{"id":"CVE-2026-41676","aliases":["AZL-83618","DEBIAN-CVE-2026-41676","EUVD-2026-25582","GHSA-pqf5-4pqq-29f5","RUSTSEC-2026-0473","SUSE-SU-2026:22554-1","SUSE-SU-2026:22574-1","SUSE-SU-2026:22583-1","SUSE-SU-2026:22589-1","SUSE-SU-2026:22593-1","SUSE-SU-2026:22615-1","SUSE-SU-2026:22624-1","SUSE-SU-2026:22737-1","SUSE-SU-2026:22787-1","SUSE-SU-2026:22801-1","SUSE-SU-2026:22827-1","SUSE-SU-2026:22895-1","SUSE-SU-2026:22898-1","SUSE-SU-2026:22910-1","SUSE-SU-2026:22917-1","SUSE-SU-2026:22921-1","SUSE-SU-2026:23036-1","SUSE-SU-2026:23070-1","SUSE-SU-2026:23071-1","SUSE-SU-2026:23643-1","SUSE-SU-2026:23659-1","SUSE-SU-2026:23983-1","SUSE-SU-2026:24014-1","SUSE-SU-2026:2777-1","SUSE-SU-2026:2807-1","SUSE-SU-2026:2825-1","SUSE-SU-2026:2826-1","SUSE-SU-2026:2831-1","SUSE-SU-2026:2832-1","SUSE-SU-2026:2833-1","SUSE-SU-2026:2834-1","SUSE-SU-2026:2834-2","SUSE-SU-2026:2835-1","SUSE-SU-2026:2975-1","SUSE-SU-2026:2976-1","SUSE-SU-2026:2977-1","SUSE-SU-2026:3022-1","SUSE-SU-2026:3026-1","SUSE-SU-2026:3040-1","SUSE-SU-2026:3474-1","SUSE-SU-2026:3475-1","SUSE-SU-2026:3576-1","SUSE-SU-2026:3992-1","UBUNTU-CVE-2026-41676","openSUSE-SU-2026:11182-1","openSUSE-SU-2026:11194-1","openSUSE-SU-2026:11205-1","openSUSE-SU-2026:11206-1","openSUSE-SU-2026:11210-1","openSUSE-SU-2026:11222-1","openSUSE-SU-2026:11237-1","openSUSE-SU-2026:11255-1","openSUSE-SU-2026:21252-1","openSUSE-SU-2026:21274-1","openSUSE-SU-2026:21285-1","openSUSE-SU-2026:21294-1","openSUSE-SU-2026:21386-1","openSUSE-SU-2026:21464-1","openSUSE-SU-2026:21782-1","openSUSE-SU-2026:21933-1","openSUSE-SU-2026:21982-1","openSUSE-SU-2026:22016-1"],"status":"published","title":"rust-openssl: Deriver::derive and PkeyCtxRef::derive can overflow short buffers on OpenSSL 1.1.1","description":"rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.9.27 to before 0.10.78, Deriver::derive (and PkeyCtxRef::derive) sets len = buf.len() and passes it as the in/out length to EVP_PKEY_derive, relying on OpenSSL to honor it. On OpenSSL 1.1.x, X25519, X448, DH and HKDF-extract ignore the incoming *keylen, unconditionally writing the full shared secret (32/56/prime-size bytes). A caller passing a short slice gets a heap/stack overflow from safe code. OpenSSL 3.x providers do check, so this only impacts older OpenSSL. This vulnerability is fixed in 0.10.78.","severity":{"version":"4.0","score":7.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00285,"percentile":0.21195,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-131","CWE-787"],"published":"2026-04-19T12:00:00Z","modified":"2026-11-10T14:10:59Z","fixes":[{"ecosystem":"crates.io","package":"openssl","fixed_in":["0.10.78"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:14","package":"rust-openssl","fixed_in":["0.10.78-1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.0","package":"s390-tools","fixed_in":["2.31.0-4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.1","package":"s390-tools","fixed_in":["2.31.0-slfo.1.1_4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"cryptsetup","fixed_in":["2.8.4-150700.6.4.4"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"s390-tools","fixed_in":["2.41.0-150700.4.26.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"s390-tools","fixed_in":["2.31.0-150400.7.34.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"s390-tools","fixed_in":["2.31.0-150400.7.34.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"s390-tools","fixed_in":["2.31.0-150500.9.32.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"sdbootutil","fixed_in":["1+git20260706.f9f4faf-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"rustup","fixed_in":["1.28.2~0-4.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"sccache","fixed_in":["0.16.0~0-2.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.9.27"},{"fixed":"0.10.78"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"389-ds-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.1.1-12"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"rust-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.45-1","0.10.57-1","0.10.64-1","0.10.68-1","0.10.70-1","0.10.72-1","0.10.73-1","0.10.78-1","0.10.79-1","0.10.81-1"]},{"source":"osv","ecosystem":"Debian:13","package":"rust-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.72-1","0.10.73-1","0.10.78-1","0.10.79-1","0.10.81-1"]},{"source":"osv","ecosystem":"Debian:14","package":"rust-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.78-1"}]}],"versions":["0.10.72-1","0.10.73-1"]},{"source":"osv","ecosystem":"crates.io","package":"openssl","ranges":[{"type":"SEMVER","events":[{"introduced":"0.9.27"},{"fixed":"0.10.78"}]}]},{"source":"osv","ecosystem":"crates.io","package":"openssl","ranges":[{"type":"SEMVER","events":[{"introduced":"0.9.27"},{"fixed":"0.10.78"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"rust-keylime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.9+49-160000.1.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-160000.1.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-160000.1.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"rust-keylime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.9+49-160000.1.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"rust-keylime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.9+49-160000.1.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"python-maturin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.7-160000.5.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"python-cryptography","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"44.0.3-160000.4.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"python-maturin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.7-160000.5.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"python-maturin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.7-160000.5.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"python-cryptography","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"44.0.3-160000.4.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"python-cryptography","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"44.0.3-160000.4.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"s390-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.31.0-4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"afterburn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.10.0.git73.b97f772-160000.1.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"python-cryptography","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.0.4-5.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"afterburn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.10.0.git73.b97f772-160000.1.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"afterburn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.10.0.git73.b97f772-160000.1.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"python-cryptography","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.0.4-slfo.1.1_5.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"rust-keylime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.9+49-slfo.1.1_1.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"s390-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.31.0-slfo.1.1_4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"afterburn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.10.0.git73.b97f772-1.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"rust-keylime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.9+49-1.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"libkrun","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.10-2.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"libkrun","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.10-slfo.1.1_2.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"afterburn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.10.0.git73.b97f772-slfo.1.1_1.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"aws-nitro-enclaves-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.0~git0.2950b36-160000.1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"aws-nitro-enclaves-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.0~git0.2950b36-160000.1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"aws-nitro-enclaves-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.0~git0.2950b36-160000.1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"aws-nitro-enclaves-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.0~git0.2950b36-160000.1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"sccache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.18.0~2-160000.1.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"sccache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.18.0~2-160000.1.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"rustup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.29.1~0-160000.1.1"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"rustup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.29.1~0-160000.1.1"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"cryptsetup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.4-150700.6.4.4"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"s390-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.41.0-150700.4.26.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"rust-keylime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.9+49-150500.3.19.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"rust-keylime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.9+49-150400.3.21.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"rust-keylime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.9+49-150400.3.19.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"rustup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.2~0-150400.3.13.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"rustup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.2~0-150400.3.13.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"rustup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.2~0-150400.3.13.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"rustup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.2~0-150400.3.13.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"rustup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.2~0-150400.3.13.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"rustup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.2~0-150400.3.13.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"rustup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.2~0-150400.3.13.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"rustup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.2~0-150400.3.13.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"rustup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.2~0-150600.10.13.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"rustup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.2~0-150600.10.13.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"rustup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.2~0-150600.10.13.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-3.56.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-3.56.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-150400.13.8.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-150400.13.8.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-150400.13.8.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-150400.13.8.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-150400.13.8.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-150400.13.8.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-150400.13.8.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-150400.13.8.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-150400.13.8.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-150600.18.28.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-150600.18.28.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-150600.18.28.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"afterburn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.10.0.git73.b97f772-150500.3.6.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"afterburn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.10.0.git73.b97f772-150400.3.6.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"afterburn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.10.0.git73.b97f772-150400.3.6.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"sccache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.16.0~0-150600.10.11.1"}]}],"bundled":14},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"sccache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.16.0~0-150600.10.11.1"}]}],"bundled":14},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"sccache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.16.0~0-150600.10.11.1"}]}],"bundled":14},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Python 3 15 SP7","package":"python-cryptography","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"41.0.3-150600.23.9.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"python-cryptography","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"41.0.3-150600.23.9.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"python-cryptography","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"41.0.3-150600.23.9.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"python-cryptography","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"41.0.3-150400.16.25.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"python-cryptography","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"41.0.3-150400.16.25.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"python-cryptography","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"41.0.3-150400.16.25.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"python-cryptography","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"41.0.3-150400.16.25.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"python-cryptography","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"41.0.3-150400.16.25.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"python-cryptography","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"41.0.3-150400.16.25.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"python-cryptography","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"41.0.3-150400.16.25.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"python-cryptography","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"41.0.3-150400.16.25.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"python-cryptography","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"41.0.3-150400.16.25.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"s390-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.31.0-150400.7.34.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"s390-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.31.0-150400.7.34.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"s390-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.31.0-150500.9.32.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"himmelblau","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.14+git0.e23b4c54-150500.11.12.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"himmelblau","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.14+git0.e23b4c54-150500.11.12.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"himmelblau","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.14+git0.e23b4c54-150500.11.12.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"himmelblau","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.14+git0.e23b4c54-150500.11.12.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"himmelblau","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.14+git0.e23b4c54-150500.11.12.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"himmelblau","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.14+git0.e23b4c54-150500.11.12.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP6","package":"aws-nitro-enclaves-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.0~git0.2950b36-150600.10.15.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP7","package":"aws-nitro-enclaves-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.0~git0.2950b36-150600.10.15.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"rust-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.23-1","0.10.23-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"rust-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.29-1","0.10.36-1","0.10.36-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"rust-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.45-1","0.10.57-1","0.10.57-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"rust-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.70-1","0.10.72-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"rust-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.73-1","0.10.81-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"rust-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.72-1","0.10.73-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-1.1"}]}],"bundled":8},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"sdbootutil","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1+git20260706.f9f4faf-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rustup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.2~0-4.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"sccache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.16.0~0-2.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"cargo-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.23-1.1"}]}],"bundled":8},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rust-keylime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.9+49-1.1"}]}],"bundled":8},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-maturin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.1-1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"afterburn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.10.0.git73.b97f772-1.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-160000.1.1"}]}],"bundled":8},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"rust-keylime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.9+49-160000.1.1"}]}],"bundled":8},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"python-maturin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.7-160000.5.1"}]}],"bundled":8},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"python-cryptography","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"44.0.3-160000.4.1"}]}],"bundled":8},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"afterburn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.10.0.git73.b97f772-160000.1.1"}]}],"bundled":9},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"libkrun","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.10-160000.3.1"}]}],"bundled":8},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"aws-nitro-enclaves-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.0~git0.2950b36-160000.1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"sdbootutil","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1+git20260908.c641fc2-160000.1.1"}]}],"bundled":8},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"sccache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.18.0~2-160000.1.1"}]}],"bundled":19},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"rustup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.29.1~0-160000.1.1"}]}],"bundled":16}],"products":[{"vendor":"rust-openssl","product":"rust-openssl"},{"vendor":"rust-openssl_project","product":"rust-openssl"}],"references":[{"url":"https://github.com/rust-openssl/rust-openssl/security/advisories/GHSA-pqf5-4pqq-29f5","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory","web","report"]},{"url":"https://github.com/rust-openssl/rust-openssl/pull/2606","tags":["web"]},{"url":"https://github.com/rust-openssl/rust-openssl/commit/09b425e5f59a2466d806e71a83a9a449c914c596","tags":["web"]},{"url":"https://github.com/rust-openssl/rust-openssl/releases/tag/openssl-v0.10.78","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41676","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-pqf5-4pqq-29f5"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41676.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-41676","tags":["advisory"]},{"url":"https://github.com/rust-openssl/rust-openssl","tags":["package"]},{"url":"https://crates.io/crates/openssl","tags":["package"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0473.html","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622554-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1260596","tags":["report"]},{"url":"https://bugzilla.suse.com/1270174","tags":["report"]},{"url":"https://bugzilla.suse.com/1270523","tags":["report"]},{"url":"https://bugzilla.suse.com/1270614","tags":["report"]},{"url":"https://bugzilla.suse.com/1270699","tags":["report"]},{"url":"https://bugzilla.suse.com/1270792","tags":["report"]},{"url":"https://bugzilla.suse.com/1270842","tags":["report"]},{"url":"https://bugzilla.suse.com/1270903","tags":["report"]},{"url":"https://bugzilla.suse.com/1270999","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41676","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41677","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41678","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41681","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41898","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42327","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44662","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45784","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622574-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1270085","tags":["report"]},{"url":"https://bugzilla.suse.com/1270088","tags":["report"]},{"url":"https://bugzilla.suse.com/1270089","tags":["report"]},{"url":"https://bugzilla.suse.com/1270091","tags":["report"]},{"url":"https://bugzilla.suse.com/1270092","tags":["report"]},{"url":"https://bugzilla.suse.com/1270106","tags":["report"]},{"url":"https://bugzilla.suse.com/1270107","tags":["report"]},{"url":"https://bugzilla.suse.com/1270138","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-20213","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-20214","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-20215","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-20216","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-20217","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-20243","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-20244","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622583-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622589-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1270208","tags":["report"]},{"url":"https://bugzilla.suse.com/1270515","tags":["report"]},{"url":"https://bugzilla.suse.com/1270620","tags":["report"]},{"url":"https://bugzilla.suse.com/1270706","tags":["report"]},{"url":"https://bugzilla.suse.com/1270772","tags":["report"]},{"url":"https://bugzilla.suse.com/1270801","tags":["report"]},{"url":"https://bugzilla.suse.com/1270936","tags":["report"]},{"url":"https://bugzilla.suse.com/1270994","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622593-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622615-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622624-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622737-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1270185","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622787-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1270175","tags":["report"]},{"url":"https://bugzilla.suse.com/1270483","tags":["report"]},{"url":"https://bugzilla.suse.com/1270555","tags":["report"]},{"url":"https://bugzilla.suse.com/1270651","tags":["report"]},{"url":"https://bugzilla.suse.com/1270787","tags":["report"]},{"url":"https://bugzilla.suse.com/1270817","tags":["report"]},{"url":"https://bugzilla.suse.com/1270886","tags":["report"]},{"url":"https://bugzilla.suse.com/1270949","tags":["report"]},{"url":"https://bugzilla.suse.com/1271348","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25541","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622801-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622827-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622895-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622898-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622910-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622917-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1196972","tags":["report"]},{"url":"https://bugzilla.suse.com/1242665","tags":["report"]},{"url":"https://bugzilla.suse.com/1243850","tags":["report"]},{"url":"https://bugzilla.suse.com/1244199","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-24713","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-12224","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-3416","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-5791","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622921-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623036-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1270198","tags":["report"]},{"url":"https://bugzilla.suse.com/1270429","tags":["report"]},{"url":"https://bugzilla.suse.com/1270470","tags":["report"]},{"url":"https://bugzilla.suse.com/1270582","tags":["report"]},{"url":"https://bugzilla.suse.com/1270683","tags":["report"]},{"url":"https://bugzilla.suse.com/1270721","tags":["report"]},{"url":"https://bugzilla.suse.com/1270831","tags":["report"]},{"url":"https://bugzilla.suse.com/1270877","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-24898","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623070-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623071-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623643-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1257933","tags":["report"]},{"url":"https://bugzilla.suse.com/1270202","tags":["report"]},{"url":"https://bugzilla.suse.com/1274300","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25727","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623659-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623983-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1243868","tags":["report"]},{"url":"https://bugzilla.suse.com/1257923","tags":["report"]},{"url":"https://bugzilla.suse.com/1270206","tags":["report"]},{"url":"https://bugzilla.suse.com/1270512","tags":["report"]},{"url":"https://bugzilla.suse.com/1270559","tags":["report"]},{"url":"https://bugzilla.suse.com/1270693","tags":["report"]},{"url":"https://bugzilla.suse.com/1270736","tags":["report"]},{"url":"https://bugzilla.suse.com/1270869","tags":["report"]},{"url":"https://bugzilla.suse.com/1270938","tags":["report"]},{"url":"https://bugzilla.suse.com/1270948","tags":["report"]},{"url":"https://bugzilla.suse.com/1273881","tags":["report"]},{"url":"https://bugzilla.suse.com/1273884","tags":["report"]},{"url":"https://bugzilla.suse.com/1273886","tags":["report"]},{"url":"https://bugzilla.suse.com/1273888","tags":["report"]},{"url":"https://bugzilla.suse.com/1274146","tags":["report"]},{"url":"https://bugzilla.suse.com/1282211","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-66746","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-66754","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-67181","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-67182","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93599","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93600","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93601","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93602","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624014-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1230032","tags":["report"]},{"url":"https://bugzilla.suse.com/1243862","tags":["report"]},{"url":"https://bugzilla.suse.com/1249008","tags":["report"]},{"url":"https://bugzilla.suse.com/1257902","tags":["report"]},{"url":"https://bugzilla.suse.com/1270186","tags":["report"]},{"url":"https://bugzilla.suse.com/1270521","tags":["report"]},{"url":"https://bugzilla.suse.com/1270619","tags":["report"]},{"url":"https://bugzilla.suse.com/1270644","tags":["report"]},{"url":"https://bugzilla.suse.com/1270795","tags":["report"]},{"url":"https://bugzilla.suse.com/1270870","tags":["report"]},{"url":"https://bugzilla.suse.com/1270874","tags":["report"]},{"url":"https://bugzilla.suse.com/1270989","tags":["report"]},{"url":"https://bugzilla.suse.com/1274144","tags":["report"]},{"url":"https://bugzilla.suse.com/1282217","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58160","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262777-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1241612","tags":["report"]},{"url":"https://bugzilla.suse.com/1259314","tags":["report"]},{"url":"https://bugzilla.suse.com/1261813","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262807-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262825-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262826-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262831-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1203257","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262832-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262833-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262834-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262834-2/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262835-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262975-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262976-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262977-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263022-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1210346","tags":["report"]},{"url":"https://bugzilla.suse.com/1223238","tags":["report"]},{"url":"https://bugzilla.suse.com/1229955","tags":["report"]},{"url":"https://bugzilla.suse.com/1242611","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-26964","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-32650","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-43806","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263026-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263040-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263474-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263475-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263576-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1270182","tags":["report"]},{"url":"https://bugzilla.suse.com/1270520","tags":["report"]},{"url":"https://bugzilla.suse.com/1270613","tags":["report"]},{"url":"https://bugzilla.suse.com/1270707","tags":["report"]},{"url":"https://bugzilla.suse.com/1270794","tags":["report"]},{"url":"https://bugzilla.suse.com/1270830","tags":["report"]},{"url":"https://bugzilla.suse.com/1270939","tags":["report"]},{"url":"https://bugzilla.suse.com/1270946","tags":["report"]},{"url":"https://bugzilla.suse.com/1270985","tags":["report"]},{"url":"https://bugzilla.suse.com/1273910","tags":["report"]},{"url":"https://bugzilla.suse.com/1273911","tags":["report"]},{"url":"https://bugzilla.suse.com/1273912","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263992-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-41676","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-41676","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1271911","tags":["report"]},{"url":"https://bugzilla.suse.com/1234010","tags":["report"]},{"url":"https://bugzilla.suse.com/1270192","tags":["report"]},{"url":"https://bugzilla.suse.com/1270420","tags":["report"]},{"url":"https://bugzilla.suse.com/1270471","tags":["report"]},{"url":"https://bugzilla.suse.com/1270616","tags":["report"]},{"url":"https://bugzilla.suse.com/1270670","tags":["report"]},{"url":"https://bugzilla.suse.com/1270742","tags":["report"]},{"url":"https://bugzilla.suse.com/1270863","tags":["report"]},{"url":"https://bugzilla.suse.com/1270922","tags":["report"]},{"url":"https://bugzilla.suse.com/1270995","tags":["report"]},{"url":"https://bugzilla.suse.com/1272525","tags":["report"]},{"url":"https://bugzilla.suse.com/1273384","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-41676","title":"rust-openssl: Deriver::derive and PkeyCtxRef::derive can overflow short buffers on OpenSSL 1.1.1","description":"rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.9.27 to before 0.10.78, Deriver::derive (and PkeyCtxRef::derive) sets len = buf.len() and passes it as the in/out length to EVP_PKEY_derive, relying on OpenSSL to honor it. On OpenSSL 1.1.x, X25519, X448, DH and HKDF-extract ignore the incoming *keylen, unconditionally writing the full shared secret (32/56/prime-size bytes). A caller passing a short slice gets a heap/stack overflow from safe code. OpenSSL 3.x providers do check, so this only impacts older OpenSSL. This vulnerability is fixed in 0.10.78.","status":"published","published":"2026-04-24T17:16:20.539Z","modified":"2026-04-24T17:43:20.693Z","cvss":[{"version":"4.0","score":7.