\n * feat(cli/self-update): allow setting `RUSTUP_VERSION` for arbitrary\n downgrades\n * feat(test/clitools): add `Config::expect_ok_ex_env()`\n * fix(errors)!: improve error messages for `RustupError::ToolchainNotInstalled`\n * Add set auto-install disable\n * Use `cursor: pointer` for copy button on website\n * fix(dist): refine suggestions about missing targets\n * Append Windows bin directory to PATH by default\n * Remove validation for custom toolchains when reading rust-toolchain.toml\n * document RUSTUP_AUTO_INSTALL\n * Fix build script `cargo` instructions\n","status":"published","published":"2026-10-02T19:31:21Z","modified":"2026-10-03T17:00:03.791677441Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"openSUSE-SU-2026:22079-1","title":"Security update for virtiofsd","description":"This update for virtiofsd fixes the following issue:\n\n- CVE-2026-25727: time: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion\n  (bsc#1257912).\n\nChanges for virtiofsd:\n\n * Update the time crate (bsc#1257912, CVE-2026-25727)\n * Add command line options for UID/GID translation (bsc#1283239)\n * PassthroughFs: Add IdMap structures (bsc#1283239)\n * Add host/guest UID/GID translation code (bsc#1283239)\n * Custom UID/GID mapping for Attr (bsc#1283239)\n * Add UID/GID mapping functions to PassthroughFs (bsc#1283239)\n * Use explicit UID/GID types (bsc#1283239)\n * Introduce explicit UID/GID types (bsc#1283239)\n * Use SetattrIn without conversion (bsc#1283239)\n * Use fuse::Attr in FileSystem interfaces (bsc#1283239)\n","status":"published","published":"2026-10-09T12:48:27Z","modified":"2026-10-19T17:23:12.640568433Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"SUSE-FU-2026:20990-1","title":"Feature update for himmelblau","description":"This update for himmelblau fixes the following issues:\n\nUpdate to himmelblau 2.3.8 (jsc#PED-14511):\n\nSecurity issues:\n\n- CVE-2025-54882: world readable cloud TGT token (bsc#1247735).\n- CVE-2025-58160: tracing-subscriber: Tracing log pollution (bsc#1249013).\n- CVE-2026-25727: time: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion\n  (bsc#1257904).\n- CVE-2026-31979: race condition when accessiung /tmp/krb5cc_\u003cuid\u003e (bsc#1259548).\n\nNon security issues:\n\n- Fix SELinux module packaging to use standard policy macros (bsc#1258236).\n\nChangelog:\n\nVersion 2.3.8:\n\n * Add PrivateTmp back to Tasks Daemon\n * Drop dead code\n * Drop krb5 ccache dir code\n * Add a TODO comment\n * Drop non working packaged krb5 snippet file\n * Write kerberos config snippet\n * Extend resolver interface to return kerberos config together with TGTs\n * Backport SELinux fixes from main\n * Use libkrimes to store TGTs\n\nVersion 2.3.7:\n\n * cargo vet\n * Fix AWS-LC has PKCS7_verify Certificate Chain Validation Bypass\n * Revert dependency change which broke the nightly build\n * gen_dockerfiles: only himmelblaud has tpm feature, fix all others\n * fix(build): gen_dockerfiles.py mutates shared features list mid-loop\n\nVersion 2.3.5:\n\n * Better handle Intune API version\n * Update make vet from main branch\n * pam_himmelblau: call split_username once in chauthtok\n * pam_himmelblau: return PAM_IGNORE in chauthtok for local users\n * Don't attempt a DAG when Hello fails with SSPR demand\n\nVersion 2.3.4:\n\n * deps(rust): bump the all-cargo-updates group across 1 directory with 8 updates\n * Revert sketching update (which breaks SLE16 build)\n\nVersion 2.3.3:\n\n * /var/cache/private/himmelblaud should not be created tmpfiles\n * Updatee python vers for dataclasses dep\n * deps(rust): bump the all-cargo-updates group across 1 directory with 3 updates\n * Generate pin init service file systemd \u003c 250\n * Checkin missing himmelblaud.if file for SELinux\n * Resolve typos in selinux package commands\n\nVersion 2.3.2:\n\n * Compile SELinux policy at install time for cross-distro compatibility\n * Improve PAM configuration on openSUSE/SLE\n * Fix SELinux policy\n * Add a git hook to ensure selinux policy is tested\n * Ignore generated himmelblau-hsm-pin-init service file\n * Refactor SELinux policy for cross-distro compatibility\n * Fix NSS lookup for mapped local users\n * Skip OS version compliance checks when min/max values are empty\n\nVersion 2.3.1:\n\n * Remove references to qrcodegen (these are 3.x features)\n * QR Greeter compatibility for old GNOME\n * Enable QR greeter automatically\n * ci: Use latest cargo-vet from git to fix CI\n * Fix HSM pin migration failure on Debian/Ubuntu upgrades from v1.4.x\n\nVersion 2.3.0:\n\n * Autostart the daemons on fresh install or upgrade\n * Restart sshd when installing the ssh config\n * Allow tasks daemon to write krb ccache\n * Do not enumerate mapped users in NSS\n * Update libhimmelblau to latest version\n * Fix Tumbleweed build\n\nVersion 2.2.0:\n\n * Update libhimmelblau to 0.8.x series\n * deps(rust): bump the all-cargo-updates group with 17 updates\n * Only use OpenSSH bug workaround for ssh service\n * Fix debug noise from removing user from sudo group\n * systemd: install files to /usr/lib/, not /etc/\n\nVersion 2.1.0:\n\n * Fix nightly authselect build failure\n * Generate the authselect profiles for each distro\n * Improve pam config handling in aad-tool\n * Make `aad-tool configure-pam` detect location of pam files\n\nVersion 2.0.5:\n\n * /var/lib/private/himmelblaud should be owned by root\n * Use tmpfiles.d to create himmelblaud private data directory\n * deps(rust): bump the all-cargo-updates group with 13 updates\n\nVersion 2.0.4:\n\n * Update kanidm_build_profiles mask version\n * Utilize cargo vet from main\n * Add policies cache patch via systemd-tmpfiles\n\n * Fix man page comments about change idmap_range\n * Stub picky-krb for osc build\n * Stub a kanidm_build_profiles which builds in osc\n * Ensure nss cache is created on Ubuntu/Debian\n * Request a user token if NSS hasn't been called\n\nVersion 2.0.3:\n\n * Add nss cache patch via systemd-tmpfiles\n\nVersion 2.0.2:\n\n * Recommend `patch` with the pam package\n * Fix passwordless FIDO authentication not being used when available\n * Git workflow updates for stable-2.x\n * Only warn on Intune failure\n\nVersion 2.0.1:\n\n * Force o365 desktop files to always rebuild\n * Always rebuild the o365 apps\n * Add restart on-failure to systemd services\n * Clarify `domain` SHOULD match login domain\n * Remove warning about `domain` himmelblau.conf opt\n * Pseudo eliminate multi-tenant and domains section\n * Revert \"Fix Hello PIN lookup when an alias domain\"\n * Comment out `KbdInteractiveAuthentication on` in sshd conf\n * Check the nxset sooner, to avoid unwanted errors\n * Recommend oddjob_mkhomedir with authselect\n * Pin libhimmelblau to 0.7.x\n * Deprecate Fedora 41\n * deps(rust): bump the all-cargo-updates group with 11 updates\n * Bump github/codeql-action from 4.30.8 to 4.31.2\n * Bump cachix/install-nix-action from 31.8.1 to 31.8.2\n * Bump actions/upload-artifact from 4.6.2 to 5.0.0\n * cargo clippy and rebase fix\n * fixup! add extra debug output to NotFound error code\n * force error output to show up in CI logs\n * wrap repeated sources of IdpError::NotFound in helper functions\n * add extra debug output to NotFound error code\n * use direnv for loading the nix devshell\n * We should still encourage mapping by name\n * Add support for Fedora 43\n * Provide a offline 'breakglass' mode\n * cargo clippy\n * Add warning about incorrect nsswitch configuration\n * Distinguish between online and offline token fail\n * Ensure user token uses original name\n * Fix alias domain in auth result causing failure\n * Resolve cargo clippy warnings\n * Only map on cn name for the primary domain\n * Install systemd in build scripts for gen service\n * Fix systemd version parsing\n * Update libhimmelblau to 0.7.19\n * Resolve SELinux build failures in nightly (part 2)\n * Rocky container image updates were failing\n * Warn instead of error when no idmap_range specified\n * deps(rust): bump the all-cargo-updates group across 1 directory with 7 updates\n * Trim whitespace from local group names\n * Fix borrowing error\n * Fix reference to local_sudo_group in condition\n * Only run sudo_groups if local_groups does not contain local_sudo_group\n * Leave SELinux in permissive mode for Himmelblau\n * Resolve SELinux build failures in nightly\n * nix: add join_type option to nixos-module settings\n * Build host configuration changes\n * Ensure that hsm_pin isn't present decrypted\n * Document Soft HSM changes to TPM bound\n * Disable SELinux by default on NixOS\n * sh doesn't have `source`\n * Encrypt hsm-pin using systemd-creds\n * Recommend uuid id mapping\n * Improve himmelblau.conf man page formatting\n * Implement Local User Mapping\n * Add o365 dependency for jq\n * Add selinux rules for gdm login\n * Narrow the scope of selinux policy with audit2allow\n * Generate the systemd service files\n * Fix selinux build for SLE16\n * Resolve SLE16 build dependency failure\n * Fix the rawhide build\n * Mask the sshkey-attest package\n * Bump cachix/install-nix-action from 31.7.0 to 31.8.1\n * cargo