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U","level":"high","assessor":"cna"}],"cwes":["CWE-787","CWE-131"],"updated_at":"2026-11-02T13:41:08.498858Z"}],"euvd":[{"id":"EUVD-2026-25582","description":"rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.9.27 to before 0.10.78, Deriver::derive (and PkeyCtxRef::derive) sets len = buf.len() and passes it as the in/out length to EVP_PKEY_derive, relying on OpenSSL to honor it. On OpenSSL 1.1.x, X25519, X448, DH and HKDF-extract ignore the incoming *keylen, unconditionally writing the full shared secret (32/56/prime-size bytes). A caller passing a short slice gets a heap/stack overflow from safe code. OpenSSL 3.x providers do check, so this only impacts older OpenSSL. This vulnerability is fixed in 0.10.78.","status":"published","published":"2026-04-24T17:16:20Z","modified":"2026-04-24T17:43:20Z","cvss":[{"version":"4.0","score":7.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U","level":"high"}],"updated_at":"2026-11-02T19:24:18.224827Z"}],"ghsa":[{"id":"GHSA-pqf5-4pqq-29f5","title":"rust-openssl: Deriver::derive and PkeyCtxRef::derive can overflow short buffers on OpenSSL 1.1.1","description":"`Deriver::derive` (and `PkeyCtxRef::derive`) sets `len = buf.len()` and passes it as the in/out length to `EVP_PKEY_derive`, relying on OpenSSL to honor it. On OpenSSL 1.1.x, X25519, X448, DH and HKDF-extract ignore the incoming `*keylen`, unconditionally writing the full shared secret (32/56/prime-size bytes). A caller passing a short slice gets a heap/stack overflow from safe code. OpenSSL 3.x providers do check, so this only impacts older OpenSSL.","status":"published","published":"2026-04-22T21:22:00Z","modified":"2026-04-27T16:42:06Z","cvss":[{"version":"4.0","score":7.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U","level":"high"}],"cwes":["CWE-131","CWE-787"],"updated_at":"2026-11-02T14:39:59.776263Z"}],"nvd":[{"id":"CVE-2026-41676","description":"rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.9.27 to before 0.10.78, Deriver::derive (and PkeyCtxRef::derive) sets len = buf.len() and passes it as the in/out length to EVP_PKEY_derive, relying on OpenSSL to honor it. On OpenSSL 1.1.x, X25519, X448, DH and HKDF-extract ignore the incoming *keylen, unconditionally writing the full shared secret (32/56/prime-size bytes). A caller passing a short slice gets a heap/stack overflow from safe code. OpenSSL 3.x providers do check, so this only impacts older OpenSSL. This vulnerability is fixed in 0.10.78.","status":"published","published":"2026-04-24T18:16:29.12Z","modified":"2026-07-15T16:17:18.25Z","cvss":[{"version":"4.0","score":7.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-131","CWE-787"],"updated_at":"2026-11-02T14:12:15.867234Z"}],"osv":[{"id":"CVE-2026-41676","title":"rust-openssl: Deriver::derive and PkeyCtxRef::derive can overflow short buffers on OpenSSL 1.1.1","description":"rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.9.27 to before 0.10.78, Deriver::derive (and PkeyCtxRef::derive) sets len = buf.len() and passes it as the in/out length to EVP_PKEY_derive, relying on OpenSSL to honor it. On OpenSSL 1.1.x, X25519, X448, DH and HKDF-extract ignore the incoming *keylen, unconditionally writing the full shared secret (32/56/prime-size bytes). A caller passing a short slice gets a heap/stack overflow from safe code. OpenSSL 3.x providers do check, so this only impacts older OpenSSL. This vulnerability is fixed in 0.10.78.","status":"published","published":"2026-04-24T17:16:20.539Z","modified":"2026-11-10T14:10:59.704101108Z","cvss":[{"version":"4.0","score":7.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U","level":"high"}],"cwes":["CWE-131","CWE-787"],"updated_at":"2026-11-10T14:31:49.124773Z"},{"id":"DEBIAN-CVE-2026-41676","description":"rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.9.27 to before 0.10.78, Deriver::derive (and PkeyCtxRef::derive) sets len = buf.len() and passes it as the in/out length to EVP_PKEY_derive, relying on OpenSSL to honor it. On OpenSSL 1.1.x, X25519, X448, DH and HKDF-extract ignore the incoming *keylen, unconditionally writing the full shared secret (32/56/prime-size bytes). A caller passing a short slice gets a heap/stack overflow from safe code. OpenSSL 3.x providers do check, so this only impacts older OpenSSL. This vulnerability is fixed in 0.10.78.","status":"published","published":"2026-04-24T18:16:29.12Z","modified":"2026-10-01T03:02:45.485875863Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:54.892385Z"},{"id":"GHSA-pqf5-4pqq-29f5","title":"rust-openssl: Deriver::derive and PkeyCtxRef::derive can overflow short buffers on OpenSSL 1.1.1","description":"`Deriver::derive` (and `PkeyCtxRef::derive`) sets `len = buf.len()` and passes it as the in/out length to `EVP_PKEY_derive`, relying on OpenSSL to honor it. On OpenSSL 1.1.x, X25519, X448, DH and HKDF-extract ignore the incoming `*keylen`, unconditionally writing the full shared secret (32/56/prime-size bytes). A caller passing a short slice gets a heap/stack overflow from safe code. OpenSSL 3.x providers do check, so this only impacts older OpenSSL.","status":"published","published":"2026-04-22T21:22:00Z","modified":"2026-11-10T14:10:59.704101108Z","cvss":[{"version":"4.0","score":7.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U","level":"high"}],"cwes":["CWE-131","CWE-787"],"updated_at":"2026-11-10T14:31:49.124773Z"},{"id":"UBUNTU-CVE-2026-41676","description":"rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.9.27 to before 0.10.78, Deriver::derive (and PkeyCtxRef::derive) sets len = buf.len() and passes it as the in/out length to EVP_PKEY_derive, relying on OpenSSL to honor it. On OpenSSL 1.1.x, X25519, X448, DH and HKDF-extract ignore the incoming *keylen, unconditionally writing the full shared secret (32/56/prime-size bytes). A caller passing a short slice gets a heap/stack overflow from safe code. OpenSSL 3.x providers do check, so this only impacts older OpenSSL. This vulnerability is fixed in 0.10.78.","status":"published","published":"2026-04-24T18:16:00Z","modified":"2026-10-17T12:58:16.039237866Z","cvss":[{"version":"4.0","score":7.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:18.393417Z"},{"id":"AZL-83618","title":"CVE-2026-41676 affecting package 389-ds-base 3.1.1-12","description":"rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.9.27 to before 0.10.78, Deriver::derive (and PkeyCtxRef::derive) sets len = buf.len() and passes it as the in/out length to EVP_PKEY_derive, relying on OpenSSL to honor it. On OpenSSL 1.1.x, X25519, X448, DH and HKDF-extract ignore the incoming *keylen, unconditionally writing the full shared secret (32/56/prime-size bytes). A caller passing a short slice gets a heap/stack overflow from safe code. OpenSSL 3.x providers do check, so this only impacts older OpenSSL. This vulnerability is fixed in 0.10.78.","status":"published","published":"2026-04-24T18:16:29Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:24.988217Z"},{"id":"openSUSE-SU-2026:11182-1","title":"clamav-1.5.3-1.1 on GA media","description":"These are all security issues fixed in the clamav-1.5.3-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-04T00:00:00Z","modified":"2026-07-05T14:15:04.192907623Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:11194-1","title":"sdbootutil-1+git20260706.f9f4faf-1.1 on GA media","description":"These are all security issues fixed in the sdbootutil-1+git20260706.f9f4faf-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-06T00:00:00Z","modified":"2026-07-07T08:30:08.080254511Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:11205-1","title":"rustup-1.28.2~0-4.1 on GA media","description":"These are all security issues fixed in the rustup-1.28.2~0-4.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-07T00:00:00Z","modified":"2026-07-09T10:00:07.451072429Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:11206-1","title":"sccache-0.16.0~0-2.1 on GA media","description":"These are all security issues fixed in the sccache-0.16.0~0-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-07T00:00:00Z","modified":"2026-07-09T10:00:07.660383563Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:11210-1","title":"cargo-c-0.10.23-1.1 on GA media","description":"These are all security issues fixed in the cargo-c-0.10.23-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-08T00:00:00Z","modified":"2026-07-09T10:00:09.538358088Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:11222-1","title":"keylime-ima-policy-0.2.9+49-1.1 on GA media","description":"These are all security issues fixed in the keylime-ima-policy-0.2.9+49-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-08T00:00:00Z","modified":"2026-07-09T10:00:08.539975656Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:11237-1","title":"python313-maturin-1.14.1-1.1 on GA media","description":"These are all security issues fixed in the python313-maturin-1.14.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-09T00:00:00Z","modified":"2026-07-10T10:00:10.392753115Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:11255-1","title":"afterburn-5.10.0.git73.b97f772-1.1 on GA media","description":"These are all security issues fixed in the afterburn-5.10.0.git73.b97f772-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-12T00:00:00Z","modified":"2026-07-13T09:00:09.551657076Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:21252-1","title":"Security update for clamav","description":"This update for clamav fixes the following issues:\n\nUpdate to version 1.5.3.\n\nSecurity issues fixed:\n\n- CVE-2026-20213: out-of-bounds write due to improper boundary checks for content in PE files during scanning\n (bsc#1270107).\n- CVE-2026-20214: out-of-bounds write due to improper boundary checks for content in FSG files during scanning\n (bsc#1270085).\n- CVE-2026-20215: out-of-bounds write due to improper boundary checks for content in 7z files during scanning\n (bsc#1270088).\n- CVE-2026-20216: denial of service due to improper handling of temporary resources during InstallShield file scanning\n (bsc#1270089).\n- CVE-2026-20217: out-of-bounds write due to improper boundary checks for content in PESpin files during scanning\n (bsc#1270091).\n- CVE-2026-20243: out-of-bounds write due to improper boundary checks for content in ALZ files during scanning\n (bsc#1270092).\n- CVE-2026-20244: integer overflow and DoS due to improper boundary checks for content in DMG files during scanning\n (bsc#1270106).\n- CVE-2026-41676: buffer overflow due to missing checks via `Deriver:derive`, `PkeyCtxRef:derive` and OpenSSL 1.1.1\n (bsc#1270138).\n\nOther updates and bugfixes:\n\n- Version 1.5.3:\n * Fixed a bug in the PESpin unpacker cleanup path that could free pointers into the scanned file buffer and crash the\n scanner.\n * Fixed an integer overflow in PE rebuild size calculations that could be reached through a malformed Aspack-packed PE\n file and lead to a heap buffer overflow write.\n * Fixed an InstallShield archive extraction limit bypass that could write far more temporary data than intended and\n exhaust temporary storage.\n * Fixed an FSG unpacker loop underflow that could write past the section array while scanning a malformed PE file.\n * Fixed ALZ parser size handling bugs that could cause malformed ALZ archives to panic, abort the scanner, or skip\n expected scan-limit handling.\n * Fixed a 7z parser substream count overflow that could under-allocate parser metadata arrays and write past them\n while reading a malformed archive.\n * Fixed 32-bit DMG parser size checks that could let a short mish stripe table pass validation and crash 32-bit\n scanner builds.\n * Hardened clamscan, clamdscan, and clamonacc quarantine actions against time-of-check/time-of-use races that could\n redirect copied, moved, or removed files under unsafe quarantine directory configurations.\n * Upgraded the Rust tar dependency to resolve the RUSTSEC-2026-0067 and RUSTSEC-2026-0068 advisories, and upgraded the\n Rust openssl dependency to resolve CVE-2026-41676.\n * Raised the minimum required CMake version to 3.17 to fix Linux builds with libcurl v8.21.0 when linking static\n library dependencies.\n * Metadata preclass scans now run before the final scan verdict.\n * ClamOnAcc: Fixed errors when recursively excluded paths are children of an included path.\n * ClamOnAcc: Fixed hash bucket list corruption when two watched paths collide in the same bucket.\n","status":"published","published":"2026-07-07T16:59:27Z","modified":"2026-07-09T10:00:10.943640114Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"openSUSE-SU-2026:21274-1","title":"Security update for rust-keylime","description":"This update for rust-keylime fixes the following issues:\n\nUpdate to version 0.2.9+49.\n\nSecurity issues fixed:\n\n- CVE-2026-41676: openssl: `Deriver:derive` and `PkeyCtxRef:derive` can overflow short buffers on OpenSSL 1.1.1\n (bsc#1270174).\n- CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length\n (bsc#1270614).\n- CVE-2026-41678: openssl: out-of-bounds write due to incorrect bounds assertion in `aes::unwrap_key()` (bsc#1270699).\n- CVE-2026-41681: openssl: `MdCtxRef::digest_final()` writes past caller buffer with no length check (bsc#1270792).\n- CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent\n memory to the network (bsc#1270842).\n- CVE-2026-42327: openssl: undefined behavior in `X509Ref::ocsp_responders` for certificates with non-UTF-8 OCSP URLs\n (bsc#1270523).\n- CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding due to incorrectly sized\n output buffers (bsc#1270903).\n- CVE-2026-45784: openssl: out-of-bounds write in `CipherCtxRef::cipher_update_inplace` for AES-KW-PAD ciphers due to\n incorrectly sized output buffer (bsc#1270999).\n\nOther updates and bugfixes:\n\n- Update openssl to 0.10.81.\n- Make tss-esai-sys depend on bindgen 72.1 to support llvm \u003e 21.\n- Build with Clang \u003c= 21 (bsc#1260596).\n- Version 0.2.9+49:\n * build(deps): bump uuid from 1.23.3 to 1.23.4\n * build(deps): bump syn from 2.0.117 to 2.0.118\n * build(deps): bump openssl from 0.10.80 to 0.10.81\n * build(deps): bump rand from 0.9.4 to 0.10.1\n * Added new regression test into packit-ci.yaml\n * build(deps): bump actions/checkout from 6 to 7\n * build(deps): bump uuid from 1.23.1 to 1.23.3\n * build(deps): bump log from 0.4.29 to 0.4.32\n * build(deps): bump http from 1.4.0 to 1.4.2\n * build(deps): bump codecov/codecov-action from 6 to 7\n * build(deps): bump retry-policies from 0.5.1 to 0.5.2\n * fix: Remove unused base64::Engine import in context_info tests\n * build(deps): bump reqwest-middleware from 0.5.1 to 0.5.2\n * build(deps): bump serde_json from 1.0.149 to 1.0.150\n * build(deps): bump openssl from 0.10.79 to 0.10.80\n * agent: Hash agent ID before TPM2_Certify qualifying data\n * cargo: Bump tss-esapi, picky-asn1-x509, and picky-asn1-der\n * build(deps): bump openssl from 0.10.78 to 0.10.79\n * build(deps): bump once_cell from 1.21.3 to 1.21.4\n * build(deps): bump tempfile from 3.23.0 to 3.27.0\n * push-model: cache UEFI event log bytes at startup\n * build(deps): bump quote from 1.0.40 to 1.0.45\n * build(deps): bump chrono from 0.4.42 to 0.4.44\n * build(deps): bump openssl from 0.10.73 to 0.10.78\n * build(deps): bump serde_json from 1.0.143 to 1.0.149\n * build(deps): bump syn from 2.0.106 to 2.0.117\n * build(deps): bump libc from 0.2.175 to 0.2.184\n * build(deps): bump rand from 0.9.2 to 0.9.4\n- Version 0.2.9+21:\n * tests: use Express-style named params in Mockoon endpoints\n * build(deps): bump pest_derive from 2.8.1 to 2.8.6\n * build(deps): bump trybuild from 1.0.110 to 1.0.115\n * build(deps): bump log from 0.4.28 to 0.4.29\n * build(deps): bump uuid from 1.19.0 to 1.20.0\n * build(deps): bump codecov/codecov-action from 5 to 6\n * build(deps): bump tracing-subscriber from 0.3.20 to 0.3.23\n * build(deps): bump cfg-if from 1.0.3 to 1.0.4\n * build(deps): bump tokio from 1.49.0 to 1.50.0\n * build(deps): bump actix-web from 4.12.1 to 4.13.0\n * build(deps): bump anyhow from 1.0.99 to 1.0.102\n * build(deps): bump clap from 4.5.57 to 4.5.60\n * build(deps): bump tracing from 0.1.36 to 0.1.44\n","status":"published","published":"2026-07-09T09:06:27Z","modified":"2026-07-11T18:24:35.576029611Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"openSUSE-SU-2026:21285-1","title":"Security update for python-maturin","description":"This update for python-maturin fixes the following issues\n\n- CVE-2026-41676: openssl: `Deriver:derive` and `PkeyCtxRef:derive` can overflow short buffers on OpenSSL 1.1.1\n (bsc#1270208).\n- CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length\n (bsc#1270620).\n- CVE-2026-41678: openssl: out-of-bounds write due to incorrect bounds assertion in `aes::unwrap_key()` (bsc#1270706).\n- CVE-2026-41681: openssl: `MdCtxRef::digest_final()` writes past caller buffer with no length check (bsc#1270772).\n- CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent\n memory to the network (bsc#1270801).\n- CVE-2026-42327: openssl: undefined behavior in `X509Ref::ocsp_responders` for certificates with non-UTF-8 OCSP URLs\n (bsc#1270515).\n- CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding due to incorrectly sized\n output buffers (bsc#1270936).\n- CVE-2026-45784: openssl: out-of-bounds write in `CipherCtxRef::cipher_update_inplace` for AES-KW-PAD ciphers due to\n incorrectly sized output buffer (bsc#1270994).\n","status":"published","published":"2026-07-10T08:42:03Z","modified":"2026-07-13T18:24:57.097617193Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"openSUSE-SU-2026:21294-1","title":"Security update for python-cryptography","description":"This update for python-cryptography fixes the following issues\n\n- CVE-2026-41676: openssl: `Deriver:derive` and `PkeyCtxRef:derive` can overflow short buffers on OpenSSL 1.1.1\n (bsc#1270208).\n- CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length\n (bsc#1270620).\n- CVE-2026-41678: openssl: out-of-bounds write due to incorrect bounds assertion in `aes::unwrap_key()` (bsc#1270706).\n- CVE-2026-41681: openssl: `MdCtxRef::digest_final()` writes past caller buffer with no length check (bsc#1270772).\n- CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent\n memory to the network (bsc#1270801).\n- CVE-2026-42327: openssl: undefined behavior in `X509Ref::ocsp_responders` for certificates with non-UTF-8 OCSP URLs\n (bsc#1270515).\n- CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding due to incorrectly sized\n output buffers (bsc#1270936).\n- CVE-2026-45784: openssl: out-of-bounds write in `CipherCtxRef::cipher_update_inplace` for AES-KW-PAD ciphers due to\n incorrectly sized output buffer (bsc#1270994).\n","status":"published","published":"2026-07-10T09:17:07Z","modified":"2026-07-13T18:24:57.349306744Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"openSUSE-SU-2026:21386-1","title":"Security update for afterburn","description":"This update for afterburn fixes the following issues:\n\nUpdate to version 5.10.0.git73.b97f772.\n\nSecurity issues fixed:\n\n- CVE-2026-41676: openssl: `Deriver:derive` and `PkeyCtxRef:derive` can overflow short buffers on OpenSSL 1.1.1\n (bsc#1270175).\n- CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length\n (bsc#1270555).\n- CVE-2026-41678: openssl: incorrect bounds assertion in `aes::unwrap_key()` can lead to OOB write (bsc#1270651).\n- CVE-2026-41681: openssl: `MdCtxRef::digest_final()` writes past caller buffer with no length check (bsc#1270787).\n- CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent\n memory to network peers (bsc#1270817).\n- CVE-2026-42327: openssl: undefined behavior in `X509Ref::ocsp_responders` when processing certificates with non-UTF-8\n OCSP URLs (bsc#1270483).\n- CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding (bsc#1270886).\n- CVE-2026-45784: openssl: out-of-bounds write in `CipherCtxRef::cipher_update_inplace` for AES-KW-PAD ciphers\n (bsc#1270949).\n- CVE-2026-25541: bytes: integer overflow in `BytesMut:reserve` can lead to undefined behavior and crashes\n (bsc#1271348).\n\nOther updates and bugfixes:\n\n- Version 5.10.0.git73.b97f772:\n * build(deps): bump anyhow from 1.0.99 to 1.0.103\n https://github.com/coreos/afterburn/pull/1284\n * build(deps): bump libflate from 2.1.0 to 2.2.2\n https://github.com/coreos/afterburn/pull/1283\n * build(deps): bump openssl from 0.10.79 to 0.10.80\n https://github.com/coreos/afterburn/pull/1277\n- Version 5.10.0.git70.9cc2a7b:\n * build(deps): bump openssl from 0.10.78 to 0.10.79\n * providers/hetzner: Add the HETZNER_PUBLIC_IPV6 attribute\n * providers/hetzner: Add support for network configuration\n * build(deps): bump rustls-webpki from 0.103.10 to 0.103.13\n * build(deps): bump openssl from 0.10.73 to 0.10.78\n * docs: Add AGENTS.md and CLAUDE.md for AI coding assistants\n * build(deps): bump rand from 0.9.2 to 0.9.4\n * opencode: add skills for provider scaffolding and release automation\n * ibmcloud-classic: Add missing network_id to fixture\n * kubevirt: Support static gateway and DNS with DHCP\n * build(deps): bump rustls-webpki from 0.103.6 to 0.103.10\n * fix(proxmoxve): Define DNS entries for every interface\n * Makefile: download `90-afterburn-authorized-keys-file.conf` for rpm building\n * Sync repo templates âš™\n * build(deps): bump bytes from 1.10.1 to 1.11.1\n * util/dhcp: Fix clippy lints\n * build(deps): bump actions/checkout from 4 to 6\n * build(deps): bump actions/upload-artifact from 4 to 5\n * kubevirt: modprobe for virtio_blk; remove dracut preload\n * kubevirt: Add NoCloud network configuration support\n * kubevirt: Support config drive network data\n * kubevirt: Refactor the provider to follow the proxmoxve structure\n * dracut: Add virtio_blk module preload to afterburn-network-kargs service\n * docs: Add release notes\n * cargo: Afterburn release 5.10.0\n- Version 5.10.0:\n * docs/release-notes: update for release 5.10.0\n * cargo: update dependencies\n * microsoft/azure: Add XML attribute alias for serde-xml-rs Fedora compat\n * docs/release-notes: Add entry for Azure SharedConfig XML parsing fix\n * microsoft/azure: Fix SharedConfig parsing of XML attributes\n * microsoft/azure: Mock goalstate.SharedConfig output in tests\n * providers/azure: switch SSH key retrieval from certs endpoint to IMDS\n * build(deps): bump the build group with 8 updates\n * build(deps): bump slab from 0.4.10 to 0.4.11\n * build(deps): bump actions/checkout from 4 to 5\n * upcloud: implement UpCloud provider\n * build(deps): bump the build group with 4 updates\n","status":"published","published":"2026-07-20T09:31:31Z","modified":"2026-07-24T18:24:21.743334542Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"openSUSE-SU-2026:21464-1","title":"Security update for libkrun","description":"This update for libkrun fixes the following issues:\n\n- CVE-2025-24898: openssl: use-after-free in `ssl::select_next_proto` due to improper lifetime handling (bsc#1270429).\n- CVE-2026-41676: openssl: short buffer overflow via `Deriver:derive` and `PkeyCtxRef:derive` when using OpenSSL 1.1.1\n (bsc#1270198).\n- CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length\n (bsc#1270582).\n- CVE-2026-41678: openssl: OOB write due to incorrect bounds assertion in `aes::unwrap_key()` (bsc#1270683).\n- CVE-2026-41681: openssl: stack corruption due to `MdCtxRef::digest_final()` writing past caller buffer with no length\n check (bsc#1270721).\n- CVE-2026-41898: openssl: information leak to network peers due to unchecked callback-returned length in PSK and\n cookie generate trampolines (bsc#1270831).\n- CVE-2026-42327: openssl: undefined behavior in `X509Ref::ocsp_responders` when processing certificates with non-UTF-8\n OCSP URLs (bsc#1270470).\n- CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding (bsc#1270877).\n","status":"published","published":"2026-07-28T11:13:36Z","modified":"2026-07-30T18:24:15.376456836Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"openSUSE-SU-2026:21782-1","title":"Security update for aws-nitro-enclaves-cli","description":"This update for aws-nitro-enclaves-cli fixes the following issues:\n\n- CVE-2026-25541: bytes: integer overflow in 'BytesMut:reserve' can lead to undefined behavior and crashes\n (bsc#1274300).\n- CVE-2026-25727: time: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion\n (bsc#1257933).\n- CVE-2026-41676: openssl: `Deriver:derive` and `PkeyCtxRef:derive` can overflow short buffers on OpenSSL 1.1.1\n (bsc#1270202).\n\nChanges for aws-nitro-enclaves-cli:\n\n- Update to version 1.5.0\n","status":"published","published":"2026-09-07T10:17:39Z","modified":"2026-09-09T10:00:05.697108577Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"openSUSE-SU-2026:21933-1","title":"Security update for sdbootutil","description":"This update for sdbootutil fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2026-41676: `Deriver:derive` and `PkeyCtxRef:derive` can overflow short buffers on OpenSSL 1.1.1\n (bsc#1270192).\n- CVE-2026-41677: out-of-bounds read in PEM password callback when returning an oversized length in rust-openssl\n crate (bsc#1270616).\n- CVE-2026-41678: incorrect bounds assertion in aes key wrap in rust-openssl crate (bsc#1270670).\n- CVE-2026-41681: MdCtxRef::digest_final() writes past caller buffer with no length check in rust-openssl crate\n (bsc#1270742).\n- CVE-2026-41898: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent\n memory in rust-openssl crate (bsc#1270863).\n- CVE-2026-42327: arbitrary code execution via specially crafted certificate in rust-openssl crate\n (bsc#1270471).\n- CVE-2026-44662: heap buffer overflow when encrypting with AES key-wrap-with-padding in rust-openssl crate\n (bsc#1270922).\n- CVE-2026-45784: out-of-bounds write in `CipherCtxRef::cipher_update_inplace` for AES-KW-PAD ciphers in rust-\n openssl crate (bsc#1270995).\n\nNon security issues fixed:\n\n- sdbootutil-update-predictions.service fails with Failed to start Update TPM predictions (bsc#1273384).\n- systemd ordering cycle and other service problems with snapshot 20260722 (bsc#1272525).\n- Unable to unlock multiple encrypted partitions with FIDO2 Key, Systemdboot+LUKS (bsc#1234010).\n\nChanges for sdbootutil:\n\n- Update to version 1+git20260908.c641fc2:\n * Update the shim when required\n * Warn when recovery PIN is different from recovery key\n * Improves extra boot entries support\n * Better report when the default snapshot diverges\n * Explain how to do re-enrolling if recovery PIN fails\n * Explain why update-prediction fails and how to solve it\n * Hide comparison output\n * Add bootctl default entry in the prediction\n- Update to version 1+git20260903.f91f636:\n * Include FIDO2 unlocked devices for ordering (bsc#1234010)\n * Test in parallel for speed up\n * Add --repair parameter to cleanup\n * Fix shellcheck complain\n * Report entries with missing files\n * Avoid duplicate entries in non-snapper systems\n * Add initial tests for sdbootutil\n * Report the error if bootctl clean fails\n- Update to version 1+git20260901.41540d5:\n * No warn if a component is not in the event log\n * Add status command\n * Select the new sdbootutil if available\n * Skip blank lines in measure-pcr-generator.sh\n * Do not change crypttab for unrelated entries\n * Report the bad PCR when update-prediction fail\n * Do not write the recovery PIN in the journal\n * Improves non snapshot system support\n * Update help message for --measure-pcr\n * Report when PCR 7 is dropped because shim update\n * Add --strict parameter for --pcr policy\n * Report dropped PCRs via a warn\n * Adjust the limits for PolicyOR issues\n * Avoid update predictions if the service is up\n * Keep the exit status of sdbootutil call\n- Update to version 1+git20260827.786f9a8:\n * Do not accept empty passwords\n * jeos-firstboot-enroll: report errors also in the journal\n * Restore old crypttab via the exit trap\n * Update CLAUDE data\n * Detect half created openssl keys\n * check_enrolled report when something was written in the LUKS2 header\n * Improve a bit the disk-encryption-tool keyslot detection\n * Avoid leak of env var secrets\n * Wipe the d-e-t key in the enroll service and jeos module\n * Remove the correct keyslot left by d-e-t\n * Differentiate tpm2 and tpm2+pin for unattended unlock\n * Use is_same_device in detect_tracked_device and drop greps\n * Refactor check to avoid shellcheck complain\n * Parse the entry file in a sigle place\n * Validate the entry with the new kernel name\n * Refactor enrollment interface and deprecate the old one\n * New kernels will have different hash\n * Warn If no crypttab entry found\n * Extend is_same_device\n * jeos-firstboot-enroll: validate the passwords\n * sdbootutil-enroll: report when no encryption method is provided\n * Write recovery pin after enrollment in jeos module\n * Write recovery pin after enrollment\n * Improve error detection in sdbootutil-enroll\n * Increase keyctl timeout\n * Merge require_unlock and set_unlock_method\n * Be sure that the terminal check works with snapper\n * Renerate initrd when new measure-pcr keys are created\n * Separate ask-* parameters\n * Fix reading credential and keyctl password\n * Get the device password for each enrolling mechanism\n * Drop elements from crypttab if the enrollment fails\n * Validate the enrollment for each method\n * Add warning when enrolling FIDO2 token\n- Update to version 1+git20260825.c7a5a97:\n * Refactor free space calculation\n * Do not use /proc/cmdline in half configured systems\n * Warning when the recovery PIN is not validated\n * Show default and booted snapshots with marks\n * Improve detection of snapshot systems\n * Fix when searching for a boot entry\n * Fix boot order and boot order entry\n * Create the entries directory in the ESP\n * Fix get_final_pcr parser\n * Keep btrfs error and show it when fails\n * Fix set -e early exit instances\n * Fix measure-pcr-validator when there is no terminal\n * Don't include measure-pcr-validator in initrd if TPM2 is not used\n * Update predictions even if crypttab did not change\n * Improve PCR 15 signing\n * Detect NAME=VALUE passed as parameters and complain\n * When asking a password, require a terminal\n * Filter some warnings from pcrlock\n * Detect directories that are not part of the snapshot\n * Write bash completion errors to /dev/null\n * Detect when t-u apply is done and avoid data corruption\n * Detect pcr-oracle leftovers\n * Show in title that it's the initial version for transactional systems\n * Manually generate PCR7 measurements\n * Regenerate pcrlock.json when it is missing\n- Update to version 1+git20260813.357956d:\n * Do not update the predictions without a TPM2 enrollment (bsc#1273384)\n- Update to version 1+git20260812.305d9f2:\n * Do not supplement if GRUB2-EFI is installed (bsc#1272525)\n- Update to version 1+git20260714.d9bb736:\n * tukit: do not fail if service is not found\n- Update to version 1+git20260713.d869cf8:\n * Ignore errors in the snapper plugin\n- Update to version 1+git20260709.7dfd021:\n * Remove the background process in the plugin\n * Fix missing initrd condition (bsc#1270420)\n * After reboot the shutdown service is not active\n * Disable the shutdown service after main service\n * Update uhmac dependencies (rust-openssl)\n bsc#1270192, CVE-2026-41676\n bsc#1270995, CVE-2026-45784\n bsc#1270922, CVE-2026-44662\n bsc#1270863, CVE-2026-41898\n bsc#1270742, CVE-2026-41681\n bsc#1270670, CVE-2026-41678\n bsc#1270616, CVE-2026-41677\n bsc#1270471, CVE-2026-42327\n * Add systemd transient service to update predictions\n * Install extra EFI binaries\n- Update to version 1+git20260625.7fa275e:\n * Remove duplicate code and parametrize timers\n * Check boot entry before kernel installation\n * Re-install an old kernel if initrd cannot be reused\n * Skip installation for already installed kernel\n * Add configurable devicetree entry support\n * Set explicit kernel and initrd paths\n * Remove the full tmpdir in the service\n * Fix /run/sdbootutil permissions\n * Execute predictions in the background\n * Add --disable-predictions parameter\n * Fix comparison operator\n * Add print-loader-path command\n","status":"published","published":"2026-09-23T09:16:27Z","modified":"2026-09-25T18:23:14.233701522Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"openSUSE-SU-2026:21982-1","title":"Security update for sccache","description":"This update for sccache fixes the following issues:\n\n- CVE-2024-12224: idna: idna accepts Punycode labels that do not produce any non-ASCII when decoded (bsc#1243868).\n- CVE-2026-25541: bytes: integer overflow in 'BytesMut:reserve' can lead to undefined behavior and crashes\n (bsc#1274146).\n- CVE-2026-25727: time: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion\n (bsc#1257923).\n- CVE-2026-41676: openssl: `Deriver:derive` and `PkeyCtxRef:derive` can overflow short buffers on OpenSSL 1.1.1\n (bsc#1270206).\n- CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length in rust-\n openssl crate (bsc#1270559).\n- CVE-2026-41678: openssl: incorrect bounds assertion in aes key wrap in rust-openssl crate (bsc#1270693).\n- CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check in rust-openssl crate\n (bsc#1270736).\n- CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent\n memory in rust-openssl crate (bsc#1270869).\n- CVE-2026-42327: openssl: arbitrary code execution via specially crafted certificate in rust-openssl crate\n (bsc#1270512).\n- CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding in rust-openssl crate\n (bsc#1270938).\n- CVE-2026-45784: openssl: out-of-bounds write in `CipherCtxRef::cipher_update_inplace` for AES-KW-PAD ciphers in rust-\n openssl crate (bsc#1270948).\n- CVE-2026-66746: rouille: HTTP Response Splitting via Unvalidated Response Header Values (bsc#1273881).\n- CVE-2026-66754: rouille: remove_prefix function that allows remote unauthenticated attackers to crash the server by\n sending a crafted percent-encoded URL (bsc#1273884).\n- CVE-2026-67181: rouille: HTTP Request Smuggling via Transfer-Encoding Desynchronization (bsc#1273886).\n- CVE-2026-67182: rouille: HTTP Request Smuggling Enables Front-End Access Control Bypass (bsc#1273888).\n- CVE-2026-93599: rustls-webpki: panic via empty BIT STRING (bsc#1282211).\n- CVE-2026-93600: rustls-webpki: name constraints URI validation bypass (bsc#1282211).\n- CVE-2026-93601: rustls-webpki: name constraint bypass (bsc#1282211).\n- CVE-2026-93602: rustls-webpki: CRL revocation check bypass (bsc#1282211).\n\nChanges for sccache:\n\nUpdate to version 0.18.0~2:\n * Add experimental concurrent cache support\n * chore: Remove dependency status badge (#2856)\n * Don't hand the jobserver to children that can't use it\n * dist: refuse to trim rlibs from crates that also emit a cdylib\n * fix(cache): avoid duplicate multilevel reads\n * Strip basedirs from the compiler arguments too\n * tests/integration: replace MinIO with Silo\n * ci: dump sccache logs on integration failures\n * multilevel: a chain with any writable level is writable\n * Fix parsing of #line directives\n * Release 0.18.0\n * daemonize: use an allow-list approach to inherited FDs\n * gcc, clang: make the assembler part of the cache key\n * support cl.exe /openmp:llvm\n * support all current /fsanitize*, /fsanitize-coverage*, and /fno-sanitize* args\n * support MSVC /feature argument\n * msvc: support lots of flags (#2832)\n * Update shlex dependency to version 2 (#2836)\n * gcc: mark flags as TooHard if need to cache something else (#2833)\n * clang: support more CLI options (#2834)\n * msvc: support arm64EC and fastfail flags (#2830)\n * chore: fix typo in comment (#2829)\n * nvcc: accept the --diag-error/--diag-suppress/--diag-warn family (#2816)\n * cache: allow skipping capability checks (#2822)\n * Bump opendal to 0.58.1 and fix fallout (fixes local GCS cache usage) (#2715)\n * nvcc (Windows): protect escaped quotes in dryrun lines before flattening backslashes (#2811)\n * Add an agent (#2812)\n * Add support for d20bforceinline. (#2807)\n * feat: add Microsoft Entra ID (passwordless) auth for the Azure Blob backend (#2802)\n * Bump MSRV to 1.91.0 (#2793)\n * Fix `nvcc` dryrun parsing for CUDA 13.3 (#2722)\n * test: Fixed hardcoded binary path in test\n * Release 0.17.0\n * tests: pin libc in the dist test crate\n * doc: clarify server-side outputs and drop 'recommended mode' claim\n * doc: document SCCACHE_CLIENT_SIDE env var\n * doc: document client-side and direct modes in Architecture.md\n * Fix description of Unix socket-based Redis connection\n * server: remove redundant async block in start_compile_task\n * server: simplify bind() request loops with ? instead of manual match arms\n * Add support for arg files in Rust (#2782)\n * feat: support S3 SSE-KMS with AWS-managed and customer-managed keys (#2770)\n * abort compile tasks and associated subprocesses when a client disconnects\n * treat -ivfsoverlay as a preprocessor-only argument\n * gcc: refine response-file tokenizer visibility and whitespace handling\n * integration: convert cmake 4.x modules XFAIL test to a passing test\n * gcc/clang: cache and distribute builds using quoted @response files\n * fix: Fix ToolchainPackager cfg gate to build on ppc64le/s390x\n * fix: make gcc diagnostics color output work the same as for rustc\n * implement client-side mode\n * split handle_compile_response so that the compilation result can be handled separately\n * implement IpcStorage -- Storage backend over IPC\n * extend wire protocol with storage RPCs\n * implement AddAssign for ServerStats and related types\n * add Storage::get_path for direct file access\n * implement get_raw/put_raw on MultiLevelStorage\n * add client_side_mode config flag (SCCACHE_CLIENT_SIDE)\n * Extract new_client_runtime() helper to DRY up client runtime creation\n * Clarify single-threaded runtime rationale comment (grammar)\n * fix: use single-threaded tokio runtime in sccache dist-client\n * fix: use single-threaded tokio runtime in sccache client\n * fix: handle disabled cache backend features in multilevel chain\n * Fix ldd output parsing: remove .exists() check that failed on systems where the symlink source path does not exist locally (e.g. aarch64)\n * Fix cfg guard for PanicToolchainPackager to also cover non-x86_64 Linux architectures (e.g. aarch64)\n * Release 0.16.0\n * fix: strip SCCACHE_BASEDIRS from escaped-backslash paths on Windows (#2736)\n * Ignore empty-set environment values (#2639)\n * feat: all backends support making them as read-only (#2705)\n * Enable RE on Linux-aarch64 (#2668)\n * Slightly improve logging (#2734)\n * chore: encode jwt key and cert digest with base64 in logs (#2712)\n * chore: make clippy happy (#2727)\n * feat: avoid sccache wrapper when resolving compiler (#2720)\n * Fall back to direct cache write if tempfile creation on the same fs fails (#2369)\n * remove too noisy bench\n * feat(nvcc): support argument: `--dependency-output` (#2708)\n * fix: add newline when printing dist-status to stdout\n * Revert \"Classify .s files as AssemblerToPreprocess so #include/#ifdef are hon...\"\n * Don't wait depfiles for gcc/clang preprocessed inputs\n * Classify .s files as AssemblerToPreprocess so #include/#ifdef are honored\n * prepare release 0.15.0\n * Add cargo-binstall metadata for prebuilt binary installation\n * Fix coverage\n * fix: handle directories in dep-info source file hashing\n * docs(Rust.md): Add caveats from README\n * Add retry for dists docker image build\n * ci: set crt-static for riscv64 musl targets\n * feat: Add loongarch64 support\n * feat: Implement multi-tier caching with fallback and backfilling (#2581)\n * msvc: add support for Y-, YI, Zf flags\n * Group tests logging in CI\n * Add failing test for cmake-modules + cmake 4 version\n * Unfold ninja output in the test\n * Add a comment for maintaining integration tests\n * Move cmake-modules to integration tests\n * fix: exclude CARGO_ENCODED_RUSTFLAGS from env var hash (#2651)\n * chore(deps): update rust crate quinn-proto to v0.11.14\n * Fix sync GCS initialization\n * clippy: fix from_iter_instead_of_collect lint\n * fix: add Win32_Security feature to windows-sys dependency\n * build(deps): bump actions/download-artifact from 5 to 8\n * msvc: Append the default .pdb extension for the /Fd argument (#2621)\n * build(deps): bump actions/upload-artifact from 4 to 7\n * clippy: fix ref_option lint\n * ci: install grcov from prebuilt binary instead of cargo install\n * ci: use default toolchain to install grcov\n * ci: fix artifact_failure action when target dir does not exist\n * Remove benchmark normalize_win_path_utf8 (#2634)\n * Revert \"actions: add security audit workflow (#2594)\" (#2603)\n * partial c++20 module support (#2516)\n * clippy: fix ptr_as_ptr lint (#2611)\n * Add support for `d1nodatetime` \u0026 `await:strict` MSVC flags (#2617)\n * chore: switch thirtyfour_sync to thirtyfour (#2613)\n * clippy: fix manual_string_new lint (#2609)\n * clippy: fix unnecessary_semicolon lint (#2615)\n * clippy: fix explicit_into_iter_loop lint (#2616)\n * Avoid double-caching when ccache is installed in PATH (#2524)\n * clippy: fix cloned_instead_of_copied lint (#2605)\n * clippy: fix semicolon_if_nothing_returned lint (#2601)\n * Move PreprocessorCacheModeConfig to src/config.rs (#2604)\n * clippy: fix cloned_ref_to_slice_refs lint (#2602)\n * prepare the new release (#2600)\n * chore: update to toml 0.9 (#2599)\n * ci: Add coverage to integration tests, report it to Codecov.io (#2598)\n * Preparation for multilevel caching (#2597)\n * Add sccache-dist to flake.nix (#2579)\n * fixup! cargo fmt\n * fixup! rustfmt update\n * Extract FileObjectSource, CacheRead and CacheWrite to cache_io.rs\n * chore: update to nix 0.30\n * Add a helper method to get a correct backend name\n * Add cos feature gate to RemoteStorage\n * Simplify profiles for integration tests\n * clippy: fix implicit_clone lint (#2584)\n * actions: add security audit workflow (#2594)\n * docs: fix examples showing an xz-compress toolchain archive (#2587)\n * add benches for normalize_win_path strip_basedirs (#2588)\n * snap: update to core24 (#2570)\n * Add .rustfmt.toml for consistent style between `rustfmt` and `cargo fmt` (#2582)\n * add comments about auth token requirements (#2583)\n * chore: update to tokio-serde 0.9 (#2585)\n * ci: update freebsd to 15.0 (#2586)\n * distributed compilation support for asm \u0026 preprocessor outputs (#2557)\n * remove unused declaration (#2577)\n * Extract LazyDiskCache to a separated file (#2573)\n * Revert \"ci: show diff for toml_format\" (#2578)\n * Open Add SCCACHE_BASEDIRS support\n * ci: show diff for toml_format\n * chore: update to syslog 7\n * refactor: use matrix to reduce deduplication\n * fix: remove outdated `analysis` mode\n * Unbreak the s390x CI\n * ci: add macos-15-intel for prebuilt binary (#2555)\n * Integration tests (#2564)\n * Fix code review.\n * Impl for COS.\n * build(deps): bump opendal from 0.54.0 to 0.55.0\n * Move integration tests related stuff to subdir\n * Add Objective C Header for consistency\n * github action: fix the syntax - fails in the ci\n * sccache: prepare a new release\n * msvc: add msbuild support test\n * msvc: fix detect_showincludes_prefix with MSBuild\n * chore: update to gzp 2\n * build(deps): bump rsa from 0.9.6 to 0.9.10\n * codspeed: evaluate the memory benchmarking\n * remove too quick benchmarks\n * codspeed: move to simulation mode\n * Add realistic LRU cache access pattern benchmarks\n * Add compression characteristics benchmarks\n * Add build workflow simulation benchmarks\n * Add hash computation scenario benchmarks\n * Add batch cache entry benchmarks\n * Add cache artifact serialization benchmarks\n * Add /etc/ld.so.conf.d (if present) to compiler package\n * Assembly language support\n * fix(ci): pin serde_json to avoid zmij dependency\n * fix(ci): update zmij to fix s390x cross-compilation\n * Fix the run of the CI\n * run the benchmark in the ci\n * add benchmarks\n * dedup some code\n * Fix hash logging prefix\n * Add support for C preprocessor output\n * Add GCC pipe flag support\n * Improve save-temps gcc flags detection\n * MSVC: support forward slash as an output dir marker\n * add clang -fplugin=x regression test\n * canbeconcatenated is not accounted for in cmp\n * Reversed the order for looking `rustc`, added comment\n * Fix failing test_rlib_dep_reader_call for omit CARGO_HOME\n * fix: don't hash -parallel-jobs in Clang\n * docs: add installation steps for nix (#2523)\n * Support clang -fexperimental-assignment-tracking option (#2517)\n * add a nix flake (#2518)\n * Switch from the unmaintained daemonize crate to a maintained fork\n * chore: update to fs-err 3\n * Fix grammar of error message\n * Add server name info to stderr of remote jobs that ran, but failed\n * Remove another pointless destructuring\n * try to unbreak the ci\n * fix s390x build error\n * Add riscv64 support\n * fix: make aarch64-pc-windows-msvc also zip not tar.gz\n * Free up disk space in CI\n * MSVC on Windows only\n * Avoid 'No space left on device' errors in CI\n * GitHub dropped macos-13 runners\n * Proper function pointer to int cast\n * Avoid unused structs with dist-server disabled\n * no check cfg (#2507)\n * chore: switch once_cell crate to standard library (#2499)\n * Avoid unreliable assert_cmd::cargo::cargo_bin (#2489)\n * Fix build on macOS which doesn't have separate 32-bit dirent (#2492)\n * Fix Clippy warnings (#2490)\n * docs: bump MSRV to 1.85.0\n * msvc: handle '/FoRelease\\' command-line argument\n * chore: drop tower dependency\n * chore: update to itertools 0.14\n * Use generator in CMAKE_MSVC_DEBUG_INFORMATION_FORMAT in README\n * Update directories to 6.0\n * Configuration.md - note logging env variables\n * chore: update to env_logger 0.11\n * deps: update blake3\n * prepare version 0.12.0\n * Update README with winget installation instructions\n * Skip CARGO_BUILD_JOBS in hash keys\n * build(deps): bump object from 0.36.7 to 0.37.1\n * Adjust tests after the rust update\n * Fix CI by adding cargo-features and updating coverage test to use modern -Cinstrument-coverage\n * Fix more clippy warnings\n * bump rustc in the ci too\n * Fix rustc 1.85 clippy warnings\n * bump to rustc 1.85 / edition 2024. mandatory for reqsign-core and run rustfmt with the version\n * fix clippy warnings\n * bump opendal to 0.54.0 \u0026 reqsign to 0.18.0\n * github action: when creating a release, make it as draft before (#2458)\n * prepare version 0.11.0 (#2457)\n * document SCCACHE_LOG_MILLIS (#2456)\n * logging: add a option to log milliseconds (Closes: #2454) (#2455)\n * feat: handle human size prefixes (#2405)\n * fix: in stats, Compare values AND keys to have a fully deterministic order (#2403)\n * Add --diagnostic-width to test for args ignored in hash\n * Ignore --diagnostic-width argument when computing hash\n * build(deps): bump actions/checkout from 4 to 5\n * build(deps): bump actions/download-artifact from 4 to 5\n * build(deps): bump actions/github-script from 7 to 8\n * Fix rustfmt\n * Fix comments on request\n * Fix clippy and rustfmt\n * Add test for count toolchain and use Determenistic for create tar archive\n * Fix mtime for reproducable toolchains\n * build(deps): bump chrono from 0.4.41 to 0.4.42\n * fix typo in an environment variable name\n * Fix documentation of azure configuration\n * Account for clippy-driver having extra prefix `rustc`\n * Fix build on Android (in Termux)\n * add support for s390x build\n * chore: replace retry crate with backon\n * Remove or replace \"Windows 2019\" CI config\n * Needs another result unwrapping, it seems\n * Test: invoking symlink \"compiler\" to \"sccache\" invokes \"compiler\"\n * Add a comment about the problem with symlinks and current_exe()\n * Fix symbolic links to sccache on linux\n * Allow the CI configuration to disable clang++ for CUDA testing\n * Don't run tests using clang++ as CUDA compiler on Windows\n * add description to sccache-dist commands\n * Display a more user-friendly error when compiling on Linux/arm64\n * Clarify documentation about \"the hash\" (aka cache key)\n * Remove stray ')'\n * Remove documentation for removed limitations of preprocessor cache mode\n * Fix preprocessor cache mode when the compiler outputs a dep file\n * Partially revert \"Don't cache dep file (#2322)\"\n * Do not disable preprocessor cache mode if there is a dep file\n * Fix preprocessor cache mode with distributed builds (#2173)\n * Change self of generate_hash_key() from Box\u003cSelf\u003e to \u0026mut Self\n * Remove a few IMO pointless indirections / aliases\n * Remove workaround for #2173\n * Add test for bug #2173\n * chore: fix some minor issues in comments\n * build(deps): bump chrono from 0.4.40 to 0.4.41\n * build(deps): bump memchr from 2.7.1 to 2.7.5\n * check if we can use a specific version of rust to build grcov\n * Move comment that hadn't moved with its corresponding code\n * Rework direct mode documentation some more\n * Explain what preprocessor cache mode really does\n * Reword and correct the preprocessor cache mode documentation\n * chore: Remove not working mozilla code\n * Add support for -fsanitize-ignorelist\n * github storage: adjust the doc\n * github storage: ACTIONS_CACHE_URL =\u003e ACTIONS_RESULTS_URL\n * github storage: force version 2\n * Update codecov badge in README.md\n * Expand tests for dist-server\n * ci: Consolidate testing, coverage\n * ci: Update ubuntu-20.04 runners to ubuntu-22.04\n * chore: fix some comments\n * Give the --dist-status user some information about when a retry will happen.\n * Add support for Xclang flag '-mrelax-all'\n * Add support for Xclang flag '-mconstructor-aliases'\n * feat(utils): Add support for object \u003e= 0.33\n * fix(tests): Remove executable bit from oauth.rs\n * build(deps): bump openssl from 0.10.64 to 0.10.72\n * build(deps): bump tokio from 1.41.0 to 1.43.1\n * Improve the CARGO_INCREMENTAL checking (#2364)\n * build(deps): bump chrono from 0.4.38 to 0.4.40\n * build(deps): bump clap from 4.4.18 to 4.5.13\n * build(deps): bump ring from 0.17.7 to 0.17.13\n * Bail on `nvcc -time` and `nvcc -fdevice-time-trace` flags\n * test hip with librandomize_readdir\n * Add randomize_readdir test utility\n * fix non-strict HIP device lib order\n * Create config during testing to collect coverage data\n * Extend coverage to distributed tests\n * chore: replace num_cpus crate with available_parallelism in standard library (#2342)\n * Update CI coverage: grcov/codecov\n","status":"published","published":"2026-09-30T17:58:26Z","modified":"2026-10-01T17:30:06.785984892Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"openSUSE-SU-2026:22016-1","title":"Security update for rustup","description":"This update for rustup fixes the following issues:\n\n- CVE-2024-12224: idna: idna accepts Punycode labels that do not produce any non-ASCII when decoded (bsc#1243862).\n- CVE-2025-58160: tracing-subscriber: Tracing log pollution (bsc#1249008).\n- CVE-2026-25541: bytes: integer overflow in 'BytesMut:reserve' can lead to undefined behavior and crashes\n (bsc#1274144).\n- CVE-2026-25727: time: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion\n (bsc#1257902).\n- CVE-2026-41676: openssl: `Deriver:derive` and `PkeyCtxRef:derive` can overflow short buffers on OpenSSL 1.1.1\n (bsc#1270186).\n- CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length in rust-\n openssl crate (bsc#1270619).\n- CVE-2026-41678: openssl: incorrect bounds assertion in aes key wrap in rust-openssl crate (bsc#1270644).\n- CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check in rust-openssl crate\n (bsc#1270795).\n- CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent\n memory in rust-openssl crate (bsc#1270870).\n- CVE-2026-42327: openssl: arbitrary code execution via specially crafted certificate in rust-openssl crate\n (bsc#1270521).\n- CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding in rust-openssl crate\n (bsc#1270874).\n- CVE-2026-45784: openssl: out-of-bounds write in `CipherCtxRef::cipher_update_inplace` for AES-KW-PAD ciphers in rust-\n openssl crate (bsc#1270989).\n- CVE-2026-93599: rustls-webpki: panic via empty BIT STRING (bsc#1282217).\n- CVE-2026-93600: rustls-webpki: name constraints URI validation bypass (bsc#1282217).\n- CVE-2026-93601: rustls-webpki: name constraint bypass (bsc#1282217).\n- CVE-2026-93602: rustls-webpki: CRL revocation check bypass (bsc#1282217).\n- rust-shlex: Multiple issues involving quote API (RUSTSEC-2024-0006, GHSA-r7qv-8r2h-pg27) (bsc#1230032).\n\nChanges for rustup:\n\n- Update to version 1.29.1~0:\n * dist(rustup-init/sh): update commit shasum in help string\n * style(bin/rustup-init): reformat code\n * docs(changelog): update for v1.29.1 stable release\n * warn how to switch away from the deprecated complete profile\n * fix(cli/help): fix wording in `rustup run --help`\n * ci(docker/android): stop building OpenSSL\n * refactor(cli/docs): use tracing for docs opening status messages\n * refactor(self-update): rename Windows uninstall registry helpers\n * feat(test): isolate Windows registry state per test\n * docs(dev-guide): mention how to support new compilation targets\n * Fix funding link\n * chore(deps): lock file maintenance\n * refactor(cli/self-update): move `current_install_opts()` to `InstallOpts::display()`\n * refactor(cli/self-update): move `process` out of `InstallOpts`\n * fix(cli/self-update): postpone initialization of `Cfg` in `setup_mode`\n * refactor(cli/self-update): take `Process` in `check_existence_of_settings_file()`\n * fix(settings): prevent creating new file with `SettingsFile::read_settings()`\n * test(cli-inst-interactive): test file creation on cancelled installation\n * refactor(toolchain/names): inline `validate()` aliases into `FromStr`\n * refactor(toolchain/names): rename `validate()` to `normalize_name()`\n * fix minor typos\n * www: align copy icon\n * refactor(toolchain/names)!: remove `try_from_str!()`\n * refactor(toolchain/names)!: remove `from_variant!()`\n * Add `rustup doc --serve` to serve docs over local HTTP\n * Move doc() and man() into a new docs module\n * chore(github): comment out instructions in PR template\n * docs(dev-guide): reapply abandoned changes from #4970\n * Add riscv64 unknown linux musl support\n * fix(deps): update rust crate enum-map to v3\n * refactor(cli/self-update)!: rename `install()` to `InstallOpts::install()`\n * refactor(cli/self-update)!: rename `maybe_install_rust()` to `InstallOpts::install_rust()`\n * refactor(cli/self-update)!: rename `InstallOpts::install()` to `InstallOpts::select_toolchain()`\n * refactor(toolchain/names)!: make more clones during conversions explicit\n * refactor(cli/self-update): move message templates to `mod msg`\n * style(cli/self-update): reorganize imports\n * Add pull request template linking to the dev guide\n * doc: add AI policy to the dev guide\n * ci(dist): ensure pushing to `dev-static` on `stable` update\n * test(toolchain): add a test case for `rustup toolchain install --override`\n * feat(toolchain): add `--default` flag to `rustup toolchain install`\n * fix(toolchain): inline use of `set_override`\n * Add Enzyme to the list of rustup components\n * fix: repair toolchains without an installed manifest\n * refactor: expose the installed manifest path\n * Docs: Remove i686 `set default-host` example\n * fix(self-update): only remove complete profile lines\n * chore(deps): bump `platforms` to 4.1.0\n * chore(deps): remove pinned `openssl-src`\n * refactor: replace `cfg_if!{}` with `cfg_select!{}`\n * fix: Lock state file updates\n * Fix Rust 1.97 clippy warnings\n * uninstalls toolchains prior to deleting the rustup home folder\n * Take semver-compatible dependency updates\n * Upgrade platforms to 4\n * docs: update `CHANGELOG` for v1.29.1\n * Lock file maintenance\n * Remove Windows special case from `can_run`\n * diskio: drop unnecessary constructor wrapper\n * diskio: rename _IncrementalFileState to FileState\n * diskio: inline IncrementalFileState type alias\n * Minimize API visibility\n * toolchain: streamline validate() implementations\n * toolchain: avoid internal cloning\n * dist: drop unused conversion impl\n * dist: keep impls with type definitions\n * Don't hide allocations inside From impls\n * toolchain: drop impls for \u0026String\n * Warn on clippy::or_fun_call\n * Warn on clippy::needless_by_ref_mut\n * Warn on clippy::redundant_clone\n * Warn on clippy::manual_let_else\n * Warn on clippy::use_self\n * errors: box ToolchainDesc in RustupError variants\n * errors: box Manifest in RequestedComponentsUnavailable variant\n * No (more) need to allow clippy::arc_with_non_send_sync\n * Replace use of FnMut trait objects with custom trait\n * test(cli/self-upd): use direct arg0 override for `as_rustup_setup()`\n * chore(deps): update actions/cache action to v6\n * ci(windows): add support for aarch64-pc-windows-gnullvm target\n * ci(windows): refine MSVC/MINGW job step predicates\n * chore(deps): update actions/checkout action to v7\n * fix(deps): update rust crate itertools to 0.15\n * fix(progress): use the `prefix` placeholder instead of `msg` for component name\n * rustup: warn when no toolchain or default is configured\n * errors: extract default stable hint\n * feat(toolchain): make the \"installed\" text of a toolchain install green\n * Add aarch64-unknown-freebsd\n * chore: address linter warnings\n * chore(deps): bump to semver-compatible versions\n * Add funding links\n * ci(docker/freebsd): bump `clang` version to `freebsd14`\n * ci(freebsd): use FreeBSD 14.0 for full CI\n * chore(deps): update `curl`\n * feat(cli/rustup-mode): warn about auto-installation in some subcommands\n * refactor(config): accept `Cfg` in `EnsureInstalled::warn_auto_install()`\n * test(cli/rustup-mode): test auto-installation on to-be-deprecated subcommand\n * dist: move display_name() before other methods that it calls\n * chore(gitignore): add .cargo/config.windows-cross.toml to gitignore\n * docs(dev-guide): update platform-specific code guidance\n * docs(dev-guide): mention rust-analyzer support for Windows-specific code on Unix\n * docs(dev-guide): mention how to lint Windows-specific code on Unix\n * chore(config): add example config for cross checking and rust-analyzer\n * chore: add rust-analyzer example config\n * Display the full names of targets not matching the host target tuple\n * docs(dev-guide/tips-and-tricks): mention the `RUSTUP_FORCE_ARG0='rustup'` cargo alias\n * build(cargo): add `cargo` alias for `RUSTUP_FORCE_ARG0='rustup'`\n * docs: rename the repath helper variable\n * Remove double buffering when extracting archives\n * refactor(toolchain/distributable): return `EnsureInstalled\u003c\u003e` from `DistributableToolchain::install()`\n * docs(dev-guide/coding-standards): adapt style guide from rustls\n * fix(deps): update opentelemetry\n * feat(config): warn user if auto-install is enabled\n * refactor(config): return `EnsureInstalled\u003c\u003e` from more functions\n * refactor(config): extract `EnsureInstalled\u003c\u003e` wrapper type\n * test: make tests agnostic to external `RUSTUP_AUTO_INSTALL` and `RUST_RECURSION_COUNT`\n * test(dist): fail v2 manifest update when manifest disagrees with .sha256\n * fix(dist): propagate v2 manifest checksum failure instead of reporting \"unchanged\"\n * Align shell setup comments in install message\n * feat(cli/self-update): refine wording of \"already installed Rust\" warning\n * chore(settings): rename default_host_triple to default_host_tuple and alias old name\n * chore(settings): add test to parse default_host_triple in toml\n * test(download): also scrub `HTTP_PROXY` in `scrub_env()`\n * chore: document legacy default host setting\n * chore: rename internal tuple constants\n * chore: rename partially \"Triple\" to \"Tuple\" to reflect the new terminology\n * fix(cli/rustup-mode)!: complete `rustup show` if active toolchain is not installed\n * refactor(cli/rustup-mode): postpone eval of `active_toolchain_targets` in `show()`\n * refactor(cli/rustup-mode): postpone eval of `active_toolchain` in `show()`\n * refactor(cli/rustup-mode): reduce rightward drift in `show()`\n * refactor(cli/rustup-mode): refine usage of `stdout` term and locks in `show()`\n * feat(config): add `Cfg` field to force-disable auto-installation\n * Provide --yes alias for -y flag consistently\n * refactor(tests): rename triple to tuple\n * refactor: bulk rename triple to ruple\n * refactor: rename get_default_host_triple to default_host_tuple\n * test(download): support more feature flag combinations\n * docs: fix the FileBuffer::clear doc comment wording\n * docs: fix plural of VM in coding standards\n * fix(dist): bulk rename triple to tuple for variables and messages\n * refactor(dist): rename PartialTargetTriple to PartialTargetTuple\n * refactor(dist): rename triple module to target_tuple\n * refactor: remove PartialToochainDesc::has_triple() in favor to PartialTargetTriple::is_empty()\n * refactor(dist): rename TargetTriple to TargetTuple\n * fix(self-update): rename triple to tuple in self_update\n * dist: bump `rustup` version to v1.29.1\n * ci(linux/x64-musl): install missing libc dependencies\n * fix(tests): rename HOST_TRIPLE placeholder to HOST_TUPLE\n * fix(tests): rename this_host_triple() to this_host_tuple()\n * fix(init): rename triple to tuple to reflect the new terminology\n * fix(docs): rename triple to tuple to reflect the new terminology\n * chore(deps): update ubuntu docker tag to v26\n * Improve error message for incomplete toolchains\n * chore(deps): update bwoodsend/setup-winlibs-action action to v1.16\n * test(dist/manifest): use the reordered fixture in `manifest_serialized_with_sorted_keys`\n * docs: fix \"initial\" spelling in stylesheet variable\n * ci: powerpc64-unknown-linux-musl is now stable\n * style(cli/rustup-mode): address clippy warnings\n * docs(dev-guide): update release process with new backporting flow\n * docs: fix actions template README typo\n * Only show post-install instructions for currently installed shells\n * docs: fix Windows MSVC guide typo\n * Upgrade to rustls-platform-verifier 0.7\n * Make component removal best-effort and preserve single-error behavior\n * Use `cc-rs` to detect the default linker, instead of assuming `cc`\n * ci(test): add `workflow_dispatch` trigger on par with `schedule`\n * ci: fix incorrect `contains()` predicate\n * fix(dist/manifestation): fix log format when installing exactly 2 components\n * Allow rustup component add to install multiple components in one update #4787\n * fix(docs): correct link to `no-self-update` feature\n * ci: enable on all PR target branches\n * ci(backport): rename backport branches to `release/*`\n * feat(toolchain): run a pre-check before updating all toolchains\n * feat(install): accept an optional pre-fetched manifest when installing\n * fix(toolchain): extract manifest fetching out of `show_dist_version()`\n * fix(manifest): aggregate a manifest and its hash in a `ManifestWithHash` struct\n * fix: Reduce flickering by using `set_move_cursor`\n * ci(backport): add support for backporting\n * fix: install message misalignment.