vet dependency updates\n * deps(rust): bump the all-cargo-updates group across 1 directory with 13 updates\n * Bump actions/dependency-review-action from 4.8.0 to 4.8.1\n * Bump cachix/install-nix-action from 31.7.0 to 31.8.0\n * Bump github/codeql-action from 3.30.5 to 4.30.8\n * Bump ossf/scorecard-action from 2.4.2 to 2.4.3\n * SELinux improvements\n * Fix a typo in package gen scripts\n * cargo fmt\n * Permit NSS response for mapped primary fake group\n * Fix Nix Error With Fuzz\n * Decrease CI fuzzer setup time\n * Document join types\n * Support for Entra registered devices\n * Run `cargo test` in a container\n * Bump cachix/install-nix-action from 31.6.2 to 31.7.0\n * deps(rust): bump the all-cargo-updates group across 1 directory with 2 updates\n * Bump github/codeql-action from 3.30.4 to 3.30.5\n * Use pastey crate instead of unmaintained paste\n * Pin unmaintained serde_cbor dep to serde_cbor_2\n * Resolve tower-http `cargo audit` warning\n * Replace unmaintained fxhash with own version\n * Resolve warning about workflow top level write permissions\n * Remove dependabot automerge\n * Resolve division by 0 in idmap code\n * [StepSecurity] ci: Harden GitHub Actions\n * Only idmap against initialized domains\n * Resolve invalid init of idmap with same domain\n * Add fuzzing of idmap code\n * Add basic fuzzing of the config options\n * Resolve error found by fuzzing\n * cargo vet prune\n * deps(rust): bump regex in the all-cargo-updates group\n * Bump actions/dependency-review-action from 4.7.3 to 4.8.0\n * Bump actions/checkout from 3.6.0 to 5.0.0\n * Bump cachix/cachix-action from 14 to 16\n * Bump ossf/scorecard-action from 2.4.0 to 2.4.2\n * Bump cachix/install-nix-action from 25 to 31\n * Add the OpenSSF Best Practices badge\n * Add scorecard badge\n * [StepSecurity] Apply security best practices\n * Fix group static mapping\n * Move aad-tool idmap cache clear to the idmap cmd\n * Resolve errant \"Hello key missing.\" messages\n * Update flake.nix\n * Slow the dependabot update frequency\n * Audit dependabot updates\n * deps(rust): bump the all-cargo-updates group across 1 directory with 11 updates\n * feat: Add support for aarch64 on Debian-based distributions\n * Resolve possible invalid pointer dereferences\n * Avoid revealing account ids in debug log\n * Cause doc links to open in the correct apps\n * Permit opening multiple instances of Word/Excel\n * Modify systray and app close behavior\n * Don't use questionably licensed icons for o365\n * Resolve NixOS CI failure\n * Fix building w/out deprecated interactive feature\n * Update himmelblau.conf.5 sudo_groups example\n * Entra group based sudo access\n * Audited the cargo updates\n * deps(rust): bump the all-cargo-updates group with 6 updates\n * Vet libhimmelblau\n * Add `make vet` command\n * Update deny.toml\n * Remove incompatible licenses from deps\n * Fix RHEL8 package signing\n * Add SBOM generation\n * Add an IRP checklist for security incidents\n * Run the nixos build/release on the correct version\n * Add crate dependency auditing on MR\n * Add some exceptions\n * Initialize cargo vet\n * Remove in-tree kanidm dependencies\n * Fix Hello PIN lookup when an alias domain\n * Raise maximum group lookup from 100 to 999\n * Always work with lowercase account names\n * Modify FUNDING.yml for funding sources\n * Remove glib dependency\n * deps(rust): bump the all-cargo-updates group with 10 updates\n * Add CI check for licenses\n * Update dependabot.yml to target all stable branches\n * Add authselect module for Rocky/Fedora\n * Recommend packages, instead of require\n * Add a Contributing document\n * Add a Code of Conduct\n * add withSelinux flag to nix build, brings SELinux binaries into the build environment.\n * deps(rust): bump tracing-subscriber in the cargo group\n * Don't overwrite the himmelblau.conf on rpm upgrade\n * Add help output to the Makefile\n * Fix building packages with docker in root mode\n * Update to latest libhimmelblau and identity_dbus_broker\n * Make PRT SSO cookie via broker work as well for Edge\n * Make broker work for Edge\n * Generate Office 365 desktop apps\n * Update README\n * Add `make uninstall` command\n * Remove the deprecated tests suite\n * Himmelblau no longer has git submodules\n * Make install using packages\n * Add Debian 13 packages\n * Generate Dockerfiles automatically\n * Add SELinux configuration\n * Himmelblau daemon requires system tss user\n * Add cron dependency for Intune scripts\n * Do not mangle /usr/etc configuration files\n * deps(rust): bump the all-cargo-updates group with 7 updates\n * Add SLE16 (beta) build target\n * Automatically append to nsswitch.conf in postinst\n * Correct the RPM postinst script syntax\n * Fix Kerberos credential cache permissions\n * Set file owner and group before writing its content\n * Create SECURITY.md\n * Rev the dev version to 2.0.0\n * Ensure alias domains match when checking Intune device id\n * Debian 12 doesn't support ConditionPathExists and notify-reload\n * Write scripts policy to a readable directory\n * Apply Intune policies right after enrollment\n * Add more debug instrumentation\n * Provide device_id to Intune enrollment if not cached\n * Ensure nss cache directory is created during install\n * Remove /var/cache/himmelblaud access from tasks daemon\n * Resolve daemon startup absolute path warnings\n * Delay Intune enrollment on Device Auth fail\n * Do not leak the Intune IW service token in the logs\n\nVersion 1.4.2:\n\n * Revert libhimmelblau unstable update\n\nVersion 1.4.1:\n\n * Update Intune to use app version 1.2511.7\n\nVersion 1.4.0:\n\n * Resolve build failures\n * deps(rust): bump the all-cargo-updates group across 1 directory with 6 updates\n\nVersion 1.3.0:\n\n * Revert the self-hosted runner name\n * deps(rust): bump the all-cargo-updates group with 23 updates\n * Include latest branch in CI\n * Self hosted runners\n\nVersion 1.1.0:\n\n * Fix policy application\n * Add remaining Linux password compliance policies\n * Add custom compliance enforcement\n * deps(rust): bump the all-cargo-updates group with 3 updates\n * deps(rust): bump the all-cargo-updates group with 5 updates\n * Add SLE15SP7 build target\n * Add RHEL 10 build target\n * Fix Intermittent auth issue AADSTSError 16000\n * Remove old utf8proc dependency\n * Add `fedora42` build target\n * Handle PRT expiration and tie to offline auth\n * Correctly delete the Hello keys on bad pin count\n * Add ability to disable Hello PIN per-service\n * Update NixOS support to 25.05\n * Handle disabled device by attempting re-enrollment\n * Always attempt confidential client creds for aad-tool\n * Include HSM option defs in himmelblau.conf man page\n * Improve the aad-tool cache-clear command\n * Add `mfaSshWorkaroundFlag` configuration option to Nix Flake.\n * Add the ability to remove confidential client creds\n * If bad PIN count is exceeded, delete the Hello key\n * deps(rust): bump the all-cargo-updates group with 4 updates\n * Add instructions for creating developer builds\n * Fix GDM3 first time login password prompt\n * Default HsmType should be soft\n * Add himmelblaud to tss group for TPM startup\n * Enforce strict order for the systemd units\n * Update libhimmelblau and compact_jwt\n * Fix builds w/tpm\n * aad-tool Authentication flow improvements\n * Filter out irrelevant debug in aad-tool\n * Create a unified login experience for aad-tool\n * Utilize confidential creds for aad-tool enumerate\n * himmelblau should get posix attributes w/out delegate user access\n * Always use the Object Id for mapping Group to GID\n * Update enhancement-request.md for SPI donations\n * Update bug_report.md with SPI donation\n * Update build requires in README.md\n * Update FUNDING.yml with SPI Paypal donation button\n * Don't break from tasks loop when policies fail\n * Enroll in Intune as soon as it is enabled\n * Implement `decoupled hello` behavior\n * Cache encrypted PRT to disk for offline login SSO\n * Update to latest hsm-crypto\n * Enable tpm functionality\n * Allow altering the password and PIN prompt messages\n * Ensure Hello PIN lockout happens when online\n * Cache the build target output to improve build times\n * Easier build selection w/ Makefile\n * Revert mistaken removal from Makefile\n * Make the user wait longer with each incorrect PIN\n * Make the bad PIN count configurable\n * Improve aad-tool manpage\n * aad-tool fails if the user has FIDO2 enabled\n * Offline auth permits authentication with invalid Hello PIN\n * PIN complexity to match Windows\n * Update to latest SSSD idmap code\n * Add aad-tool options for setting posix attrs\n * Add scopes and redirect uris aad-tool application create\n * Add aad-tool commands for managaging extension attrs\n * Utilize the sidtoname call for object id mapping\n * Add commands for listing/creating App registrations\n * Potential fix for code scanning alert no. 2: Workflow does not contain permissions\n * Potential fix for code scanning alert no. 4: Workflow does not contain permissions\n * Potential fix for code scanning alert: Workflow does not