\n * refactor: extracted `progress_style` method for DownloadStatus\n * fix(deps): update rust crate sha2 to 0.11\n * chore(doc): Added comments for clarify the usage of `Component::name` `Manifest::name` and the `short_name` funcc accordingly.\n * refactor: Rename `Component`'s `name_in_manifest` to `name` and `short_name` accordingly\n * self_update: show path to executable in case of updater failure\n * Revert \"fix(ci/freebsd): install ca certs to prevent certificate-related issues\"\n * ci: don't install protoc\n * Update to mdbook 0.5\n * ci(all-features): bump protoc version\n * fix(dist/manifestation): use full toolchain name in `Update::unavailable_components()`\n * style(dist/manifestation): merge imports\n * Fix zsh completion showing all PATH entries for +toolchain arg\n * fix(cli/proxy-mode): stop enforcing `quiet: true`\n * chore(deps/freebsd): downgrade `libz-sys` to v1.1.24\n * fix(ci/freebsd): install ca certs to prevent certificate-related issues\n * fix(rustup-init/sh): prevent passing `--default-host` twice\n * Avoid warning about the existence of a `settings.toml` on a fresh install\n * use tuple instead of triple for env overrides\n * Take platforms 3.9.0\n * Unpin tracing-subcriber\n * chore(deps): update `aws-lc-rs` and `aws-lc-sys`\n * docs(changelog): update release date for v1.29.0\n * docs(dev-guide/release-process): mention the CfT blog post\n * docs(changelog): update for v1.29.0 stable release\n * fix(cli): Style CLI errors in init mode\n * test: Add unknown arg init test\n * chore(deps): update actions/upload-artifact action to v7\n * refactor(www): simplify instruction css selector\n * feat(www): make copy button dark mode-aware\n * feat(www): move feedback text out of copy button\n * fix(www): apply filter to rust logo\n * feat(www): add dark mode\n * refactor(www): extract css variables\n * fix(cli/self-update): enforce a newline after `check_updates()`\n * refactor(cli/self-update): extract `has_progress_bars` in `check_updates()`\n * fix(cli/self-update): unify `check_*update*()`'s message formats\n * docs(downloads): fix the default number of `RUSTUP_CONCURRENT_DOWNLOADS`\n * feat(toolchain): add `--override` to override toolchain as soon as installed\n * fix(toolchain): improve logs when recovering from an interrupted installation\n * chore(deps): downgrade `openssl-src` to 300.5.4+3.5.4\n * style(download): clean up imports\n * fix(diskio): fall back to single-threaded unpacking when `ram_budget` \u003c 512MB to avoid OOM on memory-constrained systems\n * test(downloads): check if an error is thrown if the server does not honor range\n * fix(downloads): check correct response when resuming from partial (reqwest)\n * fix(downloads): check correct response when resuming from partial (curl)\n * fix(deps): update rust crate toml to v1\n * fix(dist/manifest): sort keys when serializing `Manifest`\n * hack(ci/linux): disable BuildKit when building local images\n * chore(ci): use more distinctive local image names\n * Upgrade rand to 0.10\n * Upgrade snapbox to 1\n * Upgrade to anstream 1\n * fix(downloads): adjust error message for partial files in network failures\n * test(downloads): ensure that partial files are not removed when network fails\n * feat(downloads): do not delete partial download when network fails\n * fix(downloads): substitute `DEK` alias for `DownloadError`\n * chore(deps): update aws-actions/configure-aws-credentials action to v6\n * cli: introduce semantic exit code constants for rustup check\n * Add missing Windows SDK instructions\n * Add winget instructions to MSVC install page\n * Remove nu-string-interpolation `$`\n * Replace $nu.home-path with ~\n * feat(cli/rustup-mode): add \"Exit status\" section to `rustup check --help`\n * Add common commands section in help text\n * fix(cli/rustup-mode): improve exit code of `rustup check`\n * refactor(test)!: pass status code directly to `SanitizedOutput`\n * Add powerpc64-unknown-linux-musl support\n * fix: add copy_file_symlink_to_source for self-installation\n * fix: preserve symlinks in copy_dir instead of following them\n * feat(cli/rustup-mode): add `doc --rustc-docs` to open rustdoc for Rust internals\n * Remove the mixed singular/plural phrasing as \"component(s)\" instead, use \"components\" or \"component\".\n In the singular case also add the name of the component for more consistent messaging style with\n other info! outputs about single components.\n * fix(cli/rustup-mode): `check` for self updates for `SelfUpdateMode::CheckOnly`\n * test: Add test for sequential multi-toolchain uninstall\n * fix: directory removal race condition in toolchain uninstall\n * test(cli_v2): test error when missing many components on install\n * fix(dist): adjust printed newlines in `components_missing_msg()`\n * unified nightly disclaimer wording/styling; preserved distinct messages per scenario\n * Upgrade to reqwest 0.13\n * change test name to match new terminology\n * rename file to match new terminology\n * change 'target triple' to 'target tuple'\n * fix(toolchain): forbid toolchain names starting with +\n * cli: add `doc --releases` to open release notes\n * chore(deps): update actions/upload-artifact action to v6\n * chore(deps): update actions/cache action to v5\n * dist: use more concise API in helper function\n * dist: inline more logic into helper function\n * dist: give helper function a more meaningful name\n * dist: move helper function closer to usage site\n * docs(dev-guide): mention snapshot updating in release process\n * fix(toolchain): avoid unwrapping when parsing a toolchain name\n * fix(toolchain): change regex to reject leading zeros in toolchain name\n * docs(changelog): update for v1.29.0 beta release\n * dist: bump `rustup` version to v1.29.0\n * docs(changelog): add missing link references\n * test(static-roots): use a more compact syntax for raw binaries\n * test(static-roots): return `Result` from `store_static_roots()`\n * download: statically bundle relevant trust anchors\n * Added xonsh support\n * refactor(dist/manifestation): remove redundant redeclarations\n * docs(dist/download): remove outdated note on concurrent download progress reporting\n * fix(dist/download): align `total_bytes` fields in progress reporting UI\n * fix: default to GNU host in Cygwin/MSYS/MinGW environments (#4221)\n * chore(config): remove redundant imports\n * fix(dist/manifestation): print \"downloading component\" only on `InstallEvents`\n * fix(utils): downgrade panic to warning in `delete_dir_contents_following_links()`\n * chore(deps): update actions/checkout action to v6\n * Prepare for mdbook 0.5 migration\n * dist: make installation asynchronous\n * dist: make installations 'static\n * dist: take ownership of Manifestation\n * dist: store owned temp::Context in Transaction\n * dist: store temp::Context in DownloadCfg\n * dist: align progress bar elements\n * dist: track progress during unpacking\n * utils: drop unused reader tracking\n * process: fix refresh rate for progress bars\n * process: reduce duplication in ProgressDrawTarget setup\n * Yield references from Manifest::short_name()\n * Move Component name helpers to Manifest\n * dist: simplify ComponentBinary construction\n * dist: hoist creation of io_executor some more\n * Move unpack_ram() from dist to diskio\n * dist: hoist Executor creation up\n * dist: inline effective RAM limit calculation\n * dist: hoist environment variable extraction\n * dist: use logging for missing parent warnings\n * dist: clarify dependency on unpack RAM budget\n * diskio: clarify dependency on I/O thread count\n * dist: transfer ownership of component values\n * dist: take ownership of existing Components\n * dist: take ownership of toolchain name in update()\n * dist: take ownership of manifest in update()\n * dist: derive trivial initialization for Update\n * dist: rename Update::build_update() to new()\n * dist: linearize for-loop in Update::build_update()\n * dist: inline single-use function\n * dist: inline trivial helper function\n * dist: inline single-use tranaction change helpers\n * dist: store specific config bit in Transaction\n * chore(config): migrate config .github/renovate.json\n * dist: attach manifest download functions to DownloadCfg\n * rustup: unhide top-level install/uninstall commands\n * dist: move update_from_dist() to DistOptions::install_into()\n * Be more consistent about aliases for different subcommands\n * test: add test for `rustup toolchain install --no-update`\n * feat(rustup-mode): add `no_update` flag to `rustup toolchain install`\n * cli: prepare DistOptions in advance\n * dist: inline trivial wrapper function\n * cli: inline single-use update_all_channels() helper\n * config: simplify update_all_channels()\n * dist: deduplicate DistOptions initialization\n * dist: avoid recomputing dist root URL\n * dist: simplify tracing instrumentation\n * install: take ownership in InstallMethod::install()\n * dist: move DistributableToolchain::install() up\n * dist: clarify when update_hash is available\n * cli: avoid dropped temporary\n * Take semver-compatible dependencies\n * dist: install while downloading\n * dist: store more context in ComponentBinary\n * dist: yield self when download is complete\n * dist: move URL alteration logic into DownloadCfg method\n * Apply suggestions from clippy 1.91\n * refactor(check): Consolidate use_colors checks\n * fix(check): Use Cargo's colors\n * refactor(check): Make calls more consistent\n * dist: drop another layer of abstraction\n * dist: store package directory once\n * dist: inline short single-use function\n * dist: discard unnecessary abstraction layer\n * chore(deps): update actions/upload-artifact action to v5\n * fix(cli/rustup-mode): add missing self-update in `rustup toolchain install`\n * refactor(cli/self-update): move `self_update()` to `SelfUpdateMode::update()`\n * refactor(cli/rustup-mode): pass self-update predicates into `self_update()`\n * refactor(cli/self-update): import `utils::ExitCode`\n * rustup: tweak update check output style\n * fix(list): Match show command's styling\n * test(list): Add UI test\n * fix(toolchain): Have 'list' match 'show's styling\n * refactor(toolchain): Order logic by display order\n * refactor(toolchain): Use string interpolation\n * test(toolchain): Show list's behavior\n * fix(update): Match 'cargo update's colors\n * refactor(update): Centralize style knowledge\n * test: Cover different show_channel_update cases\n * fix(check): Subject check to RUSTUP_TERM_COLOR\n * test(check): Show current style\n * fix: Use HEADER styling in 'rustup show'\n * chore: Update clap-cargo\n * test: Demonstrate show's behavior\n * test(process): Allow forcing color on\n * test(process): Ensure non-locked writes are stripped of ANSI escape codes\n * cli: update `uninstall_removes_source_from_rcs` to mirror `uninstall_doesnt_modify_rcs_with_no_modify_path`\n * cli: add tests for `rustup self uninstall --no-modify-path`\n * cli: add `rustup self uninstall --no-modify-path`\n * cli: add help text for `rustup self uninstall -y`\n * fix(cli/help): change indentation of discussions to 2 spaces\n * fix(cli/help): adjust help text for `rustup install`\n * feat(cli/help): add toolchain install tips to `rustup update`'s discussion\n * feat(cli/help): discuss `rustup toolchain install`\n * style: Remove wildcard imports\n * progress: modify progress bar's states to be column-aligned\n * installations: handle installation of components through progress bars\n * feat(cli): Add a sub-heading style for 'completion' Help Discussion\n * feat(cli): Have Help Discussions match rest of CLI Help\n * feat(cli): Add color to clap help/errors\n * refactor(cli): Switch help text to functions\n * cli: propagate ActiveSource from the top\n * cli: upgrade error events to ERROR level\n * cli: inline Cfg::active_rustc_version()\n * cli: extract display_version() from rustup main()\n * cli: inline Cfg::resolve_local_toolchain()\n * cli: inline Cfg::resolve_toolchain()\n * config: extract setting of toolchain override in rustup help mode\n * cli: avoid Cfg construction indirection\n * config: privatize some Cfg fields\n * config: drop trivial Cfg setters\n * Expand `RUSTUP_TOOLCHAIN_SOURCE`'s documentation\n * refactor(installation): extract installation of a component into a separate function\n * bin: clean up imports\n * cli: rename CLIError to CliError\n * config: rename OverrideDB to OverrideDb\n * dist: clean up unnecessary qualification\n * test: Replace trycmd with snapbox\n * chore: Update snapbox\n * Update the default Windows SDK version\n * refactor(log): Single source RUSTUP_TERM_COLOR\n * style: Encourage using existing imports\n * process: avoid fine-grained locking for logs\n * process: discard unnecessary layer of synchronization\n * process: inline TerminalInnerLocked\n * process: replace unsafe code with safe equivalent\n * process: extract color_choice() method\n * process: extract is_a_tty value\n * process: inline StreamSelector::is_a_tty()\n * process: inline TestWriterLock\n * Implement `RUSTUP_TOOLCHAIN_SOURCE` with new `Display` impl\n * Move `Display` impl to `to_reason()`\n * Rename `ActiveReason` to `ActiveSource`\n * dist: simplify DownloadStatus setup\n * dist: decentralize download status\n * dist: postpone creation of ComponentBinary values\n * dist: extract DownloadStatus type\n * dist: call DownloadTracker methods directly\n * dist: drop unnecessary Notifier layer\n * dist: replace PackageContext with DownloadCfg\n * refactor: Directly apply styling\n * refactor: Don't bother grabbing lock for tests\n * refactor: Replace termcolor with anstream\n * refactor: Move style building out of ColorableTerminal\n * refactor: Migrate to anstyle for color definitions\n * fix(www): removes www subdomain from all rust-lang.org urls\n * dist: move Notification into dist::download\n * notifications: remove unused Display impl\n * dist: move Notifier into DownloadCfg\n * cli: build Cfg earlier in setup mode\n * dist: reuse existing DownloadCfg in update_v1()\n * dist: move dist_root out of DownloadCfg\n * dist: drop unused Clone derives\n * dist: drop Copy derive from DownloadCfg\n * dist: move Notifier and DownloadTracker into dist::download\n * dist: inline DownloadCfg test setup\n * download: move File items down\n * download: extract DownloadCfg initialization from Cfg\n * config: discard pointless method argument\n * cli: rename DownloadTracker::new_with_display_progress() to new()\n * notifications: log directly from DownloadTracker\n * notifications: log directly on bad download checksums\n * notifications: log directly when reusing downloaded files\n * notifications: log directly on buffer size changes\n * Update platforms to 3.7.0\n * notifications: log directly on duplicate toolchain files\n * notifications: log directly on metadata upgrades that remove toolchains\n * notifications: log directly when reading metadata version\n * notifications: log directly when metadata upgrade is not needed\n * notifications: log directly when upgrading metadata version\n * notifications: log directly when uninstalling toolchains\n * notifications: log directly when toolchain is up to date\n * notifications: log directly when toolchain has been installed\n * notifications: log directly when installing toolchains\n * notifications: log the toolchain directory directly\n * notifications: log directly when using existing toolchains\n * notifications: log directly when looking for toolchains\n * notifications: log directly when setting auto-self-update mode\n * notifications: log directly when setting profile\n * notifications: log directly when setting overrides\n * notifications: use human-friendly log format for temp file deletions\n * notifications: use human-friendly log format for directory deletions\n * notifications: use human-friendly log format for retrying renames\n * notifications: use human-friendly log format for path canonicalization\n * cli: drop unnecessary generics\n * process: import instead of qualifying ColorableTerminal\n * process: hide internal structure\n * process: don't re-export external items\n * process: rename terminalsource to terminal_source\n * process: rename filesource to file_source\n * process: re-order items in terminalsource module\n * feat(cli/self-update): add support for PowerShell on Unix systems\n * refactor: Remove unused traits\n * refactor: Directly use ColorableTerminal\n * refactor: Simplify working with ColorableTerminal\n * fix(process): Ensure stdout/stderr lock is held across calls\n * refactor(process): Centralize Write bookkeeping\n * docs(changelog): describe default profile change during auto-install\n * Fix typo in clitools.rs comment\n * ci(docs): fix local doc branch name\n * Move the default branch from `master` to `main`\n * Upgrade opentelemetry dependencies\n * ci: use macOS Intel runners\n * notifications: log directly when setting the default toolchain\n * notifications: log directly when setting auto install mode\n * notifications: log directly when resuming partial downloads\n * notifications: log directly when downloading files\n * notifications: log directly when removing stray hash files\n * notifications: log directly when skipping components\n * notifications: log directly on missing components\n * notifications: log directly when downloading legacy manifests\n * notifications: log directly for downloaded manifests\n * notifications: log directly for manifest downloads\n * notifications: log directly when removing components\n * notifications: log directly when installing components\n * notifications: log directly after failing to determine memory limit\n * notifications: log directly when hash file not found\n * notifications: log directly when failing to update hash file\n * notifications: log directly when component is already installed\n * notifications: log directly for valid checksums\n * notifications: log directly when using download backends\n * chore: avoid trailing whitespace in error message\n * refactor: Switch logging to anstyle\n * refactor: Remove unused ColorableTerminal::carriage_return\n * notifications: privatize Notification type\n * notifications: log directly on creating temp files\n * notifications: log directly on temp root creation\n * notifications: log directly on file deletions\n * notifications: log directly on directory deletions\n * notifications: log directly about non-fatal errors\n * notifications: log directly about rolling back changes\n * notifications: log directly for retrying renames\n * notifications: log directly when removing directories\n * notifications: log directly when copying directories\n * notifications: log directly when linking directories\n * notifications: log directly when path canonicalization fails\n * notifications: log directly when creating directories\n * tests: use DistContext for dist::components tests\n * tests: move DistContext into library\n * tests: deduplicate distribution installation tests\n * notifications: tweak style\n * Inline utils Notification variants into top-level Notification\n * Inline dist Notification variants into top-level Notification\n * Inline dist::temp::Notification variants into top-level Notification\n * dist: remove temp::Notification variant from dist::Notification\n * dist: extract URL alteration from download() method\n * dist: detach download_component() from Manifestation\n * dist: introduce ComponentBinary type\n * dist: avoid passing through arguments\n * dist: avoid unnecessary type annotations\n * dist: avoid cloning components Vec\n * refactor: remove redundant references\n * dist: simpify casting to trait object\n * dist: deduplicate decompression setup code\n * cli: move more self update logic into self_update module\n * refactor(dist/manifestation): remove redundant `.to_string()`\n * Remove unneeded paranthesees\n * Fix link in the bug reporting template\n * ci(all-features/windows): update `OPENSSL_LIB_DIR` for OpenSSL v3 compatibility\n * docs(dev-guide): improve suggestion for overriding arg0\n * docs(dev-guide): mention the arg0 override trick on welcome page\n * docs(README): link CI status badge to GitHub Actions panel\n * feat(dist/manifestation): adjust default concurrent downloads when installing toolchains\n * feat(cli/rustup-mode): check updates for all channels unless `RUSTUP_CONCURRENT_DOWNLOADS` is set to 1\n * refactor: rename `num_channels` to `concurrent_downloads`\n * fix: fix hang by preventing `stream.buffered(0)` in concurrent downloads\n * test(dist/manifestation): extract `TestContext::*with_env()`\n * refactor(download): use `NonZero` instead of `NonZeroU64`\n * refactor(process): remove redundant `.context()` in `Process::concurrent_downloads()`\n * chore(deps/renovate): group version bumps for `windows-rs` crates\n * Upgrade windows crates\n * fix(cli/rustup_mode): use ASCII-compatible spinner\n * chore(deps): update aws-actions/configure-aws-credentials action to v5\n * feat(install): warn if default linker (cc) is missing; add respective test case\n * Remove hardcoded dependency to the master branch\n * feat(downloads): delay the reappearance of the progress bar when retrying a download\n * fix(downloads): correct faulty behavior when a download fails\n * fix(downloads): correct faulty output when retrying a download\n * feat(self_update): add tcsh shell support to cli #3413\n * Replace non_empty_env_var() with Process::var_opt()\n * fix(downloads): report real elapsed time of a component downloads instead of cumulative\n * Treat empty environment variables as unset\n * fix(downloads): honor the RUSTUP_CONCURRENT_DOWNLOADS by always having \"n\" concurrent downloads\n * chore(deps): disable default features for zstd\n * feat(downloads): introduce `RUSTUP_CONCURRENT_DOWNLOADS` to control concurrency\n * ci(check): make installation of `taplo-cli` faster\n * fix(notifications): delete unnecessary Download(Pop/Push)Unit notifications\n * fix(downloads): extract closure for downloading a component into a separate function\n * feat(downloads): concurrently download components\n * fix(downloads): add a comment to justify the unwrap on `.get()` of `OnceLock`\n * chore(deps): update actions/checkout action to v5\n * fix(download_timeout): introduce RUSTUP_DOWNLOAD_TIMEOUT for overriding download timeout\n * fix(downloads): substitute the LazyLock for a OnceLock\n * feat(rustup_mode): revise help message\n * feat: improve error message for `rustup which`\n * test: detach snapshots from component installation order\n * feat(download_tracker): refactor in favor of `indicatif`\n * feat(process): create a `ProgressDrawTarget` (for `indicatif`) inside the `Process`\n * fix(rustup-init/sh): avoid `hw.optional.*: 1` stdout in macOS arch check\n * hack(cli/common): suppress host emulation warnings in rustup's own CI\n * fix(test/clitools): pass `RUSTUP_CI` to in-process tests\n * ci(macos): run x64 workflows with Rosetta 2\n * docs(user-guide/environment-variables): clarify the unit of `RUSTUP_UNPACK_RAM`\n * docs(user-guide/environment-variables): unify description style\n * docs(user-guide/environment-variables): update description of `RUSTUP_IO_THREADS`\n * Limit Tokio worker threads to I/O thread count\n * Use manual Tokio runtime setup\n * Attach io_thread_count() to Process\n * Always consider RUSTUP_IO_THREADS as input for thread count\n * utils: express io_thread_count() in a simpler way\n * opt(err): show renaming file error source\n * Set a maximum thread limit for remove_dir_all\n * fix(toolchain/distributable): refine handling of known targets with no prebuilt artifacts\n * fix(ci/fetch-rust-docker): update comments\n * fix(ci/docker): update `CC` name for `powerpc64le-unknown-linux-gnu`\n * Extract self_update() from update_all_channels()\n * Show channel updates even if self update is not permitted\n * Remove Cargo feature indirection\n * Move Cfg::get_self_update_mode() to SelfUpdateMode::from_cfg()\n * Replace trivial enum with bool\n * feat(updates): introduce `RUSTUP_TERM_WIDTH` to override terminal width\n * feat(updates): introduce `RUSTUP_TERM_PROGRESS_WHEN` to toggle the progress bars\n * Limit the default number of I/O threads\n * Bump `toml` to 0.9\n * feat(updates): check for updates concurrently\n * feat(terminal): implement the `TermLike` trait for `ColorableTerminal`\n * chore: use match ergonomics in favor of explicit `ref`s\n * refactor(download/curl): use early returns in `download()`\n * chore(cli/rustup_mode): merge `std` imports\n * chore(cli/rustup-mode): import `std::io`\n * chore: fix new `clippy` warnings\n * fix(ci/run): specify target triple for `bindgen-cli` installation\n * feat(www): improve \"copy\" button style compatibility with Chromium\n * ci(run): install `codegen-cli` with `cargo-binstall`\n * docs: replace Discord links\n * Block broken snap curl\n * Upgrade to windows-sys 0.60\n * Emphasize that `llvm-tools` dist component is not subject to compiler stability guarantees\n * docs(README): update CI status badge\n * Fix rustup-init.sh cputype check for sparcv9\n * add Solaris support\n * test(clitools)!: remove all deprecated `.expect_*()` APIs\n * test(clitools)!: privatize `Config::run()`\n * test: migrate remaining uses of `.run()` to `.expect()` APIs\n * test(clitools): extract `Assert::redact()`\n * test: simplify `.display().to_string()` in `.extend_redactions()`\n * test(cli_misc): bring back missing assertions\n * Update help.rs: bash completions instructions (#1)\n * docs(user-guide): fix typo\n * docs(dev-guide): update the section on `clippy` lints\n * docs(dev-guide): mention test helpers and `Assert`\n * docs(test/clitools): add docs for `Assert`\n * Upgrade to rustls-platform-verifier 0.6\n * test(cli-v2): migrate to `.expect()` APIs\n * test(cli-misc): migrate to `.expect()` APIs\n * fix(toolchain): fix proxy fallback notification format on Windows\n * test(cli-v1): migrate to `.expect()` APIs\n * test(download): serialize tests with proxy-sensitive URLs\n * test(cli-rustup): migrate to `.expect()` APIs\n * test(clitool): add `Assert::remove_redactions()`\n * test(clitools): allow `OsStr`-like args in `Config::expect*()`\n * Fix CI image names for downloading ARM and PowerPC artifacts\n * Update platforms to 3.6\n * test(cli-exact): migrate to `.expect()` APIs\n * Avoid swallowing errors in show()\n * Simplify target processing logic\n * Inline returned bindings\n * Increase Windows main thread stack size to 2mb\n * test(cli-inst-interactive): migrate to `.expect()` APIs\n * Unset RUSTUP_AUTO_INSTALL for tests\n * test(cli-paths): migrate to `.expect()` APIs\n * test(cli-exact): use the new `[CURRENT_VERSION]` redaction\n * test(cli-self-upd): migrate to `.expect()` APIs\n * Tweak list_items() docstring\n * Leverage bool::then_some() to simplify some code\n * Avoid intermediate allocation in listing\n * test(custom-toolchains): `target list` now can display the installed targets\n * feat(custom-toolchains): `target` and `component list` working on custom toolchains\n * Skip manifest loading if there are no components/targets to check\n * fix(deps): update rust crate opener to 0.8.0\n * rustup check: set exit status based on available updates\n * rustup check: adopt no-self-update logic\n * feat(self_update): add proxy sanity checks\n * style(test): qualify uses of `snapbox::str![]`\n * refactor(test): migrate some tests to `.expect()` APIs\n * chore(test): deprecated old APIs overlapping with the new ones\n * refactor(test): add new `.expect()`-based testing APIs\n * test(custom-toolchains): using `show` on a custom toolchain without a `components` file\n * test(custom-toolchains): add test to showcase that the issue was solved\n * feat(custom-toolchains): `rustup show` now reporting installed targets\n * tests: print diffs on test failures\n * Log versions during self updates\n * Fix cargo lints on Windows\n * toolchain: hoist binary name conditionals out of fallback functions\n * refactor(test): replace `TempDir::into_path()` with `TempDir::keep()`\n * refactor(test/clitools): use globally-defined `tempdir_in_with_prefix()`\n * feat(toolchain): notify the user when proxy fallback is activated\n * feat(toolchain): consider external `rust-analyzer` when calling a proxy\n * refactor(toolchain): move predicates into `Toolchain::maybe_do_cargo_fallback()`\n * refactor(toolchain): privatize `Toolchain::maybe_do_cargo_fallback()`\n * deps: update aws-lc-rs to 1.13.1\n * docs(changelog): mirror changes from the release announcement, take 2\n * Deprecate native-tls as well\n * Enable HTTP/2 support for reqwest download backend\n * Emit tracing events from log facade calls\n * download: show Debug representation for errors\n * Avoid repeated globals in tracing events\n * Log original download errors immediately\n * feat(cli/rustup-mode): add aliases to `rustup component remove`\n * Switch flate2 to use the zlib-rs backend\n * Hardlink proxies if symlinks aren't reachable\n * Add powerpc64le-unknown-linux-musl support\n * Add toolchain_name to not installed bail msg\n * Warn about using curl\n * Drop workspace indirection\n * Fold download crate back into rustup\n * download: merge integration test files\n * Test CARGO environment replacement\n * Update CARGO env var if it is a rustup proxy\n * Tweak toolchain subcommand help text\n * Move toolchain and default commands first\n * show toolchain paths in rustup show -v output\n * refactor(cli/self-update): save allocations in `Nu::rcfiles()`\n * fix(cli/self-update)!: stop appending to `env.nu` due to deprecation\n * fix(cli/self-update): consider Windows paths in Nushell suggestions\n * refactor(cli/self-update): use `path add` in `env.nu` template\n * fix(cli/self-update): use interpolated string in `env.nu` template\n * Upgrade dependencies\n * docs(user-guide/environment-variables): document `RUSTUP_VERSION`\n * feat(rustup-init/sh): allow setting `RUSTUP_VERSION` during installation\n * feat(cli/self-update): allow setting `RUSTUP_VERSION` for arbitrary\n downgrades\n * feat(test/clitools): add `Config::expect_ok_ex_env()`\n * fix(errors)!: improve error messages for `RustupError::ToolchainNotInstalled`\n * Add set auto-install disable\n * Use `cursor: pointer` for copy button on website\n * fix(dist): refine suggestions about missing targets\n * Append Windows bin directory to PATH by default\n * Remove validation for custom toolchains when reading rust-toolchain.toml\n * document RUSTUP_AUTO_INSTALL\n * Fix build script `cargo` instructions\n","status":"published","published":"2026-10-02T19:31:21Z","modified":"2026-10-03T17:00:03.791677441Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"RUSTSEC-2026-0473","title":"Buffer overflow in `Deriver::derive` and `PkeyCtxRef::derive` with OpenSSL 1.1.x","description":"`Deriver::derive` and `PkeyCtxRef::derive` pass the length of the caller's buffer to `EVP_PKEY_derive` and rely on OpenSSL to write no more than that. With OpenSSL 1.1.x, the X25519, X448 and HKDF-extract implementations ignore the length they are given and always write the whole result, so a buffer shorter than the shared secret or derived key is overrun. The overflow is reachable from safe code.