contain permissions\n * Never write the app_id to the server config\n * Disable passwordless Fido by default\n * Stop using deprecated `users` crate\n * When group membership lookup fails, use cached groups\n * aad-tool command for enumerating users and groups\n * Name-Based Group Matching in `pam_allow_groups` Leads to Potential Security Bypass\n * Add the configure-pam option to aad-tool man page\n * Add static idmap cache for on-prem to cloud migration\n * Update bug_report.md with request for himmelblau.conf\n * deps(rust): bump the all-cargo-updates group with 2 updates\n * Update crates in a group\n * Update crate bumps\n * Utilize new Intune compliance enforcement via libhimmelblau\n * Correct the README regarding Intune policy compliance\n * Disable Chromium policy\n * Re-enable Intune policy and add scripts and compliance policies\n * himmelblau.conf alias `domain` as `domains`\n * Support Fido auth in pam passwd\n * Add TAP support to himmelblaud and pam passwd\n * Mixed case names should properly identify Hello Key\n * Update linux-entra-sso to latest version\n * Fix group lookup for Entra Id group name\n * Fix mixed case name lookup from PRT cache\n * Crate updates\n * Fix tasks daemon debug output\n * Remove write locks where unecessary\n * Fix deadlock in nss\n * systemd notify fixes\n * Console\n * Address Feedback\n * Order services before gdb/nss-user-target\n * deps(rust): bump rpassword from 7.3.1 to 7.4.0\n * deps(rust): bump tokio from 1.44.2 to 1.45.0\n * deps(rust): bump sha2 from 0.10.8 to 0.10.9\n * deps(rust): bump systemd-journal-logger from 2.2.0 to 2.2.2\n * deps(rust): bump clap from 4.5.31 to 4.5.38\n * Update notify-debouncer-full\n * Update opentelemetry\n * Update dependencies\n * deps(rust): bump time from 0.3.39 to 0.3.41\n * Replace source filter that blacklists files with filter that whitelists files.\n * Mark himmelblau.conf as config in rpm\n * Update README.md\n * Ensure only the base URL is printed to log\n * If unix_user_get fails, wait, and try again\n * Supplying a PRT cookie to SSO doesn't require network\n * Don't send a password prompt if the network is down\n * Auth via MFA if Hello PIN fails 3 times\n * Improve Hello PIN failed auth error\n * Fix rocky9 build\n * deps(rust): bump anyhow from 1.0.96 to 1.0.98\n * deps(rust): bump libc from 0.2.170 to 0.2.172\n * deps(rust): bump cc from 1.2.16 to 1.2.19\n * deps(rust): bump tokio from 1.43.0 to 1.44.2\n * deps(rust): bump openssl from 0.10.71 to 0.10.72 in the cargo group\n * deps(rust): bump reqwest from 0.12.12 to 0.12.15\n * Update libhimmelblau in Cargo.lock\n * Fix nss and offline checks for domain aliases\n * Report error when MS Authenticator denies authorization\n * Bail out of invalid offline auth\n * Handle AADSTS errors from BeginAuth response\n * Never dump failed reqwests to the log\n * Update sccache-action version to use new cache service\n * Permit daemon to start when network is down\n * Add an nss cache for when daemon is down\n * Additional pam info cues\n * Proceed with Hello auth even with net down\n * Indicate to the user what the password and PIN are\n * Ensure pam messages are seen\n * Display the minimum PIN length during Hello setup\n * PAM should loop, not die on error\n * Ensure prompt msg remains for confirmation\n * Update bug_report.md\n * Ignore demands for setting up MS Authenticator\n * Login fails if Entra is configured to recommend MS authenticator\n * Add pam configure command to aad-tool\n * Update README.md with pam passwd instructions\n * aad-tool authtest needs to map names\n * Update demo video in README.md\n * Sign RPM packages\n * Ensure the pam module is installed correctly for SLE\n * Improve pam error handling and messaging\n * Only push cachix builds for stable releases\n * Terminate linux-entra-sso when browser terminates\n * On deb, push pam config after install\n * Increase priority of deb PAM passwd for Himmelblau\n * Improve offline state handling\n * Specify request for Entra Id password in PAM\n * QR Greeter also supports gnome-shell 47\n * Fix profile photo loading\n * Clarify pam_allow_groups in himmelblau.conf man page\n * Don't hide debug for pam_allow_groups miss\n * Handle failures in passwordless auth\n * build all root packages\n * split config options that can be defined per-domain from those which are global only\n * configure cachix signing and upload in ci\n * deps(rust): bump serde_json from 1.0.138 to 1.0.140\n * deps(rust): bump serde from 1.0.218 to 1.0.219\n * deps(rust): bump time from 0.3.37 to 0.3.39\n * deps(rust): bump bytes from 1.10.0 to 1.10.1\n * deps(rust): bump pkg-config from 0.3.31 to 0.3.32\n * Entra Id is case insensitive, cache lookup must match\n * deps(rust): bump ring from 0.17.9 to 0.17.13 in the cargo group\n * Support CompanionAppsNotification mfa method\n * QR code for gnome-shell greeter\n * Allow tasks to start if AccountsService dir missing\n * Remove invalid python dependency from sso package\n * Fixes https://github.com/himmelblau-idm/himmelblau/issues/397\n * Clear server config when clearing cache\n * Update version in the Cargo.lock\n * deps(rust): bump async-trait from 0.1.86 to 0.1.87\n * deps(rust): bump chrono from 0.4.39 to 0.4.40\n * Fix himmelblau.conf man page cn_name_mapping entry\n * deps(rust): bump pem from 3.0.4 to 3.0.5\n * deps(rust): bump serde from 1.0.217 to 1.0.218\n\nVersion 1.0.0:\n\n * deps(rust): bump cc from 1.2.15 to 1.2.16\n * Update workflow versions\n","status":"published","published":"2026-04-01T09:19:25Z","modified":"2026-04-10T18:33:45.284951Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-SU-2026:0452-1","title":"Security update for rust-keylime","description":"This update for rust-keylime fixes the following issues:\n\nUpdate to version 0.2.8+116.\n\nSecurity issues fixed:\n\n- CVE-2026-25727: time: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion\n  (bsc#1257908).\n\nOther updates and bugfixes:\n\n- Update vendored crates `time` to version 0.3.47.\n\n- Update to version 0.2.8+116:\n\n  * build(deps): bump bytes from 1.7.2 to 1.11.1\n  * api: Modify /version endpoint output in version 2.5\n  * Add API v2.5 with backward-compatible /v2.5/quotes/integrity\n  * tests: add unit test for resolve_agent_id (#1182)\n  * (pull-model): enable retry logic for registration\n  * rpm: Update specfiles to apply on master\n  * workflows: Add test to detect unused crates\n  * lib: Drop unused crates\n  * push-model: Drop unused crates\n  * keylime-agent: Drop unused crates\n  * build(deps): bump uuid from 1.18.1 to 1.19.0\n  * Update reqwest-retry to 0.8, retry-policies to 0.5\n  * rpm: Fix cargo_build macro usage on CentOS Stream\n  * fix(push-model): resolve hash_ek uuid to actual EK hash\n  * build(deps): bump thiserror from 2.0.16 to 2.0.17\n  * workflows: Separate upstream test suite from e2e coverage\n  * Send UEFI measured boot logs as raw bytes (#1173)\n  * auth: Add unit tests for SecretToken implementation\n  * packit: Enable push-attestation tests\n  * resilient_client: Prevent authentication token leakage in logs\n\n- Use tmpfiles.d for /var directories (PED-14736)\n  \n- Update to version 0.2.8+96:\n  \n  * build(deps): bump wiremock from 0.6.4 to 0.6.5\n  * build(deps): bump actions/checkout from 5 to 6\n  * build(deps): bump chrono from 0.4.41 to 0.4.42\n  * packit: Get coverage from Fedora 43 runs\n  * Fix issues pointed out by clippy\n  * Replace mutex unwraps with proper error handling in TPM library\n  * Remove unused session request methods from StructureFiller\n  * Fix config panic on missing ek_handle in push model agent\n  * build(deps): bump tempfile from 3.21.0 to 3.23.0\n  * build(deps): bump actions/upload-artifact from 4 to 6 (#1163)\n  * Fix clippy warnings project-wide\n  * Add KEYLIME_DIR support for verifier TLS certificates in push model agent\n  * Thread privileged resources and use MeasurementList for IMA reading\n  * Add privileged resource initialization and privilege dropping to push model agent\n  * Fix privilege dropping order in run_as()\n  * add documentation on FQDN hostnames\n  * Remove confusing logs for push mode agent\n  * Set correct default Verifier port (8891-\u003e8881) (#1159)\n  * Add verifier_url to reference configuration file (#1158)\n  * Add TLS support for Registrar communication (#1139)\n  * Fix agent handling of 403 registration responses (#1154)\n  * Add minor README.md rephrasing (#1151)\n  * build(deps): bump actions/checkout from 5 to 6 (#1153)\n  * ci: update spec files for packit COPR build\n  * docs: improve challenge encoding and async TPM documentation\n  * refactor: improve middleware and error handling\n  * feat: add authentication client with middleware integration\n  * docker: Include keylime_push_model_agent binary\n  * Include attestation_interval configuration (#1146)\n  * Persist payload keys to avoid attestation failure on restart\n  * crypto: Implement the load or generate pattern for keys\n  * Use simple algorithm specifiers in certification_keys object (#1140)\n  * tests: Enable more tests in CI\n  * Fix RSA2048 algorithm reporting in