\n\nOpenSSL 3.x checks the length itself and is not affected. From 0.10.78, when built against OpenSSL 1.1.x or LibreSSL, both functions derive into a temporary buffer of the required size whenever the caller's buffer is too short, and copy only what fits.","status":"published","published":"2026-04-19T12:00:00Z","modified":"2026-11-10T14:00:02.488005222Z","updated_at":"2026-11-10T14:31:49.124773Z"},{"id":"SUSE-SU-2026:22554-1","title":"Security update for rust-keylime","description":"This update for rust-keylime fixes the following issues:\n\nUpdate to version 0.2.9+49.\n\nSecurity issues fixed:\n\n- CVE-2026-41676: openssl: `Deriver:derive` and `PkeyCtxRef:derive` can overflow short buffers on OpenSSL 1.1.1\n (bsc#1270174).\n- CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length\n (bsc#1270614).\n- CVE-2026-41678: openssl: out-of-bounds write due to incorrect bounds assertion in `aes::unwrap_key()` (bsc#1270699).\n- CVE-2026-41681: openssl: `MdCtxRef::digest_final()` writes past caller buffer with no length check (bsc#1270792).\n- CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent\n memory to the network (bsc#1270842).\n- CVE-2026-42327: openssl: undefined behavior in `X509Ref::ocsp_responders` for certificates with non-UTF-8 OCSP URLs\n (bsc#1270523).\n- CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding due to incorrectly sized\n output buffers (bsc#1270903).\n- CVE-2026-45784: openssl: out-of-bounds write in `CipherCtxRef::cipher_update_inplace` for AES-KW-PAD ciphers due to\n incorrectly sized output buffer (bsc#1270999).\n\nOther updates and bugfixes:\n\n- Update openssl to 0.10.81.\n- Make tss-esai-sys depend on bindgen 72.1 to support llvm \u003e 21.\n- Build with Clang \u003c= 21 (bsc#1260596).\n- Version 0.2.9+49:\n * build(deps): bump uuid from 1.23.3 to 1.23.4\n * build(deps): bump syn from 2.0.117 to 2.0.118\n * build(deps): bump openssl from 0.10.80 to 0.10.81\n * build(deps): bump rand from 0.9.4 to 0.10.1\n * Added new regression test into packit-ci.yaml\n * build(deps): bump actions/checkout from 6 to 7\n * build(deps): bump uuid from 1.23.1 to 1.23.3\n * build(deps): bump log from 0.4.29 to 0.4.32\n * build(deps): bump http from 1.4.0 to 1.4.2\n * build(deps): bump codecov/codecov-action from 6 to 7\n * build(deps): bump retry-policies from 0.5.1 to 0.5.2\n * fix: Remove unused base64::Engine import in context_info tests\n * build(deps): bump reqwest-middleware from 0.5.1 to 0.5.2\n * build(deps): bump serde_json from 1.0.149 to 1.0.150\n * build(deps): bump openssl from 0.10.79 to 0.10.80\n * agent: Hash agent ID before TPM2_Certify qualifying data\n * cargo: Bump tss-esapi, picky-asn1-x509, and picky-asn1-der\n * build(deps): bump openssl from 0.10.78 to 0.10.79\n * build(deps): bump once_cell from 1.21.3 to 1.21.4\n * build(deps): bump tempfile from 3.23.0 to 3.27.0\n * push-model: cache UEFI event log bytes at startup\n * build(deps): bump quote from 1.0.40 to 1.0.45\n * build(deps): bump chrono from 0.4.42 to 0.4.44\n * build(deps): bump openssl from 0.10.73 to 0.10.78\n * build(deps): bump serde_json from 1.0.143 to 1.0.149\n * build(deps): bump syn from 2.0.106 to 2.0.117\n * build(deps): bump libc from 0.2.175 to 0.2.184\n * build(deps): bump rand from 0.9.2 to 0.9.4\n- Version 0.2.9+21:\n * tests: use Express-style named params in Mockoon endpoints\n * build(deps): bump pest_derive from 2.8.1 to 2.8.6\n * build(deps): bump trybuild from 1.0.110 to 1.0.115\n * build(deps): bump log from 0.4.28 to 0.4.29\n * build(deps): bump uuid from 1.19.0 to 1.20.0\n * build(deps): bump codecov/codecov-action from 5 to 6\n * build(deps): bump tracing-subscriber from 0.3.20 to 0.3.23\n * build(deps): bump cfg-if from 1.0.3 to 1.0.4\n * build(deps): bump tokio from 1.49.0 to 1.50.0\n * build(deps): bump actix-web from 4.12.1 to 4.13.0\n * build(deps): bump anyhow from 1.0.99 to 1.0.102\n * build(deps): bump clap from 4.5.57 to 4.5.60\n * build(deps): bump tracing from 0.1.36 to 0.1.44\n","status":"published","published":"2026-07-09T09:05:32Z","modified":"2026-07-14T18:24:37.552767259Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:22574-1","title":"Security update for clamav","description":"This update for clamav fixes the following issues:\n\nUpdate to version 1.5.3.\n\nSecurity issues fixed:\n\n- CVE-2026-20213: out-of-bounds write due to improper boundary checks for content in PE files during scanning\n (bsc#1270107).\n- CVE-2026-20214: out-of-bounds write due to improper boundary checks for content in FSG files during scanning\n (bsc#1270085).\n- CVE-2026-20215: out-of-bounds write due to improper boundary checks for content in 7z files during scanning\n (bsc#1270088).\n- CVE-2026-20216: denial of service due to improper handling of temporary resources during InstallShield file scanning\n (bsc#1270089).\n- CVE-2026-20217: out-of-bounds write due to improper boundary checks for content in PESpin files during scanning\n (bsc#1270091).\n- CVE-2026-20243: out-of-bounds write due to improper boundary checks for content in ALZ files during scanning\n (bsc#1270092).\n- CVE-2026-20244: integer overflow and DoS due to improper boundary checks for content in DMG files during scanning\n (bsc#1270106).\n- CVE-2026-41676: buffer overflow due to missing checks via `Deriver:derive`, `PkeyCtxRef:derive` and OpenSSL 1.1.1\n (bsc#1270138).\n\nOther updates and bugfixes:\n\n- Version 1.5.3:\n * Fixed a bug in the PESpin unpacker cleanup path that could free pointers into the scanned file buffer and crash the\n scanner.\n * Fixed an integer overflow in PE rebuild size calculations that could be reached through a malformed Aspack-packed PE\n file and lead to a heap buffer overflow write.\n * Fixed an InstallShield archive extraction limit bypass that could write far more temporary data than intended and\n exhaust temporary storage.\n * Fixed an FSG unpacker loop underflow that could write past the section array while scanning a malformed PE file.\n * Fixed ALZ parser size handling bugs that could cause malformed ALZ archives to panic, abort the scanner, or skip\n expected scan-limit handling.\n * Fixed a 7z parser substream count overflow that could under-allocate parser metadata arrays and write past them\n while reading a malformed archive.\n * Fixed 32-bit DMG parser size checks that could let a short mish stripe table pass validation and crash 32-bit\n scanner builds.\n * Hardened clamscan, clamdscan, and clamonacc quarantine actions against time-of-check/time-of-use races that could\n redirect copied, moved, or removed files under unsafe quarantine directory configurations.\n * Upgraded the Rust tar dependency to resolve the RUSTSEC-2026-0067 and RUSTSEC-2026-0068 advisories, and upgraded the\n Rust openssl dependency to resolve CVE-2026-41676.\n * Raised the minimum required CMake version to 3.17 to fix Linux builds with libcurl v8.21.0 when linking static\n library dependencies.\n * Metadata preclass scans now run before the final scan verdict.\n * ClamOnAcc: Fixed errors when recursively excluded paths are children of an included path.\n * ClamOnAcc: Fixed hash bucket list corruption when two watched paths collide in the same bucket.\n","status":"published","published":"2026-07-07T16:57:40Z","modified":"2026-07-15T18:24:12.330896901Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:22583-1","title":"Security update for rust-keylime","description":"This update for rust-keylime fixes the following issues:\n\nUpdate to version 0.2.9+49.\n\nSecurity issues fixed:\n\n- CVE-2026-41676: openssl: `Deriver:derive` and `PkeyCtxRef:derive` can overflow short buffers on OpenSSL 1.1.1\n (bsc#1270174).\n- CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length\n (bsc#1270614).\n- CVE-2026-41678: openssl: out-of-bounds write due to incorrect bounds assertion in `aes::unwrap_key()` (bsc#1270699).\n- CVE-2026-41681: openssl: `MdCtxRef::digest_final()` writes past caller buffer with no length check (bsc#1270792).\n- CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent\n memory to the network (bsc#1270842).\n- CVE-2026-42327: openssl: undefined behavior in `X509Ref::ocsp_responders` for certificates with non-UTF-8 OCSP URLs\n (bsc#1270523).\n- CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding due to incorrectly sized\n output buffers (bsc#1270903).\n- CVE-2026-45784: openssl: out-of-bounds write in `CipherCtxRef::cipher_update_inplace` for AES-KW-PAD ciphers due to\n incorrectly sized output buffer (bsc#1270999).\n\nOther updates and bugfixes:\n\n- Update openssl to 0.10.81.\n- Make tss-esai-sys depend on bindgen 72.1 to support llvm \u003e 21.\n- Build with Clang \u003c= 21 (bsc#1260596).\n- Version 0.2.9+49:\n * build(deps): bump uuid from 1.23.3 to 1.23.4\n * build(deps): bump syn from 2.0.117 to 2.0.118\n * build(deps): bump openssl from 0.10.80 to 0.10.81\n * build(deps): bump rand from 0.9.4 to 0.10.1\n * Added new regression test into packit-ci.yaml\n * build(deps): bump actions/checkout from 6 to 7\n * build(deps): bump uuid from 1.23.1 to 1.23.3\n * build(deps): bump log from 0.4.29 to 0.4.32\n * build(deps): bump http from 1.4.0 to 1.4.2\n * build(deps): bump codecov/codecov-action from 6 to 7\n * build(deps): bump retry-policies from 0.5.1 to 0.5.2\n * fix: Remove unused base64::Engine import in context_info tests\n * build(deps): bump reqwest-middleware from 0.5.1 to 0.5.2\n * build(deps): bump serde_json from 1.0.149 to 1.0.150\n * build(deps): bump openssl from 0.10.79 to 0.10.80\n * agent: Hash agent ID before TPM2_Certify qualifying data\n * cargo: Bump tss-esapi, picky-asn1-x509, and picky-asn1-der\n * build(deps): bump openssl from 0.10.78 to 0.10.79\n * build(deps): bump once_cell from 1.21.3 to 1.21.4\n * build(deps): bump tempfile from 3.23.0 to 3.27.0\n * push-model: cache UEFI event log bytes at startup\n * build(deps): bump quote from 1.0.40 to 1.0.45\n * build(deps): bump chrono from 0.4.42 to 0.4.44\n * build(deps): bump openssl from 0.10.73 to 0.10.78\n * build(deps): bump serde_json from 1.0.143 to 1.0.149\n * build(deps): bump syn from 2.0.106 to 2.0.117\n * build(deps): bump libc from 0.2.175 to 0.2.184\n * build(deps): bump rand from 0.9.2 to 0.9.4\n- Version 0.2.9+21:\n * tests: use Express-style named params in Mockoon endpoints\n * build(deps): bump pest_derive from 2.8.1 to 2.8.6\n * build(deps): bump trybuild from 1.0.110 to 1.0.115\n * build(deps): bump log from 0.4.28 to 0.4.29\n * build(deps): bump uuid from 1.19.0 to 1.20.0\n * build(deps): bump codecov/codecov-action from 5 to 6\n * build(deps): bump tracing-subscriber from 0.3.20 to 0.3.23\n * build(deps): bump cfg-if from 1.0.3 to 1.0.4\n * build(deps): bump tokio from 1.49.0 to 1.50.0\n * build(deps): bump actix-web from 4.12.1 to 4.13.0\n * build(deps): bump anyhow from 1.0.99 to 1.0.102\n * build(deps): bump clap from 4.5.57 to 4.5.60\n * build(deps): bump tracing from 0.1.36 to 0.1.44\n","status":"published","published":"2026-07-09T09:05:32Z","modified":"2026-07-15T18:24:12.640797837Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:22589-1","title":"Security update for python-maturin","description":"This update for python-maturin fixes the following issues\n\n- CVE-2026-41676: openssl: `Deriver:derive` and `PkeyCtxRef:derive` can overflow short buffers on OpenSSL 1.1.1\n (bsc#1270208).\n- CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length\n (bsc#1270620).\n- CVE-2026-41678: openssl: out-of-bounds write due to incorrect bounds assertion in `aes::unwrap_key()` (bsc#1270706).\n- CVE-2026-41681: openssl: `MdCtxRef::digest_final()` writes past caller buffer with no length check (bsc#1270772).\n- CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent\n memory to the network (bsc#1270801).\n- CVE-2026-42327: openssl: undefined behavior in `X509Ref::ocsp_responders` for certificates with non-UTF-8 OCSP URLs\n (bsc#1270515).\n- CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding due to incorrectly sized\n output buffers (bsc#1270936).\n- CVE-2026-45784: openssl: out-of-bounds write in `CipherCtxRef::cipher_update_inplace` for AES-KW-PAD ciphers due to\n incorrectly sized output buffer (bsc#1270994).\n","status":"published","published":"2026-07-10T08:43:40Z","modified":"2026-07-16T18:24:37.756785448Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:22593-1","title":"Security update for python-cryptography","description":"This update for python-cryptography fixes the following issues\n\n- CVE-2026-41676: openssl: `Deriver:derive` and `PkeyCtxRef:derive` can overflow short buffers on OpenSSL 1.1.1\n (bsc#1270208).\n- CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length\n (bsc#1270620).\n- CVE-2026-41678: openssl: out-of-bounds write due to incorrect bounds assertion in `aes::unwrap_key()` (bsc#1270706).\n- CVE-2026-41681: openssl: `MdCtxRef::digest_final()` writes past caller buffer with no length check (bsc#1270772).\n- CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent\n memory to the network (bsc#1270801).\n- CVE-2026-42327: openssl: undefined behavior in `X509Ref::ocsp_responders` for certificates with non-UTF-8 OCSP URLs\n (bsc#1270515).\n- CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding due to incorrectly sized\n output buffers (bsc#1270936).\n- CVE-2026-45784: openssl: out-of-bounds write in `CipherCtxRef::cipher_update_inplace` for AES-KW-PAD ciphers due to\n incorrectly sized output buffer (bsc#1270994).\n","status":"published","published":"2026-07-10T09:16:28Z","modified":"2026-07-16T18:24:37.892457557Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:22615-1","title":"Security update for python-maturin","description":"This update for python-maturin fixes the following issues\n\n- CVE-2026-41676: openssl: `Deriver:derive` and `PkeyCtxRef:derive` can overflow short buffers on OpenSSL 1.1.1\n (bsc#1270208).\n- CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length\n (bsc#1270620).\n- CVE-2026-41678: openssl: out-of-bounds write due to incorrect bounds assertion in `aes::unwrap_key()` (bsc#1270706).\n- CVE-2026-41681: openssl: `MdCtxRef::digest_final()` writes past caller buffer with no length check (bsc#1270772).\n- CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent\n memory to the network (bsc#1270801).\n- CVE-2026-42327: openssl: undefined behavior in `X509Ref::ocsp_responders` for certificates with non-UTF-8 OCSP URLs\n (bsc#1270515).\n- CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding due to incorrectly sized\n output buffers (bsc#1270936).\n- CVE-2026-45784: openssl: out-of-bounds write in `CipherCtxRef::cipher_update_inplace` for AES-KW-PAD ciphers due to\n incorrectly sized output buffer (bsc#1270994).\n","status":"published","published":"2026-07-10T08:43:40Z","modified":"2026-07-17T18:24:02.333900641Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:22624-1","title":"Security update for python-cryptography","description":"This update for python-cryptography fixes the following issues\n\n- CVE-2026-41676: openssl: `Deriver:derive` and `PkeyCtxRef:derive` can overflow short buffers on OpenSSL 1.1.1\n (bsc#1270208).\n- CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length\n (bsc#1270620).\n- CVE-2026-41678: openssl: out-of-bounds write due to incorrect bounds assertion in `aes::unwrap_key()` (bsc#1270706).\n- CVE-2026-41681: openssl: `MdCtxRef::digest_final()` writes past caller buffer with no length check (bsc#1270772).\n- CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent\n memory to the network (bsc#1270801).\n- CVE-2026-42327: openssl: undefined behavior in `X509Ref::ocsp_responders` for certificates with non-UTF-8 OCSP URLs\n (bsc#1270515).\n- CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding due to incorrectly sized\n output buffers (bsc#1270936).\n- CVE-2026-45784: openssl: out-of-bounds write in `CipherCtxRef::cipher_update_inplace` for AES-KW-PAD ciphers due to\n incorrectly sized output buffer (bsc#1270994).\n","status":"published","published":"2026-07-10T09:16:28Z","modified":"2026-07-17T18:24:02.647809394Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:22737-1","title":"Security update for s390-tools","description":"This update for s390-tools fixes the following issue\n\n- CVE-2026-41676: openssl: `Deriver:derive` and `PkeyCtxRef:derive` can overflow short buffers on OpenSSL 1.1.1\n (bsc#1270185).\n","status":"published","published":"2026-07-09T07:32:43Z","modified":"2026-07-22T18:25:10.562649079Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:22787-1","title":"Security update for afterburn","description":"This update for afterburn fixes the following issues:\n\nUpdate to version 5.10.0.git73.b97f772.\n\nSecurity issues fixed:\n\n- CVE-2026-41676: openssl: `Deriver:derive` and `PkeyCtxRef:derive` can overflow short buffers on OpenSSL 1.1.1\n (bsc#1270175).\n- CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length\n (bsc#1270555).\n- CVE-2026-41678: openssl: incorrect bounds assertion in `aes::unwrap_key()` can lead to OOB write (bsc#1270651).\n- CVE-2026-41681: openssl: `MdCtxRef::digest_final()` writes past caller buffer with no length check (bsc#1270787).\n- CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent\n memory to network peers (bsc#1270817).\n- CVE-2026-42327: openssl: undefined behavior in `X509Ref::ocsp_responders` when processing certificates with non-UTF-8\n OCSP URLs (bsc#1270483).\n- CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding (bsc#1270886).\n- CVE-2026-45784: openssl: out-of-bounds write in `CipherCtxRef::cipher_update_inplace` for AES-KW-PAD ciphers\n (bsc#1270949).\n- CVE-2026-25541: bytes: integer overflow in `BytesMut:reserve` can lead to undefined behavior and crashes\n (bsc#1271348).\n\nOther updates and bugfixes:\n\n- Version 5.10.0.git73.b97f772:\n * build(deps): bump anyhow from 1.0.99 to 1.0.103\n https://github.com/coreos/afterburn/pull/1284\n * build(deps): bump libflate from 2.1.0 to 2.2.2\n https://github.com/coreos/afterburn/pull/1283\n * build(deps): bump openssl from 0.10.79 to 0.10.80\n https://github.com/coreos/afterburn/pull/1277\n- Version 5.10.0.git70.9cc2a7b:\n * build(deps): bump openssl from 0.10.78 to 0.10.79\n * providers/hetzner: Add the HETZNER_PUBLIC_IPV6 attribute\n * providers/hetzner: Add support for network configuration\n * build(deps): bump rustls-webpki from 0.103.10 to 0.103.13\n * build(deps): bump openssl from 0.10.73 to 0.10.78\n * docs: Add AGENTS.md and CLAUDE.md for AI coding assistants\n * build(deps): bump rand from 0.9.2 to 0.9.4\n * opencode: add skills for provider scaffolding and release automation\n * ibmcloud-classic: Add missing network_id to fixture\n * kubevirt: Support static gateway and DNS with DHCP\n * build(deps): bump rustls-webpki from 0.103.6 to 0.103.10\n * fix(proxmoxve): Define DNS entries for every interface\n * Makefile: download `90-afterburn-authorized-keys-file.conf` for rpm building\n * Sync repo templates âš™\n * build(deps): bump bytes from 1.10.1 to 1.11.1\n * util/dhcp: Fix clippy lints\n * build(deps): bump actions/checkout from 4 to 6\n * build(deps): bump actions/upload-artifact from 4 to 5\n * kubevirt: modprobe for virtio_blk; remove dracut preload\n * kubevirt: Add NoCloud network configuration support\n * kubevirt: Support config drive network data\n * kubevirt: Refactor the provider to follow the proxmoxve structure\n * dracut: Add virtio_blk module preload to afterburn-network-kargs service\n * docs: Add release notes\n * cargo: Afterburn release 5.10.0\n- Version 5.10.0:\n * docs/release-notes: update for release 5.10.0\n * cargo: update dependencies\n * microsoft/azure: Add XML attribute alias for serde-xml-rs Fedora compat\n * docs/release-notes: Add entry for Azure SharedConfig XML parsing fix\n * microsoft/azure: Fix SharedConfig parsing of XML attributes\n * microsoft/azure: Mock goalstate.SharedConfig output in tests\n * providers/azure: switch SSH key retrieval from certs endpoint to IMDS\n * build(deps): bump the build group with 8 updates\n * build(deps): bump slab from 0.4.10 to 0.4.11\n * build(deps): bump actions/checkout from 4 to 5\n * upcloud: implement UpCloud provider\n * build(deps): bump the build group with 4 updates\n","status":"published","published":"2026-07-20T09:31:31Z","modified":"2026-07-23T18:24:26.727780833Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:22801-1","title":"Security update for python-cryptography","description":"This update for python-cryptography fixes the following issues\n\n- CVE-2026-41676: openssl: `Deriver:derive` and `PkeyCtxRef:derive` can overflow short buffers on OpenSSL 1.1.1\n (bsc#1270208).\n- CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length in rust-\n openssl crate (bsc#1270620).\n- CVE-2026-41678: openssl: incorrect bounds assertion in aes key wrap in rust-openssl crate (bsc#1270706).\n- CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check in rust-openssl crate\n (bsc#1270772).\n- CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent\n memory in rust-openssl crate (bsc#1270801).\n- CVE-2026-42327: openssl: arbitrary code execution via specially crafted certificate in rust-openssl crate\n (bsc#1270515).\n- CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding in rust-openssl crate\n (bsc#1270936).\n- CVE-2026-45784: openssl: out-of-bounds write in `CipherCtxRef::cipher_update_inplace` for AES-KW-PAD ciphers in rust-\n openssl crate (bsc#1270994).\n","status":"published","published":"2026-07-20T10:13:27Z","modified":"2026-07-28T18:24:06.433268332Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:22827-1","title":"Security update for afterburn","description":"This update for afterburn fixes the following issues:\n\nUpdate to version 5.10.0.git73.b97f772.\n\nSecurity issues fixed:\n\n- CVE-2026-41676: openssl: `Deriver:derive` and `PkeyCtxRef:derive` can overflow short buffers on OpenSSL 1.1.1\n (bsc#1270175).\n- CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length\n (bsc#1270555).\n- CVE-2026-41678: openssl: incorrect bounds assertion in `aes::unwrap_key()` can lead to OOB write (bsc#1270651).\n- CVE-2026-41681: openssl: `MdCtxRef::digest_final()` writes past caller buffer with no length check (bsc#1270787).\n- CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent\n memory to network peers (bsc#1270817).\n- CVE-2026-42327: openssl: undefined behavior in `X509Ref::ocsp_responders` when processing certificates with non-UTF-8\n OCSP URLs (bsc#1270483).\n- CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding (bsc#1270886).\n- CVE-2026-45784: openssl: out-of-bounds write in `CipherCtxRef::cipher_update_inplace` for AES-KW-PAD ciphers\n (bsc#1270949).\n- CVE-2026-25541: bytes: integer overflow in `BytesMut:reserve` can lead to undefined behavior and crashes\n (bsc#1271348).\n\nOther updates and bugfixes:\n\n- Version 5.10.0.git73.b97f772:\n * build(deps): bump anyhow from 1.0.99 to 1.0.103\n https://github.com/coreos/afterburn/pull/1284\n * build(deps): bump libflate from 2.1.0 to 2.2.2\n https://github.com/coreos/afterburn/pull/1283\n * build(deps): bump openssl from 0.10.79 to 0.10.80\n https://github.com/coreos/afterburn/pull/1277\n- Version 5.10.0.git70.9cc2a7b:\n * build(deps): bump openssl from 0.10.78 to 0.10.79\n * providers/hetzner: Add the HETZNER_PUBLIC_IPV6 attribute\n * providers/hetzner: Add support for network configuration\n * build(deps): bump rustls-webpki from 0.103.10 to 0.103.13\n * build(deps): bump openssl from 0.10.73 to 0.10.78\n * docs: Add AGENTS.md and CLAUDE.md for AI coding assistants\n * build(deps): bump rand from 0.9.2 to 0.9.4\n * opencode: add skills for provider scaffolding and release automation\n * ibmcloud-classic: Add missing network_id to fixture\n * kubevirt: Support static gateway and DNS with DHCP\n * build(deps): bump rustls-webpki from 0.103.6 to 0.103.10\n * fix(proxmoxve): Define DNS entries for every interface\n * Makefile: download `90-afterburn-authorized-keys-file.conf` for rpm building\n * Sync repo templates âš™\n * build(deps): bump bytes from 1.10.1 to 1.11.1\n * util/dhcp: Fix clippy lints\n * build(deps): bump actions/checkout from 4 to 6\n * build(deps): bump actions/upload-artifact from 4 to 5\n * kubevirt: modprobe for virtio_blk; remove dracut preload\n * kubevirt: Add NoCloud network configuration support\n * kubevirt: Support config drive network data\n * kubevirt: Refactor the provider to follow the proxmoxve structure\n * dracut: Add virtio_blk module preload to afterburn-network-kargs service\n * docs: Add release notes\n * cargo: Afterburn release 5.10.0\n- Version 5.10.0:\n * docs/release-notes: update for release 5.10.0\n * cargo: update dependencies\n * microsoft/azure: Add XML attribute alias for serde-xml-rs Fedora compat\n * docs/release-notes: Add entry for Azure SharedConfig XML parsing fix\n * microsoft/azure: Fix SharedConfig parsing of XML attributes\n * microsoft/azure: Mock goalstate.SharedConfig output in tests\n * providers/azure: switch SSH key retrieval from certs endpoint to IMDS\n * build(deps): bump the build group with 8 updates\n * build(deps): bump slab from 0.4.10 to 0.4.11\n * build(deps): bump actions/checkout from 4 to 5\n * upcloud: implement UpCloud provider\n * build(deps): bump the build group with 4 updates\n","status":"published","published":"2026-07-20T09:39:37Z","modified":"2026-07-28T18:24:08.176444246Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:22895-1","title":"Security update for python-cryptography","description":"This update for python-cryptography fixes the following issues\n\n- CVE-2026-41676: openssl: `Deriver:derive` and `PkeyCtxRef:derive` can overflow short buffers on OpenSSL 1.1.1\n (bsc#1270208).\n- CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length in rust-\n openssl crate (bsc#1270620).\n- CVE-2026-41678: openssl: incorrect bounds assertion in aes key wrap in rust-openssl crate (bsc#1270706).\n- CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check in rust-openssl crate\n (bsc#1270772).\n- CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent\n memory in rust-openssl crate (bsc#1270801).\n- CVE-2026-42327: openssl: arbitrary code execution via specially crafted certificate in rust-openssl crate\n (bsc#1270515).\n- CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding in rust-openssl crate\n (bsc#1270936).\n- CVE-2026-45784: openssl: out-of-bounds write in `CipherCtxRef::cipher_update_inplace` for AES-KW-PAD ciphers in rust-\n openssl crate (bsc#1270994).\n","status":"published","published":"2026-07-22T09:07:35Z","modified":"2026-07-28T18:24:18.657951932Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:22898-1","title":"Security update for rust-keylime","description":"This update for rust-keylime fixes the following issues:\n\nUpdate to version 0.2.9+49.\n \nSecurity issues fixed:\n\n- CVE-2026-41676: openssl: `Deriver:derive` and `PkeyCtxRef:derive` can overflow short buffers on OpenSSL 1.1.1\n (bsc#1270174).\n- CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length \n (bsc#1270614).\n- CVE-2026-41678: openssl: out-of-bounds write due to incorrect bounds assertion in `aes::unwrap_key()` (bsc#1270699).\n- CVE-2026-41681: openssl: `MdCtxRef::digest_final()` writes past caller buffer with no length check (bsc#1270792).\n- CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent\n memory to the network (bsc#1270842).\n- CVE-2026-42327: openssl: undefined behavior in `X509Ref::ocsp_responders` for certificates with non-UTF-8 OCSP URLs\n (bsc#1270523).\n- CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding due to incorrectly sized\n output buffers (bsc#1270903).\n- CVE-2026-45784: openssl: out-of-bounds write in `CipherCtxRef::cipher_update_inplace` for AES-KW-PAD ciphers due to\n incorrectly sized output buffer (bsc#1270999).\n\nOther updates and bugfixes:\n\n- Update openssl to 0.10.81.\n- Make tss-esai-sys depend on bindgen 72.1 to support llvm \u003e 21.\n- Build with Clang \u003c= 21 (bsc#1260596).\n- Version 0.2.9+49:\n * build(deps): bump uuid from 1.23.3 to 1.23.4\n * build(deps): bump syn from 2.0.117 to 2.0.118\n * build(deps): bump openssl from 0.10.80 to 0.10.81\n * build(deps): bump rand from 0.9.4 to 0.10.1\n * Added new regression test into packit-ci.yaml\n * build(deps): bump actions/checkout from 6 to 7\n * build(deps): bump uuid from 1.23.1 to 1.23.3\n * build(deps): bump log from 0.4.29 to 0.4.32\n * build(deps): bump http from 1.4.0 to 1.4.2\n * build(deps): bump codecov/codecov-action from 6 to 7\n * build(deps): bump retry-policies from 0.5.1 to 0.5.2\n * fix: Remove unused base64::Engine import in context_info tests\n * build(deps): bump reqwest-middleware from 0.5.1 to 0.5.2\n * build(deps): bump serde_json from 1.0.149 to 1.0.150\n * build(deps): bump openssl from 0.10.79 to 0.10.80\n * agent: Hash agent ID before TPM2_Certify qualifying data\n * cargo: Bump tss-esapi, picky-asn1-x509, and picky-asn1-der\n * build(deps): bump openssl from 0.10.78 to 0.10.79\n * build(deps): bump once_cell from 1.21.3 to 1.21.4\n * build(deps): bump tempfile from 3.23.0 to 3.27.0\n * push-model: cache UEFI event log bytes at startup\n * build(deps): bump quote from 1.0.40 to 1.0.45\n * build(deps): bump chrono from 0.4.42 to 0.4.44\n * build(deps): bump openssl from 0.10.73 to 0.10.78\n * build(deps): bump serde_json from 1.0.143 to 1.0.149\n * build(deps): bump syn from 2.0.106 to 2.0.117\n * build(deps): bump libc from 0.2.175 to 0.2.184\n * build(deps): bump rand from 0.9.2 to 0.9.4\n- Version 0.2.9+21:\n * tests: use Express-style named params in Mockoon endpoints\n * build(deps): bump pest_derive from 2.8.1 to 2.8.6\n * build(deps): bump trybuild from 1.0.110 to 1.0.115\n * build(deps): bump log from 0.4.28 to 0.4.29\n * build(deps): bump uuid from 1.19.0 to 1.20.0\n * build(deps): bump codecov/codecov-action from 5 to 6\n * build(deps): bump tracing-subscriber from 0.3.20 to 0.3.23\n * build(deps): bump cfg-if from 1.0.3 to 1.0.4\n * build(deps): bump tokio from 1.49.0 to 1.50.0\n * build(deps): bump actix-web from 4.12.1 to 4.13.0\n * build(deps): bump anyhow from 1.0.99 to 1.0.102\n * build(deps): bump clap from 4.5.57 to 4.5.60\n * build(deps): bump tracing from 0.1.36 to 0.1.44\n","status":"published","published":"2026-07-22T09:10:07Z","modified":"2026-07-28T18:24:18.681820987Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:22910-1","title":"Security update for s390-tools","description":"This update for s390-tools fixes the following issue\n\n- CVE-2026-41676: openssl: `Deriver:derive` and `PkeyCtxRef:derive` can overflow short buffers on OpenSSL 1.1.1 (bsc#1270185).\n","status":"published","published":"2026-07-21T16:53:29Z","modified":"2026-07-28T18:24:19.444627678Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:22917-1","title":"Security update for afterburn","description":"This update for afterburn fixes the following issues\n\nUpdate to version 5.10.0.git73.b97f772.\n\nSecurity issues fixed:\n\n- CVE-2022-24713: regex: high complexity when parsing regexes with large repetitions on empty sub-expressions can lead\n to DoS (bsc#1196972).\n- CVE-2024-12224: idna: privilege escalation due acceptance Punycode labels that do not produce any non-ASCII when\n decoded (bsc#1243850).\n- CVE-2025-3416: openssl: use-after-free in `Md::fetch` and `Cipher::fetch` (bsc#1242665).\n- CVE-2025-5791: users: `root` appended to group listings unless the correct listing has exactly 1024 groups\n (bsc#1244199).\n- CVE-2026-41676: openssl: `Deriver:derive` and `PkeyCtxRef:derive` can overflow short buffers on OpenSSL 1.1.1\n (bsc#1270175).\n- CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length\n (bsc#1270555).\n- CVE-2026-41678: openssl: incorrect bounds assertion in `aes::unwrap_key()` can lead to OOB write (bsc#1270651).\n- CVE-2026-41681: openssl: `MdCtxRef::digest_final()` writes past caller buffer with no length check (bsc#1270787).\n- CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent\n memory to network peers (bsc#1270817).\n- CVE-2026-42327: openssl: undefined behavior in `X509Ref::ocsp_responders` when processing certificates with non-UTF-8\n OCSP URLs (bsc#1270483).\n- CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding (bsc#1270886).\n- CVE-2026-45784: openssl: out-of-bounds write in `CipherCtxRef::cipher_update_inplace` for AES-KW-PAD ciphers\n (bsc#1270949).\n- CVE-2026-25541: bytes: integer overflow in `BytesMut:reserve` can lead to undefined behavior and crashes\n (bsc#1271348).\n\nOther updates and bugfixes:\n\n- Version 5.10.0.git73.b97f772:\n * build(deps): bump anyhow from 1.0.99 to 1.0.103\n https://github.com/coreos/afterburn/pull/1284\n * build(deps): bump libflate from 2.1.0 to 2.2.2\n https://github.com/coreos/afterburn/pull/1283\n * build(deps): bump openssl from 0.10.79 to 0.10.80\n https://github.com/coreos/afterburn/pull/1277\n- Version 5.10.0.git70.9cc2a7b:\n * build(deps): bump openssl from 0.10.78 to 0.10.79\n * providers/hetzner: Add the HETZNER_PUBLIC_IPV6 attribute\n * providers/hetzner: Add support for network configuration\n * build(deps): bump rustls-webpki from 0.103.10 to 0.103.13\n * build(deps): bump openssl from 0.10.73 to 0.10.78\n * docs: Add AGENTS.md and CLAUDE.md for AI coding assistants\n * build(deps): bump rand from 0.9.2 to 0.9.4\n * opencode: add skills for provider scaffolding and release automation\n * ibmcloud-classic: Add missing network_id to fixture\n * kubevirt: Support static gateway and DNS with DHCP\n * build(deps): bump rustls-webpki from 0.103.6 to 0.103.10\n * fix(proxmoxve): Define DNS entries for every interface\n * Makefile: download `90-afterburn-authorized-keys-file.conf` for rpm building\n * Sync repo templates âš™\n * build(deps): bump bytes from 1.10.1 to 1.11.1\n * util/dhcp: Fix clippy lints\n * build(deps): bump actions/checkout from 4 to 6\n * build(deps): bump actions/upload-artifact from 4 to 5\n * kubevirt: modprobe for virtio_blk; remove dracut preload\n * kubevirt: Add NoCloud network configuration support\n * kubevirt: Support config drive network data\n * kubevirt: Refactor the provider to follow the proxmoxve structure\n * dracut: Add virtio_blk module preload to afterburn-network-kargs service\n * docs: Add release notes\n * cargo: Afterburn release 5.10.0\n- Version 5.10.0:\n * docs/release-notes: update for release 5.10.0\n * cargo: update dependencies\n * microsoft/azure: Add XML attribute alias for serde-xml-rs Fedora compat\n * docs/release-notes: Add entry for Azure SharedConfig XML parsing fix\n * microsoft/azure: Fix SharedConfig parsing of XML attributes\n * microsoft/azure: Mock goalstate.SharedConfig output in tests\n * providers/azure: switch SSH key retrieval from certs endpoint to IMDS\n * build(deps): bump the build group with 8 updates\n * build(deps): bump slab from 0.4.10 to 0.4.11\n * build(deps): bump actions/checkout from 4 to 5\n * upcloud: implement UpCloud provider\n * build(deps): bump the build group with 4 updates\n","status":"published","published":"2026-07-23T11:09:40Z","modified":"2026-07-28T18:24:14.839227879Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:22921-1","title":"Security update for rust-keylime","description":"This update for rust-keylime fixes the following issues\n\nUpdate to version 0.2.9+49.\n \nSecurity issues fixed:\n\n- CVE-2026-41676: openssl: `Deriver:derive` and `PkeyCtxRef:derive` can overflow short buffers on OpenSSL 1.1.1\n (bsc#1270174).\n- CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length \n (bsc#1270614).\n- CVE-2026-41678: openssl: out-of-bounds write due to incorrect bounds assertion in `aes::unwrap_key()` (bsc#1270699).\n- CVE-2026-41681: openssl: `MdCtxRef::digest_final()` writes past caller buffer with no length check (bsc#1270792).\n- CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent\n memory to the network (bsc#1270842).\n- CVE-2026-42327: openssl: undefined behavior in `X509Ref::ocsp_responders` for certificates with non-UTF-8 OCSP URLs\n (bsc#1270523).\n- CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding due to incorrectly sized\n output buffers (bsc#1270903).\n- CVE-2026-45784: openssl: out-of-bounds write in `CipherCtxRef::cipher_update_inplace` for AES-KW-PAD ciphers due to\n incorrectly sized output buffer (bsc#1270999).\n\nOther updates and bugfixes:\n\n- Update openssl to 0.10.81.\n- Make tss-esai-sys depend on bindgen 72.1 to support llvm \u003e 21.\n- Build with Clang \u003c= 21 (bsc#1260596).\n- Version 0.2.9+49:\n * build(deps): bump uuid from 1.23.3 to 1.23.4\n * build(deps): bump syn from 2.0.117 to 2.0.118\n * build(deps): bump openssl from 0.10.80 to 0.10.81\n * build(deps): bump rand from 0.9.4 to 0.10.1\n * Added new regression test into packit-ci.yaml\n * build(deps): bump actions/checkout from 6 to 7\n * build(deps): bump uuid from 1.23.1 to 1.23.3\n * build(deps): bump log from 0.4.29 to 0.4.32\n * build(deps): bump http from 1.4.0 to 1.4.2\n * build(deps): bump codecov/codecov-action from 6 to 7\n * build(deps): bump retry-policies from 0.5.1 to 0.5.2\n * fix: Remove unused base64::Engine import in context_info tests\n * build(deps): bump reqwest-middleware from 0.5.1 to 0.5.2\n * build(deps): bump serde_json from 1.0.149 to 1.0.150\n * build(deps): bump openssl from 0.10.79 to 0.10.80\n * agent: Hash agent ID before TPM2_Certify qualifying data\n * cargo: Bump tss-esapi, picky-asn1-x509, and picky-asn1-der\n * build(deps): bump openssl from 0.10.78 to 0.10.79\n * build(deps): bump once_cell from 1.21.3 to 1.21.4\n * build(deps): bump tempfile from 3.23.0 to 3.27.0\n * push-model: cache UEFI event log bytes at startup\n * build(deps): bump quote from 1.0.40 to 1.0.45\n * build(deps): bump chrono from 0.4.42 to 0.4.44\n * build(deps): bump openssl from 0.10.73 to 0.10.78\n * build(deps): bump serde_json from 1.0.143 to 1.0.149\n * build(deps): bump syn from 2.0.106 to 2.0.117\n * build(deps): bump libc from 0.2.175 to 0.2.184\n * build(deps): bump rand from 0.9.2 to 0.9.4\n- Version 0.2.9+21:\n * tests: use Express-style named params in Mockoon endpoints\n * build(deps): bump pest_derive from 2.8.1 to 2.8.6\n * build(deps): bump trybuild from 1.0.110 to 1.0.115\n * build(deps): bump log from 0.4.28 to 0.4.29\n * build(deps): bump uuid from 1.19.0 to 1.20.0\n * build(deps): bump codecov/codecov-action from 5 to 6\n * build(deps): bump tracing-subscriber from 0.3.20 to 0.3.23\n * build(deps): bump cfg-if from 1.0.3 to 1.0.4\n * build(deps): bump tokio from 1.49.0 to 1.50.0\n * build(deps): bump actix-web from 4.12.1 to 4.13.0\n * build(deps): bump anyhow from 1.0.99 to 1.0.102\n * build(deps): bump clap from 4.5.57 to 4.5.60\n * build(deps): bump tracing from 0.1.36 to 0.1.44\n","status":"published","published":"2026-07-24T08:14:50Z","modified":"2026-07-28T18:24:17.329155779Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:23036-1","title":"Security update for libkrun","description":"This update for libkrun fixes the following issues:\n\n- CVE-2025-24898: openssl: select_next_proto use after free in rust-openssl (bsc#1270429).\n- CVE-2026-41676: openssl: `Deriver:derive` and `PkeyCtxRef:derive` can overflow short buffers on OpenSSL 1.1.1\n (bsc#1270198).\n- CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length in rust-\n openssl crate (bsc#1270582).\n- CVE-2026-41678: openssl: incorrect bounds assertion in aes key wrap in rust-openssl crate (bsc#1270683).\n- CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check in rust-openssl crate\n (bsc#1270721).\n- CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent\n memory in rust-openssl crate (bsc#1270831).\n- CVE-2026-42327: openssl: arbitrary code execution via specially crafted certificate in rust-openssl crate\n (bsc#1270470).\n- CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding in rust-openssl crate\n (bsc#1270877).\n\nChanges for libkrun:\n\n- Update vendored openssl crate to version 0.10.81.\n","status":"published","published":"2026-07-28T17:32:56Z","modified":"2026-08-12T18:23:38.746176517Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:23070-1","title":"Security update for libkrun","description":"This update for libkrun fixes the following issues:\n\n- CVE-2025-24898: openssl: use-after-free in `ssl::select_next_proto` due to improper lifetime handling (bsc#1270429).\n- CVE-2026-41676: openssl: short buffer overflow via `Deriver:derive` and `PkeyCtxRef:derive` when using OpenSSL 1.1.1\n (bsc#1270198).\n- CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length\n (bsc#1270582).\n- CVE-2026-41678: openssl: OOB write due to incorrect bounds assertion in `aes::unwrap_key()` (bsc#1270683).\n- CVE-2026-41681: openssl: stack corruption due to `MdCtxRef::digest_final()` writing past caller buffer with no length\n check (bsc#1270721).\n- CVE-2026-41898: openssl: information leak to network peers due to unchecked callback-returned length in PSK and\n cookie generate trampolines (bsc#1270831).\n- CVE-2026-42327: openssl: undefined behavior in `X509Ref::ocsp_responders` when processing certificates with non-UTF-8\n OCSP URLs (bsc#1270470).\n- CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding (bsc#1270877).\n","status":"published","published":"2026-07-30T08:54:20Z","modified":"2026-08-14T18:23:35.999154742Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:23071-1","title":"Security update for afterburn","description":"This update for afterburn fixes the following issues:\n\nUpdate to version 5.10.0.git73.b97f772.\n\nSecurity issues fixed:\n\n- CVE-2026-41676: openssl: `Deriver:derive` and `PkeyCtxRef:derive` can overflow short buffers on OpenSSL 1.1.1\n (bsc#1270175).\n- CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length\n (bsc#1270555).\n- CVE-2026-41678: openssl: incorrect bounds assertion in `aes::unwrap_key()` can lead to OOB write (bsc#1270651).\n- CVE-2026-41681: openssl: `MdCtxRef::digest_final()` writes past caller buffer with no length check (bsc#1270787).\n- CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent\n memory to network peers (bsc#1270817).\n- CVE-2026-42327: openssl: undefined behavior in `X509Ref::ocsp_responders` when processing certificates with non-UTF-8\n OCSP URLs (bsc#1270483).\n- CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding (bsc#1270886).\n- CVE-2026-45784: openssl: out-of-bounds write in `CipherCtxRef::cipher_update_inplace` for AES-KW-PAD ciphers\n (bsc#1270949).\n- CVE-2026-25541: bytes: integer overflow in `BytesMut:reserve` can lead to undefined behavior and crashes\n (bsc#1271348).\n\nOther updates and bugfixes:\n\n- Version 5.10.0.git73.b97f772:\n * build(deps): bump anyhow from 1.0.99 to 1.0.103\n https://github.com/coreos/afterburn/pull/1284\n * build(deps): bump libflate from 2.1.0 to 2.2.2\n https://github.com/coreos/afterburn/pull/1283\n * build(deps): bump openssl from 0.10.79 to 0.10.80\n https://github.com/coreos/afterburn/pull/1277\n- Version 5.10.0.git70.9cc2a7b:\n * build(deps): bump openssl from 0.10.78 to 0.10.79\n * providers/hetzner: Add the HETZNER_PUBLIC_IPV6 attribute\n * providers/hetzner: Add support for network configuration\n * build(deps): bump rustls-webpki from 0.103.10 to 0.103.13\n * build(deps): bump openssl from 0.10.73 to 0.10.78\n * docs: Add AGENTS.md and CLAUDE.md for AI coding assistants\n * build(deps): bump rand from 0.9.2 to 0.9.4\n * opencode: add skills for provider scaffolding and release automation\n * ibmcloud-classic: Add missing network_id to fixture\n * kubevirt: Support static gateway and DNS with DHCP\n * build(deps): bump rustls-webpki from 0.103.6 to 0.103.10\n * fix(proxmoxve): Define DNS entries for every interface\n * Makefile: download `90-afterburn-authorized-keys-file.conf` for rpm building\n * Sync repo templates âš™\n * build(deps): bump bytes from 1.10.1 to 1.11.1\n * util/dhcp: Fix clippy lints\n * build(deps): bump actions/checkout from 4 to 6\n * build(deps): bump actions/upload-artifact from 4 to 5\n * kubevirt: modprobe for virtio_blk; remove dracut preload\n * kubevirt: Add NoCloud network configuration support\n * kubevirt: Support config drive network data\n * kubevirt: Refactor the provider to follow the proxmoxve structure\n * dracut: Add virtio_blk module preload to afterburn-network-kargs service\n * docs: Add release notes\n * cargo: Afterburn release 5.10.0\n- Version 5.10.0:\n * docs/release-notes: update for release 5.10.0\n * cargo: update dependencies\n * microsoft/azure: Add XML attribute alias for serde-xml-rs Fedora compat\n * docs/release-notes: Add entry for Azure SharedConfig XML parsing fix\n * microsoft/azure: Fix SharedConfig parsing of XML attributes\n * microsoft/azure: Mock goalstate.SharedConfig output in tests\n * providers/azure: switch SSH key retrieval from certs endpoint to IMDS\n * build(deps): bump the build group with 8 updates\n * build(deps): bump slab from 0.4.10 to 0.4.11\n * build(deps): bump actions/checkout from 4 to 5\n * upcloud: implement UpCloud provider\n * build(deps): bump the build group with 4 updates\n","status":"published","published":"2026-07-30T08:59:18Z","modified":"2026-08-14T18:23:35.54834852Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:23643-1","title":"Security update for aws-nitro-enclaves-cli","description":"This update for aws-nitro-enclaves-cli fixes the following issues:\n\n- CVE-2026-25541: bytes: integer overflow in 'BytesMut:reserve' can lead to undefined behavior and crashes\n (bsc#1274300).\n- CVE-2026-25727: time: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion\n (bsc#1257933).\n- CVE-2026-41676: openssl: `Deriver:derive` and `PkeyCtxRef:derive` can overflow short buffers on OpenSSL 1.1.1\n (bsc#1270202).\n\nChanges for aws-nitro-enclaves-cli:\n\n- Update to version 1.5.0\n","status":"published","published":"2026-09-07T10:34:06Z","modified":"2026-09-29T18:23:10.591295124Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:23659-1","title":"Security update for aws-nitro-enclaves-cli","description":"This update for aws-nitro-enclaves-cli fixes the following issues:\n\n- CVE-2026-25541: bytes: integer overflow in 'BytesMut:reserve' can lead to undefined behavior and crashes\n (bsc#1274300).\n- CVE-2026-25727: time: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion\n (bsc#1257933).\n- CVE-2026-41676: openssl: `Deriver:derive` and `PkeyCtxRef:derive` can overflow short buffers on OpenSSL 1.1.1\n (bsc#1270202).\n\nChanges for aws-nitro-enclaves-cli:\n\n- Update to version 1.5.0\n","status":"published","published":"2026-09-07T10:34:06Z","modified":"2026-09-29T18:23:11.289780718Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:23983-1","title":"Security update for sccache","description":"This update for sccache fixes the following issues:\n\n- CVE-2024-12224: idna: idna accepts Punycode labels that do not produce any non-ASCII when decoded (bsc#1243868).\n- CVE-2026-25541: bytes: integer overflow in 'BytesMut:reserve' can lead to undefined behavior and crashes\n (bsc#1274146).\n- CVE-2026-25727: time: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion\n (bsc#1257923).\n- CVE-2026-41676: openssl: `Deriver:derive` and `PkeyCtxRef:derive` can overflow short buffers on OpenSSL 1.1.1\n (bsc#1270206).\n- CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length in rust-\n openssl crate (bsc#1270559).\n- CVE-2026-41678: openssl: incorrect bounds assertion in aes key wrap in rust-openssl crate (bsc#1270693).\n- CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check in rust-openssl crate\n (bsc#1270736).\n- CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent\n memory in rust-openssl crate (bsc#1270869).\n- CVE-2026-42327: openssl: arbitrary code execution via specially crafted certificate in rust-openssl crate\n (bsc#1270512).\n- CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding in rust-openssl crate\n (bsc#1270938).\n- CVE-2026-45784: openssl: out-of-bounds write in `CipherCtxRef::cipher_update_inplace` for AES-KW-PAD ciphers in rust-\n openssl crate (bsc#1270948).\n- CVE-2026-66746: rouille: HTTP Response Splitting via Unvalidated Response Header Values (bsc#1273881).\n- CVE-2026-66754: rouille: remove_prefix function that allows remote unauthenticated attackers to crash the server by\n sending a crafted percent-encoded URL (bsc#1273884).\n- CVE-2026-67181: rouille: HTTP Request Smuggling via Transfer-Encoding Desynchronization (bsc#1273886).\n- CVE-2026-67182: rouille: HTTP Request Smuggling Enables Front-End Access Control Bypass (bsc#1273888).\n- CVE-2026-93599: rustls-webpki: panic via empty BIT STRING (bsc#1282211).\n- CVE-2026-93600: rustls-webpki: name constraints URI validation bypass (bsc#1282211).\n- CVE-2026-93601: rustls-webpki: name constraint bypass (bsc#1282211).\n- CVE-2026-93602: rustls-webpki: CRL revocation check bypass (bsc#1282211).\n\nChanges for sccache:\n\nUpdate to version 0.18.0~2:\n * Add experimental concurrent cache support\n * chore: Remove dependency status badge (#2856)\n * Don't hand the jobserver to children that can't use it\n * dist: refuse to trim rlibs from crates that also emit a cdylib\n * fix(cache): avoid duplicate multilevel reads\n * Strip basedirs from the compiler arguments too\n * tests/integration: replace MinIO with Silo\n * ci: dump sccache logs on integration failures\n * multilevel: a chain with any writable level is writable\n * Fix parsing of #line directives\n * Release 0.18.0\n * daemonize: use an allow-list approach to inherited FDs\n * gcc, clang: make the assembler part of the cache key\n * support cl.exe /openmp:llvm\n * support all current /fsanitize*, /fsanitize-coverage*, and /fno-sanitize* args\n * support MSVC /feature argument\n * msvc: support lots of flags (#2832)\n * Update shlex dependency to version 2 (#2836)\n * gcc: mark flags as TooHard if need to cache something else (#2833)\n * clang: support more CLI options (#2834)\n * msvc: support arm64EC and fastfail flags (#2830)\n * chore: fix typo in comment (#2829)\n * nvcc: accept the --diag-error/--diag-suppress/--diag-warn family (#2816)\n * cache: allow skipping capability checks (#2822)\n * Bump opendal to 0.58.1 and fix fallout (fixes local GCS cache usage) (#2715)\n * nvcc (Windows): protect escaped quotes in dryrun lines before flattening backslashes (#2811)\n * Add an agent (#2812)\n * Add support for d20bforceinline. (#2807)\n * feat: add Microsoft Entra ID (passwordless) auth for the Azure Blob backend (#2802)\n * Bump MSRV to 1.91.0 (#2793)\n * Fix `nvcc` dryrun parsing for CUDA 13.3 (#2722)\n * test: Fixed hardcoded binary path in test\n * Release 0.17.0\n * tests: pin libc in the dist test crate\n * doc: clarify server-side outputs and drop 'recommended mode' claim\n * doc: document SCCACHE_CLIENT_SIDE env var\n * doc: document client-side and direct modes in Architecture.md\n * Fix description of Unix socket-based Redis connection\n * server: remove redundant async block in start_compile_task\n * server: simplify bind() request loops with ? instead of manual match arms\n * Add support for arg files in Rust (#2782)\n * feat: support S3 SSE-KMS with AWS-managed and customer-managed keys (#2770)\n * abort compile tasks and associated subprocesses when a client disconnects\n * treat -ivfsoverlay as a preprocessor-only argument\n * gcc: refine response-file tokenizer visibility and whitespace handling\n * integration: convert cmake 4.x modules XFAIL test to a passing test\n * gcc/clang: cache and distribute builds using quoted @response files\n * fix: Fix ToolchainPackager cfg gate to build on ppc64le/s390x\n * fix: make gcc diagnostics color output work the same as for rustc\n * implement client-side mode\n * split handle_compile_response so that the compilation result can be handled separately\n * implement IpcStorage -- Storage backend over IPC\n * extend wire protocol with storage RPCs\n * implement AddAssign for ServerStats and related types\n * add Storage::get_path for direct file access\n * implement get_raw/put_raw on MultiLevelStorage\n * add client_side_mode config flag (SCCACHE_CLIENT_SIDE)\n * Extract new_client_runtime() helper to DRY up client runtime creation\n * Clarify single-threaded runtime rationale comment (grammar)\n * fix: use single-threaded tokio runtime in sccache dist-client\n * fix: use single-threaded tokio runtime in sccache client\n * fix: handle disabled cache backend features in multilevel chain\n * Fix ldd output parsing: remove .exists() check that failed on systems where the symlink source path does not exist locally (e.g. aarch64)\n * Fix cfg guard for PanicToolchainPackager to also cover non-x86_64 Linux architectures (e.g. aarch64)\n * Release 0.16.0\n * fix: strip SCCACHE_BASEDIRS from escaped-backslash paths on Windows (#2736)\n * Ignore empty-set environment values (#2639)\n * feat: all backends support making them as read-only (#2705)\n * Enable RE on Linux-aarch64 (#2668)\n * Slightly improve logging (#2734)\n * chore: encode jwt key and cert digest with base64 in logs (#2712)\n * chore: make clippy happy (#2727)\n * feat: avoid sccache wrapper when resolving compiler (#2720)\n * Fall back to direct cache write if tempfile creation on the same fs fails (#2369)\n * remove too noisy bench\n * feat(nvcc): support argument: `--dependency-output` (#2708)\n * fix: add newline when printing dist-status to stdout\n * Revert \"Classify .s files as AssemblerToPreprocess so #include/#ifdef are hon...\"\n * Don't wait depfiles for gcc/clang preprocessed inputs\n * Classify .s files as AssemblerToPreprocess so #include/#ifdef are honored\n * prepare release 0.15.0\n * Add cargo-binstall metadata for prebuilt binary installation\n * Fix coverage\n * fix: handle directories in dep-info source file hashing\n * docs(Rust.md): Add caveats from README\n * Add retry for dists docker image build\n * ci: set crt-static for riscv64 musl targets\n * feat: Add loongarch64 support\n * feat: Implement multi-tier caching with fallback and backfilling (#2581)\n * msvc: add support for Y-, YI, Zf flags\n * Group tests logging in CI\n * Add failing test for cmake-modules + cmake 4 version\n * Unfold ninja output in the test\n * Add a comment for maintaining integration tests\n * Move cmake-modules to integration tests\n * fix: exclude CARGO_ENCODED_RUSTFLAGS from env var hash (#2651)\n * chore(deps): update rust crate quinn-proto to v0.11.14\n * Fix sync GCS initialization\n * clippy: fix from_iter_instead_of_collect lint\n * fix: add Win32_Security feature to windows-sys dependency\n * build(deps): bump actions/download-artifact from 5 to 8\n * msvc: Append the default .pdb extension for the /Fd argument (#2621)\n * build(deps): bump actions/upload-artifact from 4 to 7\n * clippy: fix ref_option lint\n * ci: install grcov from prebuilt binary instead of cargo install\n * ci: use default toolchain to install grcov\n * ci: fix artifact_failure action when target dir does not exist\n * Remove benchmark normalize_win_path_utf8 (#2634)\n * Revert \"actions: add security audit workflow (#2594)\" (#2603)\n * partial c++20 module support (#2516)\n * clippy: fix ptr_as_ptr lint (#2611)\n * Add support for `d1nodatetime` \u0026 `await:strict` MSVC flags (#2617)\n * chore: switch thirtyfour_sync to thirtyfour (#2613)\n * clippy: fix manual_string_new lint (#2609)\n * clippy: fix unnecessary_semicolon lint (#2615)\n * clippy: fix explicit_into_iter_loop lint (#2616)\n * Avoid double-caching when ccache is installed in PATH (#2524)\n * clippy: fix cloned_instead_of_copied lint (#2605)\n * clippy: fix semicolon_if_nothing_returned lint (#2601)\n * Move PreprocessorCacheModeConfig to src/config.rs (#2604)\n * clippy: fix cloned_ref_to_slice_refs lint (#2602)\n * prepare the new release (#2600)\n * chore: update to toml 0.9 (#2599)\n * ci: Add coverage to integration tests, report it to Codecov.io (#2598)\n * Preparation for multilevel caching (#2597)\n * Add sccache-dist to flake.nix (#2579)\n * fixup! cargo fmt\n * fixup! rustfmt update\n * Extract FileObjectSource, CacheRead and CacheWrite to cache_io.rs\n * chore: update to nix 0.30\n * Add a helper method to get a correct backend name\n * Add cos feature gate to RemoteStorage\n * Simplify profiles for integration tests\n * clippy: fix implicit_clone lint (#2584)\n * actions: add security audit workflow (#2594)\n * docs: fix examples showing an xz-compress toolchain archive (#2587)\n * add benches for normalize_win_path strip_basedirs (#2588)\n * snap: update to core24 (#2570)\n * Add .rustfmt.toml for consistent style between `rustfmt` and `cargo fmt` (#2582)\n * add comments about auth token requirements (#2583)\n * chore: update to tokio-serde 0.9 (#2585)\n * ci: update freebsd to 15.0 (#2586)\n * distributed compilation support for asm \u0026 preprocessor outputs (#2557)\n * remove unused declaration (#2577)\n * Extract LazyDiskCache to a separated file (#2573)\n * Revert \"ci: show diff for toml_format\" (#2578)\n * Open Add SCCACHE_BASEDIRS support\n * ci: show diff for toml_format\n * chore: update to syslog 7\n * refactor: use matrix to reduce deduplication\n * fix: remove outdated `analysis` mode\n * Unbreak the s390x CI\n * ci: add macos-15-intel for prebuilt binary (#2555)\n * Integration tests (#2564)\n * Fix code review.\n * Impl for COS.\n * build(deps): bump opendal from 0.54.0 to 0.55.0\n * Move integration tests related stuff to subdir\n * Add Objective C Header for consistency\n * github action: fix the syntax - fails in the ci\n * sccache: prepare a new release\n * msvc: add msbuild support test\n * msvc: fix detect_showincludes_prefix with MSBuild\n * chore: update to gzp 2\n * build(deps): bump rsa from 0.9.6 to 0.9.10\n * codspeed: evaluate the memory benchmarking\n * remove too quick benchmarks\n * codspeed: move to simulation mode\n * Add realistic LRU cache access pattern benchmarks\n * Add compression characteristics benchmarks\n * Add build workflow simulation benchmarks\n * Add hash computation scenario benchmarks\n * Add batch cache entry benchmarks\n * Add cache artifact serialization benchmarks\n * Add /etc/ld.so.conf.d (if present) to compiler package\n * Assembly language support\n * fix(ci): pin serde_json to avoid zmij dependency\n * fix(ci): update zmij to fix s390x cross-compilation\n * Fix the run of the CI\n * run the benchmark in the ci\n * add benchmarks\n * dedup some code\n * Fix hash logging prefix\n * Add support for C preprocessor output\n * Add GCC pipe flag support\n * Improve save-temps gcc flags detection\n * MSVC: support forward slash as an output dir marker\n * add clang -fplugin=x regression test\n * canbeconcatenated is not accounted for in cmp\n * Reversed the order for looking `rustc`, added comment\n * Fix failing test_rlib_dep_reader_call for omit CARGO_HOME\n * fix: don't hash -parallel-jobs in Clang\n * docs: add installation steps for nix (#2523)\n * Support clang -fexperimental-assignment-tracking option (#2517)\n * add a nix flake (#2518)\n * Switch from the unmaintained daemonize crate to a maintained fork\n * chore: update to fs-err 3\n * Fix grammar of error message\n * Add server name info to stderr of remote jobs that ran, but failed\n * Remove another pointless destructuring\n * try to unbreak the ci\n * fix s390x build error\n * Add riscv64 support\n * fix: make aarch64-pc-windows-msvc also zip not tar.gz\n * Free up disk space in CI\n * MSVC on Windows only\n * Avoid 'No space left on device' errors in CI\n * GitHub dropped macos-13 runners\n * Proper function pointer to int cast\n * Avoid unused structs with dist-server disabled\n * no check cfg (#2507)\n * chore: switch once_cell crate to standard library (#2499)\n * Avoid unreliable assert_cmd::cargo::cargo_bin (#2489)\n * Fix build on macOS which doesn't have separate 32-bit dirent (#2492)\n * Fix Clippy warnings (#2490)\n * docs: bump MSRV to 1.85.0\n * msvc: handle '/FoRelease\\' command-line argument\n * chore: drop tower dependency\n * chore: update to itertools 0.14\n * Use generator in CMAKE_MSVC_DEBUG_INFORMATION_FORMAT in README\n * Update directories to 6.0\n * Configuration.md - note logging env variables\n * chore: update to env_logger 0.11\n * deps: update blake3\n * prepare version 0.12.0\n * Update README with winget installation instructions\n * Skip CARGO_BUILD_JOBS in hash keys\n * build(deps): bump object from 0.36.7 to 0.37.1\n * Adjust tests after the rust update\n * Fix CI by adding cargo-features and updating coverage test to use modern -Cinstrument-coverage\n * Fix more clippy warnings\n * bump rustc in the ci too\n * Fix rustc 1.85 clippy warnings\n * bump to rustc 1.85 / edition 2024. mandatory for reqsign-core and run rustfmt with the version\n * fix clippy warnings\n * bump opendal to 0.54.0 \u0026 reqsign to 0.18.0\n * github action: when creating a release, make it as draft before (#2458)\n * prepare version 0.11.0 (#2457)\n * document SCCACHE_LOG_MILLIS (#2456)\n * logging: add a option to log milliseconds (Closes: #2454) (#2455)\n * feat: handle human size prefixes (#2405)\n * fix: in stats, Compare values AND keys to have a fully deterministic order (#2403)\n * Add --diagnostic-width to test for args ignored in hash\n * Ignore --diagnostic-width argument when computing hash\n * build(deps): bump actions/checkout from 4 to 5\n * build(deps): bump actions/download-artifact from 4 to 5\n * build(deps): bump actions/github-script from 7 to 8\n * Fix rustfmt\n * Fix comments on request\n * Fix clippy and rustfmt\n * Add test for count toolchain and use Determenistic for create tar archive\n * Fix mtime for reproducable toolchains\n * build(deps): bump chrono from 0.4.41 to 0.4.42\n * fix typo in an environment variable name\n * Fix documentation of azure configuration\n * Account for clippy-driver having extra prefix `rustc`\n * Fix build on Android (in Termux)\n * add support for s390x build\n * chore: replace retry crate with backon\n * Remove or replace \"Windows 2019\" CI config\n * Needs another result unwrapping, it seems\n * Test: invoking symlink \"compiler\" to \"sccache\" invokes \"compiler\"\n * Add a comment about the problem with symlinks and current_exe()\n * Fix symbolic links to sccache on linux\n * Allow the CI configuration to disable clang++ for CUDA testing\n * Don't run tests using clang++ as CUDA compiler on Windows\n * add description to sccache-dist commands\n * Display a more user-friendly error when compiling on Linux/arm64\n * Clarify documentation about \"the hash\" (aka cache key)\n * Remove stray ')'\n * Remove documentation for removed limitations of preprocessor cache mode\n * Fix preprocessor cache mode when the compiler outputs a dep file\n * Partially revert \"Don't cache dep file (#2322)\"\n * Do not disable preprocessor cache mode if there is a dep file\n * Fix preprocessor cache mode with distributed builds (#2173)\n * Change self of generate_hash_key() from Box\u003cSelf\u003e to \u0026mut Self\n * Remove a few IMO pointless indirections / aliases\n * Remove workaround for #2173\n * Add test for bug #2173\n * chore: fix some minor issues in comments\n * build(deps): bump chrono from 0.4.40 to 0.4.41\n * build(deps): bump memchr from 2.7.1 to 2.7.5\n * check if we can use a specific version of rust to build grcov\n * Move comment that hadn't moved with its corresponding code\n * Rework direct mode documentation some more\n * Explain what preprocessor cache mode really does\n * Reword and correct the preprocessor cache mode documentation\n * chore: Remove not working mozilla code\n * Add support for -fsanitize-ignorelist\n * github storage: adjust the doc\n * github storage: ACTIONS_CACHE_URL =\u003e ACTIONS_RESULTS_URL\n * github storage: force version 2\n * Update codecov badge in README.md\n * Expand tests for dist-server\n * ci: Consolidate testing, coverage\n * ci: Update ubuntu-20.04 runners to ubuntu-22.04\n * chore: fix some comments\n * Give the --dist-status user some information about when a retry will happen.