keylime agent\n  * Remove disabled_signing_algorithms configuration\n  * rpm: Fix metadata patches to apply to current code\n  * workflows/rpm.yml: Use more strict patching\n  * build(deps): bump uuid from 1.17.0 to 1.18.1\n  * Fix ECC algorithm selection and reporting for keylime agent\n  * Improve logging consistency and coherency\n  * Implement minimal RFC compliance for Location header and URI parsing (#1125)\n  * Use separate keys for payload mechanism and mTLS\n  * docker: update rust to 1.81 for distroless Dockerfile\n  * Ensure UEFI log capabilities are set to false\n  * build(deps): bump http from 1.1.0 to 1.3.1\n  * build(deps): bump log from 0.4.27 to 0.4.28\n  * build(deps): bump cfg-if from 1.0.1 to 1.0.3\n  * build(deps): bump actix-rt from 2.10.0 to 2.11.0\n  * build(deps): bump async-trait from 0.1.88 to 0.1.89\n  * build(deps): bump trybuild from 1.0.105 to 1.0.110\n  * Accept evidence handling structures null entries\n  * workflows: Add test to check if RPM patches still apply\n  * CI: Enable test add-agent-with-malformed-ek-cert\n  * config: Fix singleton tests\n  * FSM: Remove needless lifetime annotations (#1105)\n  * rpm: Do not remove wiremock which is now available in Fedora\n  * Use latest Fedora httpdate version (1.0.3)\n  * Enhance coverage with parse_retry_after test\n  * Fix issues reported by CI regarding unwrap() calls\n  * Reuse max retries indicated to the ResilientClient\n  * Include limit of retries to 5 for Retry-After\n  * Add policy to handle Retry-After response headers\n  * build(deps): bump wiremock from 0.6.3 to 0.6.4\n  * build(deps): bump serde_json from 1.0.140 to 1.0.143\n  * build(deps): bump pest_derive from 2.8.0 to 2.8.1\n  * build(deps): bump syn from 2.0.90 to 2.0.106\n  * build(deps): bump tempfile from 3.20.0 to 3.21.0\n  * build(deps): bump thiserror from 2.0.12 to 2.0.16\n  * rpm: Fix patches to apply to current master code\n  * build(deps): bump anyhow from 1.0.98 to 1.0.99\n  * state_machine: Automatically clean config override during tests\n  * config: Implement singleton and factory pattern\n  * testing: Support overriding configuration during tests\n  * feat: implement standalone challenge-response authentication module\n  * structures: rename session structs for clarity and fix typos\n  * tpm: refactor certify_credential_with_iak() into a more generic function\n  * Add Push Model Agent Mermaid FSM chart (#1095)\n  * Add state to avoid exiting on wrong attestation (#1093)\n  * Add 6 alphanumeric lowercase X-Request-ID header\n  * Enhance Evidence Handling response parsing\n  * build(deps): bump quote from 1.0.35 to 1.0.40\n  * build(deps): bump libc from 0.2.172 to 0.2.175\n  * build(deps): bump glob from 0.3.2 to 0.3.3\n  * build(deps): bump actix-web from 4.10.2 to 4.11.0\n","status":"published","published":"2026-02-11T16:17:16Z","modified":"2026-02-12T15:00:25.451695Z","updated_at":"2026-11-02T15:54:00.846737Z"},{"id":"SUSE-SU-2026:0453-1","title":"Security update for rust-keylime","description":"This update for rust-keylime fixes the following issues:\n\nUpdate to version 0.2.8+116.\n\nSecurity issues fixed:\n\n- CVE-2026-25727: time: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion\n  (bsc#1257908).\n\nOther updates and bugfixes:\n\n- Update vendored crates `time` to version 0.3.47.\n\n- Update to version 0.2.8+116:\n  \n  * build(deps): bump bytes from 1.7.2 to 1.11.1\n  * api: Modify /version endpoint output in version 2.5\n  * Add API v2.5 with backward-compatible /v2.5/quotes/integrity\n  * tests: add unit test for resolve_agent_id (#1182)\n  * (pull-model): enable retry logic for registration\n  * rpm: Update specfiles to apply on master\n  * workflows: Add test to detect unused crates\n  * lib: Drop unused crates\n  * push-model: Drop unused crates\n  * keylime-agent: Drop unused crates\n  * build(deps): bump uuid from 1.18.1 to 1.19.0\n  * Update reqwest-retry to 0.8, retry-policies to 0.5\n  * rpm: Fix cargo_build macro usage on CentOS Stream\n  * fix(push-model): resolve hash_ek uuid to actual EK hash\n  * build(deps): bump thiserror from 2.0.16 to 2.0.17\n  * workflows: Separate upstream test suite from e2e coverage\n  * Send UEFI measured boot logs as raw bytes (#1173)\n  * auth: Add unit tests for SecretToken implementation\n  * packit: Enable push-attestation tests\n  * resilient_client: Prevent authentication token leakage in logs\n\n- Use tmpfiles.d for /var directories (PED-14736)\n  \n- Update to version 0.2.8+96:\n  \n  * build(deps): bump wiremock from 0.6.4 to 0.6.5\n  * build(deps): bump actions/checkout from 5 to 6\n  * build(deps): bump chrono from 0.4.41 to 0.4.42\n  * packit: Get coverage from Fedora 43 runs\n  * Fix issues pointed out by clippy\n  * Replace mutex unwraps with proper error handling in TPM library\n  * Remove unused session request methods from StructureFiller\n  * Fix config panic on missing ek_handle in push model agent\n  * build(deps): bump tempfile from 3.21.0 to 3.23.0\n  * build(deps): bump actions/upload-artifact from 4 to 6 (#1163)\n  * Fix clippy warnings project-wide\n  * Add KEYLIME_DIR support for verifier TLS certificates in push model agent\n  * Thread privileged resources and use MeasurementList for IMA reading\n  * Add privileged resource initialization and privilege dropping to push model agent\n  * Fix privilege dropping order in run_as()\n  * add documentation on FQDN hostnames\n  * Remove confusing logs for push mode agent\n  * Set correct default Verifier port (8891-\u003e8881) (#1159)\n  * Add verifier_url to reference configuration file (#1158)\n  * Add TLS support for Registrar communication (#1139)\n  * Fix agent handling of 403 registration responses (#1154)\n  * Add minor README.md rephrasing (#1151)\n  * build(deps): bump actions/checkout from 5 to 6 (#1153)\n  * ci: update spec files for packit COPR build\n  * docs: improve challenge encoding and async TPM documentation\n  * refactor: improve middleware and error handling\n  * feat: add authentication client with middleware integration\n  * docker: Include keylime_push_model_agent binary\n  * Include attestation_interval configuration (#1146)\n  * Persist payload keys to avoid attestation failure on restart\n  * crypto: Implement the load or generate pattern for keys\n  * Use simple algorithm specifiers in certification_keys object (#1140)\n  * tests: Enable more tests in CI\n  * Fix RSA2048 algorithm reporting in keylime agent\n  * Remove disabled_signing_algorithms configuration\n  * rpm: Fix metadata patches to apply to current code\n  * workflows/rpm.yml: Use more strict patching\n  * build(deps): bump uuid from 1.17.0 to 1.18.1\n  * Fix ECC algorithm selection and reporting for keylime agent\n  * Improve logging consistency and coherency\n  * Implement minimal RFC compliance for Location header and URI parsing (#1125)\n  * Use separate keys for payload mechanism and mTLS\n  * docker: update rust to 1.81 for distroless Dockerfile\n  * Ensure UEFI log capabilities are set to false\n  * build(deps): bump http from 1.1.0 to 1.3.1\n  * build(deps): bump log from 0.4.27 to 0.4.28\n  * build(deps): bump cfg-if from 1.0.1 to 1.0.3\n  * build(deps): bump actix-rt from 2.10.0 to 2.11.0\n  * build(deps): bump async-trait from 0.1.88 to 0.1.89\n  * build(deps): bump trybuild from 1.0.105 to 1.0.110\n  * Accept evidence handling structures null entries\n  * workflows: Add test to check if RPM patches still apply\n  * CI: Enable test add-agent-with-malformed-ek-cert\n  * config: Fix singleton tests\n  * FSM: Remove needless lifetime annotations (#1105)\n  * rpm: Do not remove wiremock which is now available in Fedora\n  * Use latest Fedora httpdate version (1.0.3)\n  * Enhance coverage with parse_retry_after test\n  * Fix issues reported by CI regarding unwrap() calls\n  * Reuse max retries indicated to the ResilientClient\n  * Include limit of retries to 5 for Retry-After\n  * Add policy to handle Retry-After response headers\n  * build(deps): bump wiremock from 0.6.3 to 0.6.4\n  * build(deps): bump serde_json from 1.0.140 to 1.0.143\n  * build(deps): bump pest_derive from 2.8.0 to 2.8.1\n  * build(deps): bump syn from 2.0.90 to 2.0.106\n  * build(deps): bump tempfile from 3.20.0 to 3.21.0\n  * build(deps): bump thiserror from 2.0.12 to 2.0.16\n  * rpm: Fix patches to apply to current master code\n  * build(deps): bump anyhow from 1.0.98 to 1.0.99\n  * state_machine: Automatically clean config override during tests\n  * config: Implement singleton and factory pattern\n  * testing: Support overriding configuration during tests\n  * feat: implement standalone challenge-response authentication module\n  * structures: rename session structs for clarity and fix typos\n  * tpm: refactor certify_credential_with_iak() into a more generic function\n  * Add Push Model Agent Mermaid FSM chart (#1095)\n  * Add state to avoid exiting on wrong attestation (#1093)\n  * Add 6 alphanumeric lowercase X-Request-ID header\n  * Enhance Evidence Handling response parsing\n  * build(deps): bump quote from 1.0.35 to 1.0.40\n  * build(deps): bump libc from 0.2.172 to 0.2.175\n  * build(deps): bump glob from 0.3.2 to 0.3.3\n  * build(deps): bump actix-web from 4.10.2 to 4.11.0\n","status":"published","published":"2026-02-11T16:17:25Z","modified":"2026-02-12T15:00:25.589453Z","updated_at":"2026-11-02T15:54:00.846737Z"},{"id":"SUSE-SU-2026:0470-1","title":"Security update for rust-keylime","description":"This update for rust-keylime fixes the following issues:\n\nUpdate to version 0.2.8+116.\n\nSecurity issues fixed:\n\n- CVE-2026-25727: time: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion\n  (bsc#1257908).\n\nOther updates and bugfixes:\n\n- Update vendored crates `time` to version 0.3.47.\n\n- Update to version 0.2.8+116:\n\n  * build(deps): bump bytes from 1.7.2 to 1.11.1\n  * api: Modify /version endpoint output in version 2.5\n  * Add API v2.5 with backward-compatible /v2.5/quotes/integrity\n  * tests: add unit test for resolve_agent_id (#1182)\n  * (pull-model): enable retry logic for registration\n  * rpm: Update specfiles to apply on master\n  * workflows: Add test to detect unused crates\n  * lib: Drop unused crates\n  * push-model: Drop unused crates\n  * keylime-agent: Drop unused crates\n  * build(deps): bump uuid from 1.18.1 to 1.19.0\n  * Update reqwest-retry to 0.8, retry-policies to 0.5\n  * rpm: Fix cargo_build macro usage on CentOS Stream\n  * fix(push-model): resolve hash_ek uuid to actual EK hash\n  * build(deps): bump thiserror from 2.0.16 to 2.0.17\n  * workflows: Separate upstream test suite from e2e coverage\n  * Send UEFI measured boot logs as raw bytes (#1173)\n  * auth: Add unit tests for SecretToken implementation\n  * packit: Enable push-attestation tests\n  * resilient_client: Prevent authentication token leakage in logs\n\n- Use tmpfiles.d for /var directories (PED-14736)\n  \n- Update to version 0.2.8+96:\n  \n  * build(deps): bump wiremock from 0.6.4 to 0.6.5\n  * build(deps): bump actions/checkout from 5 to 6\n  * build(deps): bump chrono from 0.4.41 to 0.4.42\n  * packit: Get coverage from Fedora 43 runs\n  * Fix issues pointed out by clippy\n  * Replace mutex unwraps with proper error handling in TPM library\n  * Remove unused session request methods from StructureFiller\n  * Fix config panic on missing ek_handle in push model agent\n  * build(deps): bump tempfile from 3.21.0 to 3.23.0\n  * build(deps): bump actions/upload-artifact from 4 to 6 (#1163)\n  * Fix clippy warnings project-wide\n  * Add KEYLIME_DIR support for verifier TLS certificates in push model agent\n  * Thread privileged resources and use MeasurementList for IMA reading\n  * Add privileged resource initialization and privilege dropping to push model agent\n  * Fix privilege dropping order in run_as()\n  * add documentation on FQDN hostnames\n  * Remove confusing logs for push mode agent\n  * Set correct default Verifier port (8891-\u003e8881) (#1159)\n  * Add verifier_url to reference configuration file (#1158)\n  * Add TLS support for Registrar communication (#1139)\n  * Fix agent handling of 403 registration responses (#1154)\n  * Add minor README.md rephrasing (#1151)\n  * build(deps): bump actions/checkout from 5 to 6 (#1153)\n  * ci: update spec files for packit COPR build\n  * docs: improve challenge encoding and async TPM documentation\n  * refactor: improve middleware and error handling\n  * feat: add authentication client with middleware integration\n  * docker: Include keylime_push_model_agent binary\n  * Include attestation_interval configuration (#1146)\n  * Persist payload keys to avoid attestation failure on restart\n  * crypto: Implement the load or generate pattern for keys\n  * Use simple algorithm specifiers in certification_keys object (#1140)\n  * tests: Enable more tests in CI\n  * Fix RSA2048 algorithm reporting in keylime agent\n  * Remove disabled_signing_algorithms configuration\n  * rpm: Fix metadata patches to apply to current code\n  * workflows/rpm.yml: Use more strict patching\n  * build(deps): bump uuid from 1.17.0 to 1.18.1\n  * Fix ECC algorithm selection and reporting for keylime agent\n  * Improve logging consistency and coherency\n  * Implement minimal RFC compliance for Location header and URI parsing (#1125)\n  * Use separate keys for payload mechanism and mTLS\n  * docker: update rust to 1.81 for distroless Dockerfile\n  * Ensure UEFI log capabilities are set to false\n  * build(deps): bump http from 1.1.0 to 1.3.1\n  * build(deps): bump log from 0.4.27 to 0.4.28\n  * build(deps): bump cfg-if from 1.0.1 to 1.0.3\n  * build(deps): bump actix-rt from 2.10.0 to 2.11.0\n  * build(deps): bump async-trait from 0.1.88 to 0.1.89\n  * build(deps): bump trybuild from 1.0.105 to 1.0.110\n  * Accept evidence handling structures null entries\n  * workflows: Add test to check if RPM patches still apply\n  * CI: Enable test add-agent-with-malformed-ek-cert\n  * config: Fix singleton tests\n  * FSM: Remove needless lifetime annotations (#1105)\n  * rpm: Do not remove wiremock which is now available in Fedora\n  * Use latest Fedora httpdate version (1.0.3)\n  * Enhance coverage with parse_retry_after test\n  * Fix issues reported by CI regarding unwrap() calls\n  * Reuse max retries indicated to the ResilientClient\n  * Include limit of retries to 5 for Retry-After\n  * Add policy to handle Retry-After response headers\n  * build(deps): bump wiremock from 0.6.3 to 0.6.4\n  * build(deps): bump serde_json from 1.0.140 to 1.0.143\n  * build(deps): bump pest_derive from 2.8.0 to 2.8.1\n  * build(deps): bump syn from 2.0.90 to 2.0.106\n  * build(deps): bump tempfile from 3.20.0 to 3.21.0\n  * build(deps): bump thiserror from 2.0.12 to 2.0.16\n  * rpm: Fix patches to apply to current master code\n  * build(deps): bump anyhow from 1.0.98 to 1.0.99\n  * state_machine: Automatically clean config override during tests\n  * config: Implement singleton and factory pattern\n  * testing: Support overriding configuration during tests\n  * feat: implement standalone challenge-response authentication module\n  * structures: rename session structs for clarity and fix typos\n  * tpm: refactor certify_credential_with_iak() into a more generic function\n  * Add Push Model Agent Mermaid FSM chart (#1095)\n  * Add state to avoid exiting on wrong attestation (#1093)\n  * Add 6 alphanumeric lowercase X-Request-ID header\n  * Enhance Evidence Handling response parsing\n  * build(deps): bump quote from 1.0.35 to 1.0.40\n  * build(deps): bump libc from 0.2.172 to 0.2.175\n  * build(deps): bump glob from 0.3.2 to 0.3.3\n  * build(deps): bump actix-web from 4.10.2 to 4.11.0\n","status":"published","published":"2026-02-12T11:22:07Z","modified":"2026-03-23T04:52:16.167102Z","updated_at":"2026-11-02T15:54:00.846737Z"},{"id":"SUSE-SU-2026:0505-1","title":"Security update for cargo-auditable","description":"This update for cargo-auditable fixes the following issues:\n\nUpdate to version 0.7.2~0.\n\nSecurity issues fixed:\n\n- CVE-2026-25727: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion\n  (bsc#1257906).\n\nOther updates and bugfixes:\n\n- Update to version 0.7.2~0:\n\n  * mention cargo-dist in README\n  * commit Cargo.lock\n  * bump which dev-dependency to 8.0.0\n  * bump object to 0.37\n  * Upgrade cargo_metadata to 0.23\n  * Expand the set of dist platforms in config\n\n- Update to version 0.7.1~0:\n\n  * Out out of unhelpful clippy lint\n  * Satisfy clippy\n  * Do not assume --crate-name and --out-dir are present in the rustc command, but show warnings if they aren't\n  * Run apt-get update before trying to install packages\n  * run `cargo dist init` on dist 0.30\n  * Drop allow-dirty from dist config, should no longer be needed\n  * Reorder paragraphs in README\n  * Note the maintenance transition for the go extraction library\n  * Editing pass on the adopters: scanners\n  * clarify Docker support\n  * Cargo clippy fix\n  * Add Wolfi OS and Chainguard to adopters\n  * Update mentions around Anchore tooling\n  * README and documentation updates for nightly\n  * Bump dependency version in rust-audit-info\n  * More work on docs\n  * Nicer formatting on format revision documentation\n  * Bump versions\n  * regenerate JSON schema\n  * cargo fmt\n  * Document format field\n  * Make it more clear that RawVersionInfo is private\n  * Add format field to the serialized data\n  * cargo clippy fix\n  * Add special handling for proc macros to treat them as the build dependencies they are\n  * Add a test to ensure proc macros are reported as build dependencies\n  * Add a test fixture for a crate with a proc macro dependency\n  * parse fully qualified package ID specs from SBOMs\n  * select first discovered SBOM file\n  * cargo sbom integration\n  * Get rid of unmaintained wee_alloc in test code to make people's scanners misled by GHSA chill out\n  * Don't fail plan workflow due to manually changed release.yml\n  * Bump Ubuntu version to hopefully fix release.yml workflow\n  * Add test for stripped binary\n  * Bump version to 0.6.7\n  * Populate changelog\n  * README.md: add auditable2cdx, more consistency in text\n  * Placate clippy\n  * Do not emit -Wl if a bare linker is in use\n  * Get rid of a compiler warning\n  * Add bare linker detection function\n  * drop boilerplate from test that's no longer relevant\n  * Add support for recovering rustc codegen options\n  * More lenient parsing of rustc arguments\n  * More descriptive error message in case rustc is killed abruptly\n  * change formatting to fit rustfmt\n  * More descriptive error message in case cargo is killed\n  * Update REPLACING_CARGO.md to fix #195\n  * Clarify osv-scanner support in README\n  * Include the command required to view metadata\n  * Mention wasm-tools support\n  * Switch from broken generic cache action to a Rust-specific one\n  * Fill in various fields in auditable2cdx Cargo.toml\n  * Include osv-scanner in the list, with a caveat\n  * Add link to blint repo to README\n  * Mention that blint supports our data\n  * Consolidate target definitions\n  * Account for WASM test dependencies changing, commit the Cargo.lock so they would stop doing that\n  * Migrate to a maintained toolchain action\n  * Fix author specification\n  * Add link to repository to resolverver Cargo.toml\n  * Bump resolverver to 0.1.0\n  * Add resolverver crate to the tree\n\n- Update to version 0.6.6~0:\n\n  * Note the `object` upgrade in the changelog\n  * Upgrade cyclonedx-bom from 0.5 to 0.8 in auditable-cyclonedx\n  * Upgrade object crate from 0.30 to 0.36 to reduce dependency footprint\n  * Update dependencies in the lock file\n  * Populate changelog\n  * apply clippy lint\n  * add another --emit parsing test\n  * shorter code with cargo fmt\n  * Actually fix cargo-c compatibility\n  * Attempt to fix cargo-capi incompatibility\n  * Refactoring in preparation for fixes\n  * Also read the --emit flag to rustc\n  * Fill in changelogs\n  * Bump versions\n  * Drop cfg'd out tests\n  * Drop obsolete doc line\n  * Move dependency cycle tests from auditable-serde to cargo-auditable crate\n  * Remove cargo_metadata from auditable-serde API surface.\n  * Apply clippy lint\n  * Upgrade miniz_oxide to 0.8.0\n  * Insulate our semver from miniz_oxide semver\n  * Add support for Rust 2024 edition\n  * Update tests\n  * More robust OS detection for riscv feature detection\n  * bump version\n  * update changelog for auditable-extract 0.3.5\n  * Fix wasm component auditable data extraction\n  * Update blocker description in README.md\n  * Add openSUSE to adopters\n  * Update list of know adopters\n  * Fix detection of `riscv64-linux-android` target features\n  * Silence noisy lint\n  * Bump version requirement in rust-audit-info\n  * Fill in changelogs\n  * Bump semver of auditable-info\n  * Drop obsolete comment now that wasm is enabled by default\n  * Remove dependency on cargo-lock\n  * Brag about adoption in the README\n  * Don't use LTO for cargo-dist builds to make them consistent with `cargo install` etc\n  * Also build musl binaries\n  * dist: update dist config for future releases\n  * dist(cargo-auditable): ignore auditable2cdx for now\n  * chore: add cargo-dist\n","status":"published","published":"2026-02-13T14:31:50Z","modified":"2026-03-23T04:52:18.173626Z","updated_at":"2026-11-02T15:54:00.846737Z"},{"id":"SUSE-SU-2026:0506-1","title":"Security update for cargo-auditable","description":"This update for cargo-auditable fixes the following issues:\n\nUpdate to version 0.7.2~0.\n\nSecurity issues fixed:\n\n- CVE-2026-25727: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion\n  (bsc#1257906).\n\nOther updates and bugfixes:\n\n- Update to version 0.7.2~0:\n\n  * mention cargo-dist in README\n  * commit Cargo.lock\n  * bump which dev-dependency to 8.0.0\n  * bump object to 0.37\n  * Upgrade cargo_metadata to 0.23\n  * Expand the set of dist platforms in config\n\n- Update to version 0.7.1~0:\n\n  * Out out of unhelpful clippy lint\n  * Satisfy clippy\n  * Do not assume --crate-name and --out-dir are present in the rustc command, but show warnings if they aren't\n  * Run apt-get update before trying to install packages\n  * run `cargo dist init` on dist 0.30\n  * Drop allow-dirty from dist config, should no longer be needed\n  * Reorder paragraphs in README\n  * Note the maintenance transition for the go extraction library\n  * Editing pass on the adopters: scanners\n  * clarify Docker support\n  * Cargo clippy fix\n  * Add Wolfi OS and Chainguard to adopters\n  * Update mentions around Anchore tooling\n  * README and documentation updates for nightly\n  * Bump dependency version in rust-audit-info\n  * More work on docs\n  * Nicer formatting on format revision documentation\n  * Bump versions\n  * regenerate JSON schema\n  * cargo fmt\n  * Document format field\n  * Make it more clear that RawVersionInfo is private\n  * Add format field to the serialized data\n  * cargo clippy fix\n  * Add special handling for proc macros to treat them as the build dependencies they are\n  * Add a test to ensure proc macros are reported as build dependencies\n  * Add a test fixture for a crate with a proc macro dependency\n  * parse fully qualified package ID specs from SBOMs\n  * select first discovered SBOM file\n  * cargo sbom integration\n  * Get rid of unmaintained wee_alloc in test code to make people's scanners misled by GHSA chill out\n  * Don't fail plan workflow due to manually changed release.yml\n  * Bump Ubuntu version to hopefully fix release.yml workflow\n  * Add test for stripped binary\n  * Bump version to 0.6.7\n  * Populate changelog\n  * README.md: add auditable2cdx, more consistency in text\n  * Placate clippy\n  * Do not emit -Wl if a bare linker is in use\n  * Get rid of a compiler warning\n  * Add bare linker detection function\n  * drop boilerplate from test that's no longer relevant\n  * Add support for recovering rustc codegen options\n  * More lenient parsing of rustc arguments\n  * More descriptive error message in case rustc is killed abruptly\n  * change formatting to fit rustfmt\n  * More descriptive error message in case cargo is killed\n  * Update REPLACING_CARGO.md to fix #195\n  * Clarify osv-scanner support in README\n  * Include the command required to view metadata\n  * Mention wasm-tools support\n  * Switch from broken generic cache action to a Rust-specific one\n  * Fill in various fields in auditable2cdx Cargo.toml\n  * Include osv-scanner in the list, with a caveat\n  * Add link to blint repo to README\n  * Mention that blint supports our data\n  * Consolidate target definitions\n  * Account for WASM test dependencies changing, commit the Cargo.lock so they would stop doing that\n  * Migrate to a maintained toolchain action\n  * Fix author specification\n  * Add link to repository to resolverver Cargo.toml\n  * Bump resolverver to 0.1.0\n  * Add resolverver crate to the tree\n\n- Update to version 0.6.6~0:\n\n  * Note the `object` upgrade in the changelog\n  * Upgrade cyclonedx-bom from 0.5 to 0.8 in auditable-cyclonedx\n  * Upgrade object crate from 0.30 to 0.36 to reduce dependency footprint\n  * Update dependencies in the lock file\n  * Populate changelog\n  * apply clippy lint\n  * add another --emit parsing test\n  * shorter code with cargo fmt\n  * Actually fix cargo-c compatibility\n  * Attempt to fix cargo-capi incompatibility\n  * Refactoring in preparation for fixes\n  * Also read the --emit flag to rustc\n  * Fill in changelogs\n  * Bump versions\n  * Drop cfg'd out tests\n  * Drop obsolete doc line\n  * Move dependency cycle tests from auditable-serde to cargo-auditable crate\n  * Remove cargo_metadata from auditable-serde API surface.\n  * Apply clippy lint\n  * Upgrade miniz_oxide to 0.8.0\n  * Insulate our semver from miniz_oxide semver\n  * Add support for Rust 2024 edition\n  * Update tests\n  * More robust OS detection for riscv feature detection\n  * bump version\n  * update changelog for auditable-extract 0.3.5\n  * Fix wasm component auditable data extraction\n  * Update blocker description in README.md\n  * Add openSUSE to adopters\n  * Update list of know adopters\n  * Fix detection of `riscv64-linux-android` target features\n  * Silence noisy lint\n  * Bump version requirement in rust-audit-info\n  * Fill in changelogs\n  * Bump semver of auditable-info\n  * Drop obsolete comment now that wasm is enabled by default\n  * Remove dependency on cargo-lock\n  * Brag about adoption in the README\n  * Don't use LTO for cargo-dist builds to make them consistent with `cargo install` etc\n  * Also build musl binaries\n  * dist: update dist config for future releases\n  * dist(cargo-auditable): ignore auditable2cdx for now\n  * chore: add cargo-dist\n","status":"published","published":"2026-02-13T14:32:17Z","modified":"2026-03-23T04:52:18.136757Z","updated_at":"2026-11-02T15:54:00.846737Z"},{"id":"SUSE-SU-2026:0514-1","title":"Security update for cargo-auditable","description":"This update for cargo-auditable fixes the following issues:\n\nUpdate to version 0.7.2~0.\n\nSecurity issues fixed:\n\n- CVE-2026-25727: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion\n  (bsc#1257906).\n\nOther updates and bugfixes:\n\n- Update to version 0.7.2~0:\n\n  * mention cargo-dist in README\n  * commit Cargo.lock\n  * bump which dev-dependency to 8.0.0\n  * bump object to 0.37\n  * Upgrade cargo_metadata to 0.23\n  * Expand the set of dist platforms in config\n\n- Update to version 0.7.1~0:\n\n  * Out out of unhelpful clippy lint\n  * Satisfy clippy\n  * Do not assume --crate-name and --out-dir are present in the rustc command, but show warnings if they aren't\n  * Run apt-get update before trying to install packages\n  * run `cargo dist init` on dist 0.30\n  * Drop allow-dirty from dist config, should no longer be needed\n  * Reorder paragraphs in README\n  * Note the maintenance transition for the go extraction library\n  * Editing pass on the adopters: scanners\n  * clarify Docker support\n  * Cargo clippy fix\n  * Add Wolfi OS and Chainguard to adopters\n  * Update mentions around Anchore tooling\n  * README and documentation updates for nightly\n  * Bump dependency version in rust-audit-info\n  * More work on docs\n  * Nicer formatting on format revision documentation\n  * Bump versions\n  * regenerate JSON schema\n  * cargo fmt\n  * Document format field\n  * Make it more clear that RawVersionInfo is private\n  * Add format field to the serialized data\n  * cargo clippy fix\n  * Add special handling for proc macros to treat them as the build dependencies they are\n  * Add a test to ensure proc macros are reported as build dependencies\n  * Add a test fixture for a crate with a proc macro dependency\n  * parse fully qualified package ID specs from SBOMs\n  * select first discovered SBOM file\n  * cargo sbom integration\n  * Get rid of unmaintained wee_alloc in test code to make people's scanners misled by GHSA chill out\n  * Don't fail plan workflow due to manually changed release.yml\n  * Bump Ubuntu version to hopefully fix release.yml workflow\n  * Add test for stripped binary\n  * Bump version to 0.6.7\n  * Populate changelog\n  * README.md: add auditable2cdx, more consistency in text\n  * Placate clippy\n  * Do not emit -Wl if a bare linker is in use\n  * Get rid of a compiler warning\n  * Add bare linker detection function\n  * drop boilerplate from test that's no longer relevant\n  * Add support for recovering rustc codegen options\n  * More lenient parsing of rustc arguments\n  * More descriptive error message in case rustc is killed abruptly\n  * change formatting to fit rustfmt\n  * More descriptive error message in case cargo is killed\n  * Update REPLACING_CARGO.md to fix #195\n  * Clarify osv-scanner support in README\n  * Include the command required to view metadata\n  * Mention wasm-tools support\n  * Switch from broken generic cache action to a Rust-specific one\n  * Fill in various fields in auditable2cdx Cargo.toml\n  * Include osv-scanner in the list, with a caveat\n  * Add link to blint repo to README\n  * Mention that blint supports our data\n  * Consolidate target definitions\n  * Account for WASM test dependencies changing, commit the Cargo.lock so they would stop doing that\n  * Migrate to a maintained toolchain action\n  * Fix author specification\n  * Add link to repository to resolverver Cargo.toml\n  * Bump resolverver to 0.1.0\n  * Add resolverver crate to the tree\n\n- Update to version 0.6.6~0:\n\n  * Note the `object` upgrade in the changelog\n  * Upgrade cyclonedx-bom from 0.5 to 0.8 in auditable-cyclonedx\n  * Upgrade object crate from 0.30 to 0.36 to reduce dependency footprint\n  * Update dependencies in the lock file\n  * Populate changelog\n  * apply clippy lint\n  * add another --emit parsing test\n  * shorter code with cargo fmt\n  * Actually fix cargo-c compatibility\n  * Attempt to fix cargo-capi incompatibility\n  * Refactoring in preparation for fixes\n  * Also read the --emit flag to rustc\n  * Fill in changelogs\n  * Bump versions\n  * Drop cfg'd out tests\n  * Drop obsolete doc line\n  * Move dependency cycle tests from auditable-serde to cargo-auditable crate\n  * Remove cargo_metadata from auditable-serde API surface.\n  * Apply clippy lint\n  * Upgrade miniz_oxide to 0.8.0\n  * Insulate our semver from miniz_oxide semver\n  * Add support for Rust 2024 edition\n  * Update tests\n  * More robust OS detection for riscv feature detection\n  * bump version\n  * update changelog for auditable-extract 0.3.5\n  * Fix wasm component auditable data extraction\n  * Update blocker description in README.md\n  * Add openSUSE to adopters\n  * Update list of know adopters\n  * Fix detection of `riscv64-linux-android` target features\n  * Silence noisy lint\n  * Bump version requirement in rust-audit-info\n  * Fill in changelogs\n  * Bump semver of auditable-info\n  * Drop obsolete comment now that wasm is enabled by default\n  * Remove dependency on cargo-lock\n  * Brag about adoption in the README\n  * Don't use LTO for cargo-dist builds to make them consistent with `cargo install` etc\n  * Also build musl binaries\n  * dist: update dist config for future releases\n  * dist(cargo-auditable): ignore auditable2cdx for now\n  * chore: add cargo-dist\n\n- Update to version 0.6.4~0:\n\n  * Release cargo-auditable v0.6.4\n  * Correctly attribute changelog file addition in changelog\n  * Add changelog for auditable-extract\n  * Verify various feature combinations in CI\n  * Upgrade wasmparser to remove dependencies with `unsafe`\n  * Add LoongArch support\n  * cargo fmt\n  * Move doc headers to README.md and point rustdoc to them, so that we have nice crates.io pages\n  * Expand on the note about WebAssembly parsing\n  * Populate changelogs\n  * Resume bragging about all dependencies being safe, now that there is a caveat below\n  * drop fuzz Cargo.lock to always fuzz against latest versions\n  * Bump `cargo auditable` version\n  * Mention WASM support in README\n  * Revert 'Be super duper extra sure both MinGW and MSVC are tested on CI'\n  * Be super duper extra sure both MinGW and MSVC are tested on CI\n  * Add wasm32 targets to CI for more platforms\n  * Don't pass --target twice in tests\n  * Install WASM toolchain in CI\n  * cargo fmt\n  * Add WASM end-to-end test\n  * cargo fmt\n  * Update documentation to mention the WASM feature\n  * cargo fmt\n  * Plumb WASM parsing feature through the whole stack\n  * Make WASM parsing an optional, non-default feature\n  * Add a fuzzing harness for WASM parsing\n  * Rewritten WASM parsing to avoid heap allocations\n  * Initial WASM extraction support\n  * Nicer assertion\n  * Drop obsolete comment\n  * Clarify that embedding the compiler version has shipped.\n  * Fixed section name for WASM\n  * Unified and more robust platform detection. Fixed wasm build process\n  * Initial WASM support\n  * More robust platform detection for picking the binary format\n  * Fix Windows CI to run both -msvc and -gnu\n  * Use the correct link.exe flag for preserving the specified symbol even if it is unused\n  * Fix Windows\n  * Fix tests on Rust 1.77\n  * Placate clippy\n  * Oopps, I meant components field\n  * Also remove the dependencies field if empty\n  * Use serde_json with order preservation feature to get a more compressible JSON after workarounds\n  * Work around cyclonedx-bom limitations to produce minified JSON\n  * Also record the dependency kind\n  * cyclonedx-bom: also record PURL\n  * Also write the dependency tree\n  * Clear the serial number in the minimal CycloneDX variant\n  * Prototype impl of auditable2cdx\n  * Fill in auditable2cdx dependencies\n  * Initial auditable2cdx boilerplace\n  * add #![forbid(unsafe_code)]\n  * Initial implementation of auditable-to-cyclonedx conversion\n  * Add the necessary dependencies to auditable-cyclonedx\n  * Initial dummy package for auditable-cyclonedx\n\n- Update to version 0.6.2~0:\n\n  * Update the lockfile\n  * New releases of cargo-auditable and auditable-serde\n  * Use a separate project for the custom rustc path tests. Fixes intermittent test failures due to race conditions\n  * Revert 'add commit hashes to git sources'\n  * Fix cyclic dependency graph being encoded\n  * Revert 'An unsuccessful attempt to fix cycles caused by dev-dependencies'\n  * An unsuccessful attempt to fix cycles caused by dev-dependencies\n  * Fix typo\n  * Add comment\n  * Add a test for an issue with cyclic dependencies reported at https://github.com/rustsec/rustsec/issues/1043\n  * Fix auditable-serde example not building\n  * upgrade dependency miniz_oxide to 0.6.0\n  * fix formatting errors\n  * apply clippy lints for --all-features\n  * improve the internal docs and comments\n  * apply clippy lints\n  * add missing sources for one of test fixtures\n  * add commit hashes to git sources\n  * Run all tests on CI\n  * cargo fmt\n  * Run `cargo clean` in tests to get rid of stale binaries\n  * Fix date in changelog\n  * Populate changelog\n  * Bump auditable-info version in rust-audit-info\n  * Add auditable-info changelog\n  * Bump versions following cargo-lock bump\n  * auditable-serde: bump `cargo-lock` to v9\n  * switch to UNRELEASED\n  * Update CHANGELOG.md\n  * Print a better error if calling rustc fails\n  * Drop unused import\n  * placate Clippy\n  * Don't inject audit info if --print argument is passed to rustc\n  * Reflect the version change in Cargo.lock\n  * Remove space from keywords\n  * bump version to 0.6.1\n  * Fix date in changelog\n  * Update CHANGELOG.md\n  * Add publish=false\n  * Commit the generated manpage\n  * Add the code for generating a manpage; rather rudimentary so far, but it's a starting point\n  * Explain relation to supply chain attacks\n  * Add keywords to the Cargo manifest\n  * Revert 'generate a man page for cargo auditable'\n  * fix formatting\n  * fix review feedback, relocate file to under OUT_DIR, don't use anyhow and also commit the lock file\n  * generate a man page for cargo auditable\n  * Add Clippy suppression\n  * placate clippy\n  * commit Cargo.lock\n  * Sync to latest object file writing code from rustc\n  * Fix examples in docs\n  * Allow redundant field names\n  * Apply clippy suggestion: match -\u003e if let\n  * Check for clippy and format in CI\n  * Apply clippy suggestions\n  * Run CI with --locked\n\n- Update to version 0.6.0~0:\n\n  * README and documentation improvements \n  * Read the rustc path passed by Cargo; fixes #90\n  * Read location of Cargo from the environment variable Cargo sets for third-party subcommands\n  * Add a note on sccache version compatibility to CHANGELOG.md\n  * Panic on compilation commands where we fail to parse the arguments instead of silently ignoring the error\n  * Specifying the binary-scanning feature is no longer needed\n  * Pass options such as --offline to `cargo metadata`\n  * Pass on arguments from `cargo auditable` invocation to the rustc wrapper; prep work towards fixing #83\n  * Bump rust-audit-info to 0.5.2\n  * Bump auditable-serde version to 0.5.2\n  * Correctly fill in the source even in dependency entries when converting to cargo-lock data format\n  * Drop the roundtrip through str in semver::Version\n  * Release auditable-info 0.6.1\n  * Bump all the version requirements for things depending on auditable-info\n  * Fix audit_info_from_slice function signature\n","status":"published","published":"2026-02-13T14:57:18Z","modified":"2026-03-23T04:52:18.804843Z","updated_at":"2026-11-02T15:54:00.846737Z"},{"id":"SUSE-SU-2026:0582-1","title":"Security update for snpguest","description":"This update for snpguest fixes the following issues:\n\n- CVE-2026-25727: time: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion\n  (bsc#1257927).\n","status":"published","published":"2026-02-20T10:02:23Z","modified":"2026-03-23T04:52:22.132094Z","updated_at":"2026-11-02T15:54:00.846737Z"},{"id":"SUSE-SU-2026:0620-1","title":"Security update for snpguest","description":"This update for snpguest fixes the following issues:\n\nUpdate to version 0.10.0.\n\nSecurity issues fixed:  \n\n- CVE-2026-25727: time: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion (bsc#1257927).\n- CVE-2025-3416: openssl: Use-After-Free in Md::fetch and Cipher::fetch in rust-openssl crate (bsc#1242601).\n- CVE-2024-12224: idna: idna accepts Punycode labels that do not produce any non-ASCII when decoded (bcs#1243869).\n\nOther updates and bugfixes:\n\n- Update to version 0.10.0 \n\n  * fails to generate attestation reports on SEV-SNP guests with firmware API (bsc#1257877).\n  * chore: updating tool version to 0.10.0\n  * refactor(certs): remove redundant branch in file-write logic\n  * Docs: Adding verify measure, host-data, report-data to docs\n  * verify: verify measurent, host data, and report data attributes from the attestation report.\n  * library: Updating sev library to 7.1.0\n  * ci: replace deprecated gh actions\n  * feat: multi-format integer parsing for key subcommand arguments\n  * chore(main): remove unused import `clap::arg`\n  * feat(fetch): add fetch crl subcommand\n  * .github/lint: Bump toolchain version to 1.86\n  * Bump rust version to 1.86\n  * feat: bumping tool to version 0.9.2\n  * fix(verify): silence mismatched_lifetime_syntaxes in SnpOid::oid\n  * feat: support SEV-SNP ABI Spec 1.58 (bump sev to v6.3.0)\n  * docs: restore and clarify Global Options section\n  * doc: fix CL argument orders + address recent changes\n  * fix(hyperv): downgrade VMPL check from error to warning\n  * fix(report.rs): remove conflict check between --random flag and Hyper-V\n  * fix(report.rs): Decouple runtime behavior from hyperv build feature\n  * refactor: clarify --platform error message\n  * docs: add Azure/Hyper-V build note for --platform\n  * report: Writing Req Data as Binary (#101)\n  * deps: bump virtee/sev to 6.2.1 (fix TCB-serialization bug) (#99)\n  * Updating SEV library to 6.1.0 and updating version to 0.9.1\n  * Update version (0.9.0)\n  * HyperV: Fixing report command failure on Azure confidential VM\n  * Removing intird and append requirement for kernel measurements (#93)\n  * Updating to version 6 of library and fixing attestation (#89)\n  * CI: Fixing create_release workflow (#91)\n  * Minor update (0.8.3)\n  * Adding build script\n  * Update preattestation.rs\n  * Fix certificate fetch bug for Turin\n  * Minor update\n  * Update bitfield to 0.15.0\n  * Update to 0.8.1\n  * Update asn1-rs and x509-parser\n  * Update to 0.8.0\n  * key: Fix guest_field_select typo\n  * Adding Turin support and updating ASK cn\n","status":"published","published":"2026-02-24T16:36:35Z","modified":"2026-02-26T16:16:54.797628Z","updated_at":"2026-11-02T15:54:00.846737Z"},{"id":"SUSE-SU-2026:0806-1","title":"Security update for wicked2nm,suse-migration-services,suse-migration-sle16-activation,SLES16-Migration,SLES16-SAP_Migration","description":"This update for wicked2nm,suse-migration-services,suse-migration-sle16-activation,SLES16-Migration,SLES16-SAP_Migration fixes the following issues:\n\nChanges for SLES16-SAP_Migration:\n    \n- Bump version: 2.1.30    \n    \nChanges for SLES16-Migration:    \n\n- Bump version: 2.1.30    \n    \nChanges for suse-migration-sle16-activation:\n    \n- Move script package to the main migration provider\n- Create lib file for common network-prereq tasks\n- Refactor mount_system service\n        \nChanges for suse-migration-services:\n\n- Bump  to version: 2.1.30:\n    * Update docinfo\n    * Update doc/adoc/user_guide.adoc\n    * Update documentation for 12-to-15 in pubclouds\n      Fix information about default service pack target.\n    * Apply make black\n    * Added black for code formatting\n    * refactor: add `Zypper.install` wrapper\n      Add `Zypper.install` wrapper method for package installation\n    * Fixed get_migration_target return behavior\n    * fix: ensure NetworkManager is installed on the target system\n\nChanges for wicked2nm:     \n    \n- Update to version v1.4.1.\n\nSecurity issues fixed:\n- CVE-2026-25727: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion (bsc#1257911).\n\nOther updates and bugfixes:\n- update bytes from 1.10.1 to 1.11.1\n- update time to 0.3.47 \n","status":"published","published":"2026-03-04T15:46:27Z","modified":"2026-03-05T21:15:07.433929Z","updated_at":"2026-11-02T15:54:01.262144Z"},{"id":"SUSE-SU-2026:0816-1","title":"Security update for virtiofsd","description":"This update for virtiofsd fixes the following issue:\n\n- CVE-2026-25727: time: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion\n  (bsc#1257912).\n","status":"published","published":"2026-03-05T09:50:59Z","modified":"2026-03-05T21:15:07.304663Z","updated_at":"2026-11-02T15:54:01.262144Z"},{"id":"SUSE-SU-2026:0819-1","title":"Security update for virtiofsd","description":"This update for virtiofsd fixes the following issue:\n\n- CVE-2026-25727: time: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion\n  (bsc#1257912).\n","status":"published","published":"2026-03-05T10:49:51Z","modified":"2026-03-05T21:15:07.560238Z","updated_at":"2026-11-02T15:54:01.262144Z"},{"id":"SUSE-SU-2026:0860-1","title":"Security update for python-maturin","description":"This update for python-maturin fixes the following issue:\n\n- CVE-2026-25727: time: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion\n  (bsc#1257918).\n","status":"published","published":"2026-03-10T16:46:52Z","modified":"2026-03-13T19:47:39.727004Z","updated_at":"2026-11-02T15:54:01.262144Z"},{"id":"SUSE-SU-2026:1361-1","title":"Security update for himmelblau","description":"This update for himmelblau fixes the following issues:\n\nUpdate to version 2.3.9+git0.a9fd29b; (jsc#PED-14511):\n\n- CVE-2026-34397: Fix LPE due to name collision during NSS fake-primary group lookup (bsc#1261324).\n- CVE-2026-31979: Fix race condition when accessiung /tmp/krb5cc_uid (bsc#1259548).\n- CVE-2026-25727: deps(rust): Bump the `all-cargo-updates` group with 8 updates (bsc#1257904).\n- CVE-2025-58160: deps(rust): Bump `tracing-subscriber` in the cargo group (bsc#1249013).\n- CVE-2025-54882: Fix Kerberos credential cache permissions (bsc#1247735).\n- CVE-2025-53013: Fix permitted authentication with invalid Hello PIN (bsc#1245437).\n- CVE-2024-11738: Fix `rustls` network-reachable panic in `Acceptor::accept` (bsc#1233949).\n\nOther bug fixes:\n\n- Fix SELinux module packaging to use standard policy macros (bsc#1258236).\n","status":"published","published":"2026-04-15T14:14:00Z","modified":"2026-04-16T08:30:39.316405Z","updated_at":"2026-11-02T15:54:01.262144Z"}]},"sources_more":{"osv":24}}