\n * Add support for Xclang flag '-mrelax-all'\n * Add support for Xclang flag '-mconstructor-aliases'\n * feat(utils): Add support for object \u003e= 0.33\n * fix(tests): Remove executable bit from oauth.rs\n * build(deps): bump openssl from 0.10.64 to 0.10.72\n * build(deps): bump tokio from 1.41.0 to 1.43.1\n * Improve the CARGO_INCREMENTAL checking (#2364)\n * build(deps): bump chrono from 0.4.38 to 0.4.40\n * build(deps): bump clap from 4.4.18 to 4.5.13\n * build(deps): bump ring from 0.17.7 to 0.17.13\n * Bail on `nvcc -time` and `nvcc -fdevice-time-trace` flags\n * test hip with librandomize_readdir\n * Add randomize_readdir test utility\n * fix non-strict HIP device lib order\n * Create config during testing to collect coverage data\n * Extend coverage to distributed tests\n * chore: replace num_cpus crate with available_parallelism in standard library (#2342)\n * Update CI coverage: grcov/codecov\n","status":"published","published":"2026-09-30T17:49:13Z","modified":"2026-10-06T17:23:09.022286462Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:24014-1","title":"Security update for rustup","description":"This update for rustup fixes the following issues:\n\n- CVE-2024-12224: idna: idna accepts Punycode labels that do not produce any non-ASCII when decoded (bsc#1243862).\n- CVE-2025-58160: tracing-subscriber: Tracing log pollution (bsc#1249008).\n- CVE-2026-25541: bytes: integer overflow in 'BytesMut:reserve' can lead to undefined behavior and crashes\n (bsc#1274144).\n- CVE-2026-25727: time: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion\n (bsc#1257902).\n- CVE-2026-41676: openssl: `Deriver:derive` and `PkeyCtxRef:derive` can overflow short buffers on OpenSSL 1.1.1\n (bsc#1270186).\n- CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length in rust-\n openssl crate (bsc#1270619).\n- CVE-2026-41678: openssl: incorrect bounds assertion in aes key wrap in rust-openssl crate (bsc#1270644).\n- CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check in rust-openssl crate\n (bsc#1270795).\n- CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent\n memory in rust-openssl crate (bsc#1270870).\n- CVE-2026-42327: openssl: arbitrary code execution via specially crafted certificate in rust-openssl crate\n (bsc#1270521).\n- CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding in rust-openssl crate\n (bsc#1270874).\n- CVE-2026-45784: openssl: out-of-bounds write in `CipherCtxRef::cipher_update_inplace` for AES-KW-PAD ciphers in rust-\n openssl crate (bsc#1270989).\n- CVE-2026-93599: rustls-webpki: panic via empty BIT STRING (bsc#1282217).\n- CVE-2026-93600: rustls-webpki: name constraints URI validation bypass (bsc#1282217).\n- CVE-2026-93601: rustls-webpki: name constraint bypass (bsc#1282217).\n- CVE-2026-93602: rustls-webpki: CRL revocation check bypass (bsc#1282217).\n- rust-shlex: Multiple issues involving quote API (RUSTSEC-2024-0006, GHSA-r7qv-8r2h-pg27) (bsc#1230032).\n\nChanges for rustup:\n\n- Update to version 1.29.1~0:\n * dist(rustup-init/sh): update commit shasum in help string\n * style(bin/rustup-init): reformat code\n * docs(changelog): update for v1.29.1 stable release\n * warn how to switch away from the deprecated complete profile\n * fix(cli/help): fix wording in `rustup run --help`\n * ci(docker/android): stop building OpenSSL\n * refactor(cli/docs): use tracing for docs opening status messages\n * refactor(self-update): rename Windows uninstall registry helpers\n * feat(test): isolate Windows registry state per test\n * docs(dev-guide): mention how to support new compilation targets\n * Fix funding link\n * chore(deps): lock file maintenance\n * refactor(cli/self-update): move `current_install_opts()` to `InstallOpts::display()`\n * refactor(cli/self-update): move `process` out of `InstallOpts`\n * fix(cli/self-update): postpone initialization of `Cfg` in `setup_mode`\n * refactor(cli/self-update): take `Process` in `check_existence_of_settings_file()`\n * fix(settings): prevent creating new file with `SettingsFile::read_settings()`\n * test(cli-inst-interactive): test file creation on cancelled installation\n * refactor(toolchain/names): inline `validate()` aliases into `FromStr`\n * refactor(toolchain/names): rename `validate()` to `normalize_name()`\n * fix minor typos\n * www: align copy icon\n * refactor(toolchain/names)!: remove `try_from_str!()`\n * refactor(toolchain/names)!: remove `from_variant!()`\n * Add `rustup doc --serve` to serve docs over local HTTP\n * Move doc() and man() into a new docs module\n * chore(github): comment out instructions in PR template\n * docs(dev-guide): reapply abandoned changes from #4970\n * Add riscv64 unknown linux musl support\n * fix(deps): update rust crate enum-map to v3\n * refactor(cli/self-update)!: rename `install()` to `InstallOpts::install()`\n * refactor(cli/self-update)!: rename `maybe_install_rust()` to `InstallOpts::install_rust()`\n * refactor(cli/self-update)!: rename `InstallOpts::install()` to `InstallOpts::select_toolchain()`\n * refactor(toolchain/names)!: make more clones during conversions explicit\n * refactor(cli/self-update): move message templates to `mod msg`\n * style(cli/self-update): reorganize imports\n * Add pull request template linking to the dev guide\n * doc: add AI policy to the dev guide\n * ci(dist): ensure pushing to `dev-static` on `stable` update\n * test(toolchain): add a test case for `rustup toolchain install --override`\n * feat(toolchain): add `--default` flag to `rustup toolchain install`\n * fix(toolchain): inline use of `set_override`\n * Add Enzyme to the list of rustup components\n * fix: repair toolchains without an installed manifest\n * refactor: expose the installed manifest path\n * Docs: Remove i686 `set default-host` example\n * fix(self-update): only remove complete profile lines\n * chore(deps): bump `platforms` to 4.1.0\n * chore(deps): remove pinned `openssl-src`\n * refactor: replace `cfg_if!{}` with `cfg_select!{}`\n * fix: Lock state file updates\n * Fix Rust 1.97 clippy warnings\n * uninstalls toolchains prior to deleting the rustup home folder\n * Take semver-compatible dependency updates\n * Upgrade platforms to 4\n * docs: update `CHANGELOG` for v1.29.1\n * Lock file maintenance\n * Remove Windows special case from `can_run`\n * diskio: drop unnecessary constructor wrapper\n * diskio: rename _IncrementalFileState to FileState\n * diskio: inline IncrementalFileState type alias\n * Minimize API visibility\n * toolchain: streamline validate() implementations\n * toolchain: avoid internal cloning\n * dist: drop unused conversion impl\n * dist: keep impls with type definitions\n * Don't hide allocations inside From impls\n * toolchain: drop impls for \u0026String\n * Warn on clippy::or_fun_call\n * Warn on clippy::needless_by_ref_mut\n * Warn on clippy::redundant_clone\n * Warn on clippy::manual_let_else\n * Warn on clippy::use_self\n * errors: box ToolchainDesc in RustupError variants\n * errors: box Manifest in RequestedComponentsUnavailable variant\n * No (more) need to allow clippy::arc_with_non_send_sync\n * Replace use of FnMut trait objects with custom trait\n * test(cli/self-upd): use direct arg0 override for `as_rustup_setup()`\n * chore(deps): update actions/cache action to v6\n * ci(windows): add support for aarch64-pc-windows-gnullvm target\n * ci(windows): refine MSVC/MINGW job step predicates\n * chore(deps): update actions/checkout action to v7\n * fix(deps): update rust crate itertools to 0.15\n * fix(progress): use the `prefix` placeholder instead of `msg` for component name\n * rustup: warn when no toolchain or default is configured\n * errors: extract default stable hint\n * feat(toolchain): make the \"installed\" text of a toolchain install green\n * Add aarch64-unknown-freebsd\n * chore: address linter warnings\n * chore(deps): bump to semver-compatible versions\n * Add funding links\n * ci(docker/freebsd): bump `clang` version to `freebsd14`\n * ci(freebsd): use FreeBSD 14.0 for full CI\n * chore(deps): update `curl`\n * feat(cli/rustup-mode): warn about auto-installation in some subcommands\n * refactor(config): accept `Cfg` in `EnsureInstalled::warn_auto_install()`\n * test(cli/rustup-mode): test auto-installation on to-be-deprecated subcommand\n * dist: move display_name() before other methods that it calls\n * chore(gitignore): add .cargo/config.windows-cross.toml to gitignore\n * docs(dev-guide): update platform-specific code guidance\n * docs(dev-guide): mention rust-analyzer support for Windows-specific code on Unix\n * docs(dev-guide): mention how to lint Windows-specific code on Unix\n * chore(config): add example config for cross checking and rust-analyzer\n * chore: add rust-analyzer example config\n * Display the full names of targets not matching the host target tuple\n * docs(dev-guide/tips-and-tricks): mention the `RUSTUP_FORCE_ARG0='rustup'` cargo alias\n * build(cargo): add `cargo` alias for `RUSTUP_FORCE_ARG0='rustup'`\n * docs: rename the repath helper variable\n * Remove double buffering when extracting archives\n * refactor(toolchain/distributable): return `EnsureInstalled\u003c\u003e` from `DistributableToolchain::install()`\n * docs(dev-guide/coding-standards): adapt style guide from rustls\n * fix(deps): update opentelemetry\n * feat(config): warn user if auto-install is enabled\n * refactor(config): return `EnsureInstalled\u003c\u003e` from more functions\n * refactor(config): extract `EnsureInstalled\u003c\u003e` wrapper type\n * test: make tests agnostic to external `RUSTUP_AUTO_INSTALL` and `RUST_RECURSION_COUNT`\n * test(dist): fail v2 manifest update when manifest disagrees with .sha256\n * fix(dist): propagate v2 manifest checksum failure instead of reporting \"unchanged\"\n * Align shell setup comments in install message\n * feat(cli/self-update): refine wording of \"already installed Rust\" warning\n * chore(settings): rename default_host_triple to default_host_tuple and alias old name\n * chore(settings): add test to parse default_host_triple in toml\n * test(download): also scrub `HTTP_PROXY` in `scrub_env()`\n * chore: document legacy default host setting\n * chore: rename internal tuple constants\n * chore: rename partially \"Triple\" to \"Tuple\" to reflect the new terminology\n * fix(cli/rustup-mode)!: complete `rustup show` if active toolchain is not installed\n * refactor(cli/rustup-mode): postpone eval of `active_toolchain_targets` in `show()`\n * refactor(cli/rustup-mode): postpone eval of `active_toolchain` in `show()`\n * refactor(cli/rustup-mode): reduce rightward drift in `show()`\n * refactor(cli/rustup-mode): refine usage of `stdout` term and locks in `show()`\n * feat(config): add `Cfg` field to force-disable auto-installation\n * Provide --yes alias for -y flag consistently\n * refactor(tests): rename triple to tuple\n * refactor: bulk rename triple to ruple\n * refactor: rename get_default_host_triple to default_host_tuple\n * test(download): support more feature flag combinations\n * docs: fix the FileBuffer::clear doc comment wording\n * docs: fix plural of VM in coding standards\n * fix(dist): bulk rename triple to tuple for variables and messages\n * refactor(dist): rename PartialTargetTriple to PartialTargetTuple\n * refactor(dist): rename triple module to target_tuple\n * refactor: remove PartialToochainDesc::has_triple() in favor to PartialTargetTriple::is_empty()\n * refactor(dist): rename TargetTriple to TargetTuple\n * fix(self-update): rename triple to tuple in self_update\n * dist: bump `rustup` version to v1.29.1\n * ci(linux/x64-musl): install missing libc dependencies\n * fix(tests): rename HOST_TRIPLE placeholder to HOST_TUPLE\n * fix(tests): rename this_host_triple() to this_host_tuple()\n * fix(init): rename triple to tuple to reflect the new terminology\n * fix(docs): rename triple to tuple to reflect the new terminology\n * chore(deps): update ubuntu docker tag to v26\n * Improve error message for incomplete toolchains\n * chore(deps): update bwoodsend/setup-winlibs-action action to v1.16\n * test(dist/manifest): use the reordered fixture in `manifest_serialized_with_sorted_keys`\n * docs: fix \"initial\" spelling in stylesheet variable\n * ci: powerpc64-unknown-linux-musl is now stable\n * style(cli/rustup-mode): address clippy warnings\n * docs(dev-guide): update release process with new backporting flow\n * docs: fix actions template README typo\n * Only show post-install instructions for currently installed shells\n * docs: fix Windows MSVC guide typo\n * Upgrade to rustls-platform-verifier 0.7\n * Make component removal best-effort and preserve single-error behavior\n * Use `cc-rs` to detect the default linker, instead of assuming `cc`\n * ci(test): add `workflow_dispatch` trigger on par with `schedule`\n * ci: fix incorrect `contains()` predicate\n * fix(dist/manifestation): fix log format when installing exactly 2 components\n * Allow rustup component add to install multiple components in one update #4787\n * fix(docs): correct link to `no-self-update` feature\n * ci: enable on all PR target branches\n * ci(backport): rename backport branches to `release/*`\n * feat(toolchain): run a pre-check before updating all toolchains\n * feat(install): accept an optional pre-fetched manifest when installing\n * fix(toolchain): extract manifest fetching out of `show_dist_version()`\n * fix(manifest): aggregate a manifest and its hash in a `ManifestWithHash` struct\n * fix: Reduce flickering by using `set_move_cursor`\n * ci(backport): add support for backporting\n * fix: install message misalignment.\n * refactor: extracted `progress_style` method for DownloadStatus\n * fix(deps): update rust crate sha2 to 0.11\n * chore(doc): Added comments for clarify the usage of `Component::name` `Manifest::name` and the `short_name` funcc accordingly.\n * refactor: Rename `Component`'s `name_in_manifest` to `name` and `short_name` accordingly\n * self_update: show path to executable in case of updater failure\n * Revert \"fix(ci/freebsd): install ca certs to prevent certificate-related issues\"\n * ci: don't install protoc\n * Update to mdbook 0.5\n * ci(all-features): bump protoc version\n * fix(dist/manifestation): use full toolchain name in `Update::unavailable_components()`\n * style(dist/manifestation): merge imports\n * Fix zsh completion showing all PATH entries for +toolchain arg\n * fix(cli/proxy-mode): stop enforcing `quiet: true`\n * chore(deps/freebsd): downgrade `libz-sys` to v1.1.24\n * fix(ci/freebsd): install ca certs to prevent certificate-related issues\n * fix(rustup-init/sh): prevent passing `--default-host` twice\n * Avoid warning about the existence of a `settings.toml` on a fresh install\n * use tuple instead of triple for env overrides\n * Take platforms 3.9.0\n * Unpin tracing-subcriber\n * chore(deps): update `aws-lc-rs` and `aws-lc-sys`\n * docs(changelog): update release date for v1.29.0\n * docs(dev-guide/release-process): mention the CfT blog post\n * docs(changelog): update for v1.29.0 stable release\n * fix(cli): Style CLI errors in init mode\n * test: Add unknown arg init test\n * chore(deps): update actions/upload-artifact action to v7\n * refactor(www): simplify instruction css selector\n * feat(www): make copy button dark mode-aware\n * feat(www): move feedback text out of copy button\n * fix(www): apply filter to rust logo\n * feat(www): add dark mode\n * refactor(www): extract css variables\n * fix(cli/self-update): enforce a newline after `check_updates()`\n * refactor(cli/self-update): extract `has_progress_bars` in `check_updates()`\n * fix(cli/self-update): unify `check_*update*()`'s message formats\n * docs(downloads): fix the default number of `RUSTUP_CONCURRENT_DOWNLOADS`\n * feat(toolchain): add `--override` to override toolchain as soon as installed\n * fix(toolchain): improve logs when recovering from an interrupted installation\n * chore(deps): downgrade `openssl-src` to 300.5.4+3.5.4\n * style(download): clean up imports\n * fix(diskio): fall back to single-threaded unpacking when `ram_budget` \u003c 512MB to avoid OOM on memory-constrained systems\n * test(downloads): check if an error is thrown if the server does not honor range\n * fix(downloads): check correct response when resuming from partial (reqwest)\n * fix(downloads): check correct response when resuming from partial (curl)\n * fix(deps): update rust crate toml to v1\n * fix(dist/manifest): sort keys when serializing `Manifest`\n * hack(ci/linux): disable BuildKit when building local images\n * chore(ci): use more distinctive local image names\n * Upgrade rand to 0.10\n * Upgrade snapbox to 1\n * Upgrade to anstream 1\n * fix(downloads): adjust error message for partial files in network failures\n * test(downloads): ensure that partial files are not removed when network fails\n * feat(downloads): do not delete partial download when network fails\n * fix(downloads): substitute `DEK` alias for `DownloadError`\n * chore(deps): update aws-actions/configure-aws-credentials action to v6\n * cli: introduce semantic exit code constants for rustup check\n * Add missing Windows SDK instructions\n * Add winget instructions to MSVC install page\n * Remove nu-string-interpolation `$`\n * Replace $nu.home-path with ~\n * feat(cli/rustup-mode): add \"Exit status\" section to `rustup check --help`\n * Add common commands section in help text\n * fix(cli/rustup-mode): improve exit code of `rustup check`\n * refactor(test)!: pass status code directly to `SanitizedOutput`\n * Add powerpc64-unknown-linux-musl support\n * fix: add copy_file_symlink_to_source for self-installation\n * fix: preserve symlinks in copy_dir instead of following them\n * feat(cli/rustup-mode): add `doc --rustc-docs` to open rustdoc for Rust internals\n * Remove the mixed singular/plural phrasing as \"component(s)\" instead, use \"components\" or \"component\".\n In the singular case also add the name of the component for more consistent messaging style with\n other info! outputs about single components.\n * fix(cli/rustup-mode): `check` for self updates for `SelfUpdateMode::CheckOnly`\n * test: Add test for sequential multi-toolchain uninstall\n * fix: directory removal race condition in toolchain uninstall\n * test(cli_v2): test error when missing many components on install\n * fix(dist): adjust printed newlines in `components_missing_msg()`\n * unified nightly disclaimer wording/styling; preserved distinct messages per scenario\n * Upgrade to reqwest 0.13\n * change test name to match new terminology\n * rename file to match new terminology\n * change 'target triple' to 'target tuple'\n * fix(toolchain): forbid toolchain names starting with +\n * cli: add `doc --releases` to open release notes\n * chore(deps): update actions/upload-artifact action to v6\n * chore(deps): update actions/cache action to v5\n * dist: use more concise API in helper function\n * dist: inline more logic into helper function\n * dist: give helper function a more meaningful name\n * dist: move helper function closer to usage site\n * docs(dev-guide): mention snapshot updating in release process\n * fix(toolchain): avoid unwrapping when parsing a toolchain name\n * fix(toolchain): change regex to reject leading zeros in toolchain name\n * docs(changelog): update for v1.29.0 beta release\n * dist: bump `rustup` version to v1.29.0\n * docs(changelog): add missing link references\n * test(static-roots): use a more compact syntax for raw binaries\n * test(static-roots): return `Result` from `store_static_roots()`\n * download: statically bundle relevant trust anchors\n * Added xonsh support\n * refactor(dist/manifestation): remove redundant redeclarations\n * docs(dist/download): remove outdated note on concurrent download progress reporting\n * fix(dist/download): align `total_bytes` fields in progress reporting UI\n * fix: default to GNU host in Cygwin/MSYS/MinGW environments (#4221)\n * chore(config): remove redundant imports\n * fix(dist/manifestation): print \"downloading component\" only on `InstallEvents`\n * fix(utils): downgrade panic to warning in `delete_dir_contents_following_links()`\n * chore(deps): update actions/checkout action to v6\n * Prepare for mdbook 0.5 migration\n * dist: make installation asynchronous\n * dist: make installations 'static\n * dist: take ownership of Manifestation\n * dist: store owned temp::Context in Transaction\n * dist: store temp::Context in DownloadCfg\n * dist: align progress bar elements\n * dist: track progress during unpacking\n * utils: drop unused reader tracking\n * process: fix refresh rate for progress bars\n * process: reduce duplication in ProgressDrawTarget setup\n * Yield references from Manifest::short_name()\n * Move Component name helpers to Manifest\n * dist: simplify ComponentBinary construction\n * dist: hoist creation of io_executor some more\n * Move unpack_ram() from dist to diskio\n * dist: hoist Executor creation up\n * dist: inline effective RAM limit calculation\n * dist: hoist environment variable extraction\n * dist: use logging for missing parent warnings\n * dist: clarify dependency on unpack RAM budget\n * diskio: clarify dependency on I/O thread count\n * dist: transfer ownership of component values\n * dist: take ownership of existing Components\n * dist: take ownership of toolchain name in update()\n * dist: take ownership of manifest in update()\n * dist: derive trivial initialization for Update\n * dist: rename Update::build_update() to new()\n * dist: linearize for-loop in Update::build_update()\n * dist: inline single-use function\n * dist: inline trivial helper function\n * dist: inline single-use tranaction change helpers\n * dist: store specific config bit in Transaction\n * chore(config): migrate config .github/renovate.json\n * dist: attach manifest download functions to DownloadCfg\n * rustup: unhide top-level install/uninstall commands\n * dist: move update_from_dist() to DistOptions::install_into()\n * Be more consistent about aliases for different subcommands\n * test: add test for `rustup toolchain install --no-update`\n * feat(rustup-mode): add `no_update` flag to `rustup toolchain install`\n * cli: prepare DistOptions in advance\n * dist: inline trivial wrapper function\n * cli: inline single-use update_all_channels() helper\n * config: simplify update_all_channels()\n * dist: deduplicate DistOptions initialization\n * dist: avoid recomputing dist root URL\n * dist: simplify tracing instrumentation\n * install: take ownership in InstallMethod::install()\n * dist: move DistributableToolchain::install() up\n * dist: clarify when update_hash is available\n * cli: avoid dropped temporary\n * Take semver-compatible dependencies\n * dist: install while downloading\n * dist: store more context in ComponentBinary\n * dist: yield self when download is complete\n * dist: move URL alteration logic into DownloadCfg method\n * Apply suggestions from clippy 1.91\n * refactor(check): Consolidate use_colors checks\n * fix(check): Use Cargo's colors\n * refactor(check): Make calls more consistent\n * dist: drop another layer of abstraction\n * dist: store package directory once\n * dist: inline short single-use function\n * dist: discard unnecessary abstraction layer\n * chore(deps): update actions/upload-artifact action to v5\n * fix(cli/rustup-mode): add missing self-update in `rustup toolchain install`\n * refactor(cli/self-update): move `self_update()` to `SelfUpdateMode::update()`\n * refactor(cli/rustup-mode): pass self-update predicates into `self_update()`\n * refactor(cli/self-update): import `utils::ExitCode`\n * rustup: tweak update check output style\n * fix(list): Match show command's styling\n * test(list): Add UI test\n * fix(toolchain): Have 'list' match 'show's styling\n * refactor(toolchain): Order logic by display order\n * refactor(toolchain): Use string interpolation\n * test(toolchain): Show list's behavior\n * fix(update): Match 'cargo update's colors\n * refactor(update): Centralize style knowledge\n * test: Cover different show_channel_update cases\n * fix(check): Subject check to RUSTUP_TERM_COLOR\n * test(check): Show current style\n * fix: Use HEADER styling in 'rustup show'\n * chore: Update clap-cargo\n * test: Demonstrate show's behavior\n * test(process): Allow forcing color on\n * test(process): Ensure non-locked writes are stripped of ANSI escape codes\n * cli: update `uninstall_removes_source_from_rcs` to mirror `uninstall_doesnt_modify_rcs_with_no_modify_path`\n * cli: add tests for `rustup self uninstall --no-modify-path`\n * cli: add `rustup self uninstall --no-modify-path`\n * cli: add help text for `rustup self uninstall -y`\n * fix(cli/help): change indentation of discussions to 2 spaces\n * fix(cli/help): adjust help text for `rustup install`\n * feat(cli/help): add toolchain install tips to `rustup update`'s discussion\n * feat(cli/help): discuss `rustup toolchain install`\n * style: Remove wildcard imports\n * progress: modify progress bar's states to be column-aligned\n * installations: handle installation of components through progress bars\n * feat(cli): Add a sub-heading style for 'completion' Help Discussion\n * feat(cli): Have Help Discussions match rest of CLI Help\n * feat(cli): Add color to clap help/errors\n * refactor(cli): Switch help text to functions\n * cli: propagate ActiveSource from the top\n * cli: upgrade error events to ERROR level\n * cli: inline Cfg::active_rustc_version()\n * cli: extract display_version() from rustup main()\n * cli: inline Cfg::resolve_local_toolchain()\n * cli: inline Cfg::resolve_toolchain()\n * config: extract setting of toolchain override in rustup help mode\n * cli: avoid Cfg construction indirection\n * config: privatize some Cfg fields\n * config: drop trivial Cfg setters\n * Expand `RUSTUP_TOOLCHAIN_SOURCE`'s documentation\n * refactor(installation): extract installation of a component into a separate function\n * bin: clean up imports\n * cli: rename CLIError to CliError\n * config: rename OverrideDB to OverrideDb\n * dist: clean up unnecessary qualification\n * test: Replace trycmd with snapbox\n * chore: Update snapbox\n * Update the default Windows SDK version\n * refactor(log): Single source RUSTUP_TERM_COLOR\n * style: Encourage using existing imports\n * process: avoid fine-grained locking for logs\n * process: discard unnecessary layer of synchronization\n * process: inline TerminalInnerLocked\n * process: replace unsafe code with safe equivalent\n * process: extract color_choice() method\n * process: extract is_a_tty value\n * process: inline StreamSelector::is_a_tty()\n * process: inline TestWriterLock\n * Implement `RUSTUP_TOOLCHAIN_SOURCE` with new `Display` impl\n * Move `Display` impl to `to_reason()`\n * Rename `ActiveReason` to `ActiveSource`\n * dist: simplify DownloadStatus setup\n * dist: decentralize download status\n * dist: postpone creation of ComponentBinary values\n * dist: extract DownloadStatus type\n * dist: call DownloadTracker methods directly\n * dist: drop unnecessary Notifier layer\n * dist: replace PackageContext with DownloadCfg\n * refactor: Directly apply styling\n * refactor: Don't bother grabbing lock for tests\n * refactor: Replace termcolor with anstream\n * refactor: Move style building out of ColorableTerminal\n * refactor: Migrate to anstyle for color definitions\n * fix(www): removes www subdomain from all rust-lang.org urls\n * dist: move Notification into dist::download\n * notifications: remove unused Display impl\n * dist: move Notifier into DownloadCfg\n * cli: build Cfg earlier in setup mode\n * dist: reuse existing DownloadCfg in update_v1()\n * dist: move dist_root out of DownloadCfg\n * dist: drop unused Clone derives\n * dist: drop Copy derive from DownloadCfg\n * dist: move Notifier and DownloadTracker into dist::download\n * dist: inline DownloadCfg test setup\n * download: move File items down\n * download: extract DownloadCfg initialization from Cfg\n * config: discard pointless method argument\n * cli: rename DownloadTracker::new_with_display_progress() to new()\n * notifications: log directly from DownloadTracker\n * notifications: log directly on bad download checksums\n * notifications: log directly when reusing downloaded files\n * notifications: log directly on buffer size changes\n * Update platforms to 3.7.0\n * notifications: log directly on duplicate toolchain files\n * notifications: log directly on metadata upgrades that remove toolchains\n * notifications: log directly when reading metadata version\n * notifications: log directly when metadata upgrade is not needed\n * notifications: log directly when upgrading metadata version\n * notifications: log directly when uninstalling toolchains\n * notifications: log directly when toolchain is up to date\n * notifications: log directly when toolchain has been installed\n * notifications: log directly when installing toolchains\n * notifications: log the toolchain directory directly\n * notifications: log directly when using existing toolchains\n * notifications: log directly when looking for toolchains\n * notifications: log directly when setting auto-self-update mode\n * notifications: log directly when setting profile\n * notifications: log directly when setting overrides\n * notifications: use human-friendly log format for temp file deletions\n * notifications: use human-friendly log format for directory deletions\n * notifications: use human-friendly log format for retrying renames\n * notifications: use human-friendly log format for path canonicalization\n * cli: drop unnecessary generics\n * process: import instead of qualifying ColorableTerminal\n * process: hide internal structure\n * process: don't re-export external items\n * process: rename terminalsource to terminal_source\n * process: rename filesource to file_source\n * process: re-order items in terminalsource module\n * feat(cli/self-update): add support for PowerShell on Unix systems\n * refactor: Remove unused traits\n * refactor: Directly use ColorableTerminal\n * refactor: Simplify working with ColorableTerminal\n * fix(process): Ensure stdout/stderr lock is held across calls\n * refactor(process): Centralize Write bookkeeping\n * docs(changelog): describe default profile change during auto-install\n * Fix typo in clitools.rs comment\n * ci(docs): fix local doc branch name\n * Move the default branch from `master` to `main`\n * Upgrade opentelemetry dependencies\n * ci: use macOS Intel runners\n * notifications: log directly when setting the default toolchain\n * notifications: log directly when setting auto install mode\n * notifications: log directly when resuming partial downloads\n * notifications: log directly when downloading files\n * notifications: log directly when removing stray hash files\n * notifications: log directly when skipping components\n * notifications: log directly on missing components\n * notifications: log directly when downloading legacy manifests\n * notifications: log directly for downloaded manifests\n * notifications: log directly for manifest downloads\n * notifications: log directly when removing components\n * notifications: log directly when installing components\n * notifications: log directly after failing to determine memory limit\n * notifications: log directly when hash file not found\n * notifications: log directly when failing to update hash file\n * notifications: log directly when component is already installed\n * notifications: log directly for valid checksums\n * notifications: log directly when using download backends\n * chore: avoid trailing whitespace in error message\n * refactor: Switch logging to anstyle\n * refactor: Remove unused ColorableTerminal::carriage_return\n * notifications: privatize Notification type\n * notifications: log directly on creating temp files\n * notifications: log directly on temp root creation\n * notifications: log directly on file deletions\n * notifications: log directly on directory deletions\n * notifications: log directly about non-fatal errors\n * notifications: log directly about rolling back changes\n * notifications: log directly for retrying renames\n * notifications: log directly when removing directories\n * notifications: log directly when copying directories\n * notifications: log directly when linking directories\n * notifications: log directly when path canonicalization fails\n * notifications: log directly when creating directories\n * tests: use DistContext for dist::components tests\n * tests: move DistContext into library\n * tests: deduplicate distribution installation tests\n * notifications: tweak style\n * Inline utils Notification variants into top-level Notification\n * Inline dist Notification variants into top-level Notification\n * Inline dist::temp::Notification variants into top-level Notification\n * dist: remove temp::Notification variant from dist::Notification\n * dist: extract URL alteration from download() method\n * dist: detach download_component() from Manifestation\n * dist: introduce ComponentBinary type\n * dist: avoid passing through arguments\n * dist: avoid unnecessary type annotations\n * dist: avoid cloning components Vec\n * refactor: remove redundant references\n * dist: simpify casting to trait object\n * dist: deduplicate decompression setup code\n * cli: move more self update logic into self_update module\n * refactor(dist/manifestation): remove redundant `.to_string()`\n * Remove unneeded paranthesees\n * Fix link in the bug reporting template\n * ci(all-features/windows): update `OPENSSL_LIB_DIR` for OpenSSL v3 compatibility\n * docs(dev-guide): improve suggestion for overriding arg0\n * docs(dev-guide): mention the arg0 override trick on welcome page\n * docs(README): link CI status badge to GitHub Actions panel\n * feat(dist/manifestation): adjust default concurrent downloads when installing toolchains\n * feat(cli/rustup-mode): check updates for all channels unless `RUSTUP_CONCURRENT_DOWNLOADS` is set to 1\n * refactor: rename `num_channels` to `concurrent_downloads`\n * fix: fix hang by preventing `stream.buffered(0)` in concurrent downloads\n * test(dist/manifestation): extract `TestContext::*with_env()`\n * refactor(download): use `NonZero` instead of `NonZeroU64`\n * refactor(process): remove redundant `.context()` in `Process::concurrent_downloads()`\n * chore(deps/renovate): group version bumps for `windows-rs` crates\n * Upgrade windows crates\n * fix(cli/rustup_mode): use ASCII-compatible spinner\n * chore(deps): update aws-actions/configure-aws-credentials action to v5\n * feat(install): warn if default linker (cc) is missing; add respective test case\n * Remove hardcoded dependency to the master branch\n * feat(downloads): delay the reappearance of the progress bar when retrying a download\n * fix(downloads): correct faulty behavior when a download fails\n * fix(downloads): correct faulty output when retrying a download\n * feat(self_update): add tcsh shell support to cli #3413\n * Replace non_empty_env_var() with Process::var_opt()\n * fix(downloads): report real elapsed time of a component downloads instead of cumulative\n * Treat empty environment variables as unset\n * fix(downloads): honor the RUSTUP_CONCURRENT_DOWNLOADS by always having \"n\" concurrent downloads\n * chore(deps): disable default features for zstd\n * feat(downloads): introduce `RUSTUP_CONCURRENT_DOWNLOADS` to control concurrency\n * ci(check): make installation of `taplo-cli` faster\n * fix(notifications): delete unnecessary Download(Pop/Push)Unit notifications\n * fix(downloads): extract closure for downloading a component into a separate function\n * feat(downloads): concurrently download components\n * fix(downloads): add a comment to justify the unwrap on `.get()` of `OnceLock`\n * chore(deps): update actions/checkout action to v5\n * fix(download_timeout): introduce RUSTUP_DOWNLOAD_TIMEOUT for overriding download timeout\n * fix(downloads): substitute the LazyLock for a OnceLock\n * feat(rustup_mode): revise help message\n * feat: improve error message for `rustup which`\n * test: detach snapshots from component installation order\n * feat(download_tracker): refactor in favor of `indicatif`\n * feat(process): create a `ProgressDrawTarget` (for `indicatif`) inside the `Process`\n * fix(rustup-init/sh): avoid `hw.optional.*: 1` stdout in macOS arch check\n * hack(cli/common): suppress host emulation warnings in rustup's own CI\n * fix(test/clitools): pass `RUSTUP_CI` to in-process tests\n * ci(macos): run x64 workflows with Rosetta 2\n * docs(user-guide/environment-variables): clarify the unit of `RUSTUP_UNPACK_RAM`\n * docs(user-guide/environment-variables): unify description style\n * docs(user-guide/environment-variables): update description of `RUSTUP_IO_THREADS`\n * Limit Tokio worker threads to I/O thread count\n * Use manual Tokio runtime setup\n * Attach io_thread_count() to Process\n * Always consider RUSTUP_IO_THREADS as input for thread count\n * utils: express io_thread_count() in a simpler way\n * opt(err): show renaming file error source\n * Set a maximum thread limit for remove_dir_all\n * fix(toolchain/distributable): refine handling of known targets with no prebuilt artifacts\n * fix(ci/fetch-rust-docker): update comments\n * fix(ci/docker): update `CC` name for `powerpc64le-unknown-linux-gnu`\n * Extract self_update() from update_all_channels()\n * Show channel updates even if self update is not permitted\n * Remove Cargo feature indirection\n * Move Cfg::get_self_update_mode() to SelfUpdateMode::from_cfg()\n * Replace trivial enum with bool\n * feat(updates): introduce `RUSTUP_TERM_WIDTH` to override terminal width\n * feat(updates): introduce `RUSTUP_TERM_PROGRESS_WHEN` to toggle the progress bars\n * Limit the default number of I/O threads\n * Bump `toml` to 0.9\n * feat(updates): check for updates concurrently\n * feat(terminal): implement the `TermLike` trait for `ColorableTerminal`\n * chore: use match ergonomics in favor of explicit `ref`s\n * refactor(download/curl): use early returns in `download()`\n * chore(cli/rustup_mode): merge `std` imports\n * chore(cli/rustup-mode): import `std::io`\n * chore: fix new `clippy` warnings\n * fix(ci/run): specify target triple for `bindgen-cli` installation\n * feat(www): improve \"copy\" button style compatibility with Chromium\n * ci(run): install `codegen-cli` with `cargo-binstall`\n * docs: replace Discord links\n * Block broken snap curl\n * Upgrade to windows-sys 0.60\n * Emphasize that `llvm-tools` dist component is not subject to compiler stability guarantees\n * docs(README): update CI status badge\n * Fix rustup-init.sh cputype check for sparcv9\n * add Solaris support\n * test(clitools)!: remove all deprecated `.expect_*()` APIs\n * test(clitools)!: privatize `Config::run()`\n * test: migrate remaining uses of `.run()` to `.expect()` APIs\n * test(clitools): extract `Assert::redact()`\n * test: simplify `.display().to_string()` in `.extend_redactions()`\n * test(cli_misc): bring back missing assertions\n * Update help.rs: bash completions instructions (#1)\n * docs(user-guide): fix typo\n * docs(dev-guide): update the section on `clippy` lints\n * docs(dev-guide): mention test helpers and `Assert`\n * docs(test/clitools): add docs for `Assert`\n * Upgrade to rustls-platform-verifier 0.6\n * test(cli-v2): migrate to `.expect()` APIs\n * test(cli-misc): migrate to `.expect()` APIs\n * fix(toolchain): fix proxy fallback notification format on Windows\n * test(cli-v1): migrate to `.expect()` APIs\n * test(download): serialize tests with proxy-sensitive URLs\n * test(cli-rustup): migrate to `.expect()` APIs\n * test(clitool): add `Assert::remove_redactions()`\n * test(clitools): allow `OsStr`-like args in `Config::expect*()`\n * Fix CI image names for downloading ARM and PowerPC artifacts\n * Update platforms to 3.6\n * test(cli-exact): migrate to `.expect()` APIs\n * Avoid swallowing errors in show()\n * Simplify target processing logic\n * Inline returned bindings\n * Increase Windows main thread stack size to 2mb\n * test(cli-inst-interactive): migrate to `.expect()` APIs\n * Unset RUSTUP_AUTO_INSTALL for tests\n * test(cli-paths): migrate to `.expect()` APIs\n * test(cli-exact): use the new `[CURRENT_VERSION]` redaction\n * test(cli-self-upd): migrate to `.expect()` APIs\n * Tweak list_items() docstring\n * Leverage bool::then_some() to simplify some code\n * Avoid intermediate allocation in listing\n * test(custom-toolchains): `target list` now can display the installed targets\n * feat(custom-toolchains): `target` and `component list` working on custom toolchains\n * Skip manifest loading if there are no components/targets to check\n * fix(deps): update rust crate opener to 0.8.0\n * rustup check: set exit status based on available updates\n * rustup check: adopt no-self-update logic\n * feat(self_update): add proxy sanity checks\n * style(test): qualify uses of `snapbox::str![]`\n * refactor(test): migrate some tests to `.expect()` APIs\n * chore(test): deprecated old APIs overlapping with the new ones\n * refactor(test): add new `.expect()`-based testing APIs\n * test(custom-toolchains): using `show` on a custom toolchain without a `components` file\n * test(custom-toolchains): add test to showcase that the issue was solved\n * feat(custom-toolchains): `rustup show` now reporting installed targets\n * tests: print diffs on test failures\n * Log versions during self updates\n * Fix cargo lints on Windows\n * toolchain: hoist binary name conditionals out of fallback functions\n * refactor(test): replace `TempDir::into_path()` with `TempDir::keep()`\n * refactor(test/clitools): use globally-defined `tempdir_in_with_prefix()`\n * feat(toolchain): notify the user when proxy fallback is activated\n * feat(toolchain): consider external `rust-analyzer` when calling a proxy\n * refactor(toolchain): move predicates into `Toolchain::maybe_do_cargo_fallback()`\n * refactor(toolchain): privatize `Toolchain::maybe_do_cargo_fallback()`\n * deps: update aws-lc-rs to 1.13.1\n * docs(changelog): mirror changes from the release announcement, take 2\n * Deprecate native-tls as well\n * Enable HTTP/2 support for reqwest download backend\n * Emit tracing events from log facade calls\n * download: show Debug representation for errors\n * Avoid repeated globals in tracing events\n * Log original download errors immediately\n * feat(cli/rustup-mode): add aliases to `rustup component remove`\n * Switch flate2 to use the zlib-rs backend\n * Hardlink proxies if symlinks aren't reachable\n * Add powerpc64le-unknown-linux-musl support\n * Add toolchain_name to not installed bail msg\n * Warn about using curl\n * Drop workspace indirection\n * Fold download crate back into rustup\n * download: merge integration test files\n * Test CARGO environment replacement\n * Update CARGO env var if it is a rustup proxy\n * Tweak toolchain subcommand help text\n * Move toolchain and default commands first\n * show toolchain paths in rustup show -v output\n * refactor(cli/self-update): save allocations in `Nu::rcfiles()`\n * fix(cli/self-update)!: stop appending to `env.nu` due to deprecation\n * fix(cli/self-update): consider Windows paths in Nushell suggestions\n * refactor(cli/self-update): use `path add` in `env.nu` template\n * fix(cli/self-update): use interpolated string in `env.nu` template\n * Upgrade dependencies\n * docs(user-guide/environment-variables): document `RUSTUP_VERSION`\n * feat(rustup-init/sh): allow setting `RUSTUP_VERSION` during installation\n * feat(cli/self-update): allow setting `RUSTUP_VERSION` for arbitrary\n downgrades\n * feat(test/clitools): add `Config::expect_ok_ex_env()`\n * fix(errors)!: improve error messages for `RustupError::ToolchainNotInstalled`\n * Add set auto-install disable\n * Use `cursor: pointer` for copy button on website\n * fix(dist): refine suggestions about missing targets\n * Append Windows bin directory to PATH by default\n * Remove validation for custom toolchains when reading rust-toolchain.toml\n * document RUSTUP_AUTO_INSTALL\n * Fix build script `cargo` instructions\n","status":"published","published":"2026-10-02T19:21:30Z","modified":"2026-10-09T17:23:09.148573446Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:2777-1","title":"Security update for cryptsetup, s390-tools","description":"This update for cryptsetup, s390-tools fixes the following issue\n\nSecurity fixes:\n\n- CVE-2026-41676: openssl: `Deriver:derive` and `PkeyCtxRef:derive` can overflow short buffers on OpenSSL 1.1.1 (bsc#1270185).\n\nChanges for s390-tools:\n\n- Upgrade s390-tools to version 2.41.0 (jsc#PED-15860)\n- Automatically set appropriate MTU for HSCI (bsc#1259314)\n - Changes of existing tools:\n * chreipl: Make --bootparms work for ECKD re-IPL\n * cpacfstats: Add 'unauthorized' state to CPU-MF counters\n * cpictl: Detect RHCOS using VARIANT_ID\n * hsci: Automatically set appropriate MTU for HSCI\n * libutil: Add util_readlink() and util_readlinkat() helpers\n * libutil: Add util_startswith() to util_str\n * libutil: Add utility parsing functions\n * lschp: Add support for structured output (--format)\n * lsreipl: Suppress 'clear' output if not supported\n * pvimg: Add '--format text' support to 'pvimg info'\n * pvimg: Add '--print-schema ' option to 'pvimg info'\n * pvimg: Add '--show-secrets' flag to 'pvimg info'\n * pvimg: Provide improved JSON output to 'pvimg info --format json'\n * pvinfo: Improve User experience on non-SE enabled systems\n * zipl/ngdump: Ensure ext4 file system is used on dump partition\n * zkey: Add support for integrity protected disks using HMAC keys\n- Bug Fixes:\n * cpumf/pai: Handle different size of perf_event_attr\n * lscss: Fix memory leak\n * zipl: Fix dump job on tape devices\n--- s390-tools 2.40 includes ---\n- Add new tools / libraries:\n * Add project-wide .clang-tidy configuration\n * libutil: Introduce util_time for time related functionality\n * libutil: Introduce zsh/bash autocompletion tooling based on util_opt\n * pvinfo: Tool to display Secure Execution system information\n * pvverify: Tool to verify host-key documents\n- Changes of existing tools:\n * cpumf: Implement zsh and bash autocompletion\n * dasdfmt: Implement zsh and bash autocompletion\n * dbginfo.sh: Add NetworkManager and netplan\n * dbginfo.sh: Add kvm_stat\n * dbginfo.sh: Adding stp time information\n * dbginfo.sh: Simplify procfs collection\n * hyptop: Add physical information row\n * hyptop: Calculate sample time delta for physical partition\n * hyptop: Replace long option names using _ with - for consistency\n For example: --cpu_types \u003e --cpu-types\n (Options with _ are still supported for backward compatibility)\n * libekmfweb: Add function to validate a certificate against the identity key\n * netboot: Add longer kernel command lines support\n * udev/rules.d: Make virtio-blk devices non-rotational\n * udev/rules.d: Set default io scheduler to 'none' for virtio-blk\n * ziomon: Add support to sample device symlinks (/dev/disk/...)\n * ziorep_config: Add fcp-lun details to -M option output\n * ziorep_config: Add port_id and failed attributes to -A option output\n * netboot: Install on non-s390 architectures\n- Bug Fixes:\n * lib(ekmfweb|kmipclient): Use ln without -r\n * s390-tools: Fix various compilation issues with musl libc\n * zipl/boot: Fix unused loadparm when SCLP line-mode console is absent\n--- s390-tools 2.39 includes ---\n- Changes of existing tools:\n * chpstat: Add options to select IEC units for scaling (SI units are default)\n * chzdev: Introduce --no-module-load option\n * cpi: Disable CPI for SEL guests by default\n * dbginfo.sh: Enhance logging on timeout triggered\n * iucvterm: Install symlink for lsiucvallow.8 man page\n * lshwc: Add command line flag to specify individual counters\n * lspai: Add command line flag for delta values\n * lspai: Add command line flag for short counter names\n * lspai: Add command line flag to specify individual counters\n * lspai: Add command line flags for all cpus\n * lspai: Add command line flags for hexadecimal output\n * man: Use CR for constant width font\n * pvimg: Add '--image-key' option\n * zdev: Allow dynamic control of module load\n * zipl/boot: Fix EBCDIC code page 500 conversion and decrease size by 200 bytes\n * zipl: Add support of heterogeneous mirrors (remove technical limitations\n on mirrored targets, thus allowing mirrored devices consist of partitions\n at different offsets on disks of different types and geometry).\n * zkey: Add support for generating and importing exportable secure keys\n- Bug Fixes:\n * chpstat: Fix scaling of DPU utilization calculation\n * zdev/dracut: Prevent loading of unused kernel modules\n * zdev: Fix double device configuration on DPM systems\n * zdev: Fix double device configuration with rd.dasd\n * zipl_helper.device-mapper: Fix segfault in an error path\n--- s390-tools 2.38 includes ---\n * Add new tools\n - udev: New rule to set newly hotplugged CPUs online\n - zmemtopo: Display memory topology information\n - zpwr: Display power readings of a partition and CPC\n * Removed tools / features\n - check_hostkeydoc: Remove installation target\n - scsi_logging_level: Delete SCSI logging script (available in sg3_utils)\n - zdump: Drop build_arch for s390 DASD dumps\n - zdump: Drop non-extended multi-volume DASD dump support\n - zdump: Drop support of 32-bit dump architecture\n - zdump: Drop support of non-extended single volume DASD dumpers\n - zdump: Drop support of obsolete dumps and dumpers\n * Changes of existing tools / libraries\n - Various man-pages fixes\n - check_hostkeydoc: Add deprecation warning\n - check_hostkeydoc: Move to scripts directory\n - cpuplugd: Allow cpu hotplugging on systems without polarization\n - dbginfo.sh: Add Ubuntu snap tool\n - dbginfo.sh: Add missing config data and logs\n - dbginfo.sh: Reworking the container section\n - dbginfo.sh: Update for network commands\n - dbginfo.sh: Updating info for disks and lvm\n - libutil: Add machine type definition for machines 9175 and 9176\n - lscpumf: Add support for IBM z17 counter sets\n - lshwc: Add command line flag for run time\n - lshwc: Add flags to display counter values in hex\n - lshwc: Add output '--format' option\n - lshwc: Add support for delta counter value display\n - lspai: Add output '--format' option\n - lsreipl: Add secure boot state to output\n - lswhc: Add short names to lshwc output\n - pv_tools: Add Bash and Zsh completions\n - pvapconfig: Add '--unbind' option\n - pvimg/boot: Print error messages from stage3a bootloader\n - pvimg: Add support for CCK update\n - pvsecret: Add support for CCK update\n - pvsecret: Allow retrieving secrets by index; warn for duplicated entries\n - pvsecret: Deny adding secrets with duplicated secret IDs\n - zdev: Add support for virtio devices\n - zipl: Enhance mirror support\n - zipl: Implement '--dry-run' option for all dump jobs\n - zipl_helper.device-mapper: Support mirrors over NVMe devices\n - zkey/dracut: Add a dracut config file for zkey\n - zkey/initramfs: Update initramfs hook to correct drivers and include zkey plugins\n - zkey: Add support for converting a clear-key LUKS2 volume to use a secure key\n * Bug Fixes\n - chpstat: Add missing CMG 5 data fields\n - chpstat: Fix DPU utilization calculation\n - libutil/util_file: Handle over-read in util_file_read_fd()\n - pvattest: Fix successful 'check' evaluation\n - pvsecret: Fix some edge cases for plaintext keys\n - zipl_helper.device-mapper: Fix imprecise is_device_mapper() predicate\n - zkey: Fix EP11 secure key reencipher function\n - zpcictl: Fix command line parsing for invalid options\n- Amended the .spec file\n * 'Installing' all shipped rules from etc/udev/rules.d to /usr/lib/udev/rules.d\n * BuildRequires: cryptsetup-devel \u003e 2.8.2\n- Updated the code for IBM z17 machine type 9176:\n * read_values.c\n * cputype\n * Renamed cputype.1 to cputype.8 and amended\n * Amended read_values.8\n- 'Improved' the read_values.c:\n * Added functionalities for '-a' and '-L attributes'\n- Removed legacy suse_version and sle_version conditionals, standardizing on UsrMerge paths.\n- Reworked and combined all s390-tools patches (jsc#PED-14586)\n- Added new combined and reworked patches\n- Removed obsolete patches\n- Applied patches (bsc#1261813)\n * Replace sort_field option with sort\n * hyptop opts Fix long command line option abbreviations\n- Removed obsolete patch\n- Re-vendor-ed vendor.tar.zst\n\nChanges for cryptsetup:\n\n- Update to 2.8.4: (jsc#PED-15889)\n * Fix integritysetup resize (grow) of the device if integrity bitmap\n mode is used. Increasing the integrity device in bitmap mode did\n not work as integritysetup incorrectly used journal settings that\n were not applicable.\n * Fix device size status reports in cryptsetup and integritysetup.\n If the device uses a sector size larger than 512 bytes, the newly\n reported byte sizes (introduced in 2.8.0) in the status report\n were incorrectly displayed.\n * BITLK: Fix unlocking BitLocker device with recovery passphrase.\n If the recovery passphrase was present in the first keyslot, the\n device failed to unlock. This bug was introduced in 2.8.2 with\n Clear Key support.\n\n- Update to 2.8.3:\n * Stable bug-fix release with minor extensions.\n- Update to 2.8.2:\n * BITLK: Fix for BitLocker metadata validation on big-endian systems.\n\n- Update to 2.8.1:\n * Fix status and deactivation of TCRYPT (VeraCrypt compatible) devices that use chained ciphers.\n * Fix unlocking BITLK (BitLocker compatible) devices with multibyte UTF8 characters in the passphrase.\n * Do not allow activation of the LUKS2 device if the used keyslot is not encrypted (it uses a null cipher).\n - Such a configuration cannot be created by cryptsetup, but can be crafted outside of it.\n - Null cipher is sometimes used to create an empty container for later reencryption.\n - Only an empty passphrase can activate such a container (the same as in LUKS1).\n * Do not silently decrease PBKDF parallel cost (threads) if set by an option.\n - The maximum parallel cost is limited to 4 threads.\n * Fixes to configuration and installation scripts.\n - Meson and autoconf tools now properly support --prefix option for temporary directory installation.\n - Multiple fixes and cleanups to config.h for compatibility between Meson and autoconf.\n - Fix the luks2-external-tokens-path Meson option to work the same as in autoconf.\n - Fix Meson install for tool binaries, install fvault2Open man page and include test/fuzz/meson.build in release.\n * Major update to manual pages.\n - Try to explain the PBKDF hardcoded limits.\n - Add a better explanation for automatic integrity tag recalculation.\n - Mention crypt/verity/integritytab.\n - Remove or reformulate some misleading warnings present only with old and no longer supported kernels.\n - Clarify that some commands do not wipe data and unify OPAL reset wording.\n - Clarify the --label option.\n - There are also many other grammar and stylistic fixes to unify the man-page style.\n * Fixes for false-positive and annoying (optional) warnings added in recent compilers.\n\n- Update to 2.8.0:\n * Full release notes in:\n - https://cdn.kernel.org/pub/linux/utils/cryptsetup/v2.8/v2.8.0-ReleaseNotes\n * Introduce support for inline mode (use HW sectors with additional hardware\n metadata space).\n * Finalize use of keyslot context API.\n * Make all keyslot context types fully self-contained.\n * Add --key-description and --new-key-description cryptsetup options.\n * Support more precise keyslot selection in reencryption initialization.\n * Allow reencryption to resume using token and volume keys.\n * Cryptsetup repair command now tries to check LUKS keyslot areas for corruption.\n * Opal2 SED: PSID keyfile is now expected to be 32 alphanumeric characters.\n * Opal2: Avoid the Erase method and use Secure Erase for locking range.\n * Opal2: Fix some error description (in debug only).\n * Opal2: Do not allow deferred deactivation.\n * Allow --reduce-device-size and --device-size combination for reencryption\n (encrypt) action.\n * Fix the userspace storage backend to support kernel 'capi:' cipher specification format.\n * Disallow conversion from LUKS2 to LUKS1 if kernel 'capi:' cipher specification is used.\n * Explicitly disallow kernel 'capi:' cipher specification format for LUKS2\n keyslot encryption.\n * Do not allow conversion of LUKS2 to LUKS1 if an unbound keyslot is present.\n * cryptsetup: Adjust the XTS key size for kernel 'capi:' cipher specification.\n * Remove keyslot warning about possible failure due to low memory.\n * Do not limit Argon2 KDF memory cost on systems with more than 4GB of available memory.\n * Properly report out of memory error for cryptographic backends implementing Argon2.\n * Avoid KDF2 memory cost overflow on 32-bit platforms.\n * Do not use page size as a fallback for device block size.\n * veritysetup: Check hash device size in advance.\n * Print a better error message for unsupported LUKS2 AEAD device resize.\n * Optimize LUKS2 metadata writes.\n * veritysetup: support --error-as-corruption option.\n * Report all sizes in status and dump command output in the correct units.\n * Add --integrity-key-size option to cryptsetup.\n * Support trusted; encrypted keyrings for plain devices.\n * Support plain format resize with a keyring key.\n * TCRYPT: Clear mapping of system-encrypted partitions.\n * TCRYPT: Print all information from the decrypted metadata header in\n the tcryptDump command.\n * Always lock the volume key structure in memory.\n * Do not run direct-io read check on block devices.\n * Fix a possible segfault in deferred deactivation.\n * Exclude cipher allocation time from the cryptsetup benchmark.\n * Add Mbed-TLS optional crypto backend.\n * Fix the wrong preprocessor use of #ifdef for config.h processed by Meson.\n * Reorganize license files. The license text files are now in docs/licenses.\n The COPYING file in the root directory is the default license.\n * Remove cc-by-sa-4.0.txt as already shipped now in docs/licenses\n and named as COPYING.CC-BY-SA-4.0.\n * Libcryptsetup API extensions. The libcryptsetup API is backward compatible\n with all existing symbols. Due to the self-contained memory allocation,\n these symbols have the new version:\n - crypt_keyslot_context_init_by_passphrase;\n - crypt_keyslot_context_init_by_keyfile;\n - crypt_keyslot_context_init_by_token;\n - crypt_keyslot_context_init_by_volume_key;\n - crypt_keyslot_context_init_by_signed_key;\n - crypt_keyslot_context_init_by_keyring;\n - crypt_keyslot_context_init_by_vk_in_keyring;\n * New symbols:\n - crypt_format_inline\n - crypt_get_old_volume_key_size\n - crypt_reencrypt_init_by_keyslot_context\n - crypt_safe_memcpy\n * New defines:\n - CRYPT_ACTIVATE_HIGH_PRIORITY\n - CRYPT_ACTIVATE_ERROR_AS_CORRUPTION\n - CRYPT_ACTIVATE_INLINE_MODE\n - CRYPT_REENCRYPT_CREATE_NEW_DIGEST\n * New requirement flag:\n - CRYPT_REQUIREMENT_INLINE_HW_TAGS\n\n- Add a dependency on device-mapper to libcryptsetup12 to install\n the required device-mapper udev rules. (bsc#1241612)\n\n- Update to 2.7.5:\n * Fix possible online reencryption data corruption (only in 2.7.x).\n In some situations (initializing a suspended device-mapper device),\n cryptsetup disabled direct-io device access. This caused unsafe\n online reencryption operations that could lead to data corruption.\n The code now adds strict checks (and aborts the operation) and\n changes direct-io detection code to prevent data corruption.\n * Fix a clang compilation error in SSH token plugin.\n As clang linker treats missing symbols as errors, the linker phase\n for the SSH token failed as the optional cryptsetup_token_buffer_free\n was not defined.\n * Fix crypto backend initialization in crypt_format_luks2_opal API call.\n\n- Update to 2.7.4:\n * Detect device busy failure for device-mapper table-referenced\n devices.\n * Fix shared activation for dm-verity devices.\n * Add --shared option for veritysetup open action.\n * Do not use exclusive flag for the allocated backing loop files.\n * Fixes for problems found by static analyzers and Valgrind.\n * Fixes to tests and CI scripts.\n- Use fdupes to link identical man pages.\n\n- Update to 2.7.3:\n * Do not allow formatting LUKS2 with Opal SED (hardware encryption)\n if the reported logical sector size for the block device and Opal\n encryption logical block differs.\n * Fixes to wiping LUKS2 headers after Opal locking area erase.\n * Mention the need for possible PSID revert before Opal format for some\n drives (man page).\n * Fix Bitlocker-compatible code to ignore newly seen metadata entries.\n * Fix interactive query retry if LUKS2 unbound keyslot is present.\n * Detect unsupported zoned devices for LUKS header devices.\n * Allow 'capi' cipher format for benchmark command and fix parsing\n of plain IV in 'capi' format.\n * Add support for HCTR2 encryption mode.\n * Source code now uses SPDX license identifiers instead of full\n license preambles.\n * Fix missing includes for cryptographic backend that could cause\n compilation errors for some systems.\n * Fix tests to work correctly in FIPS mode with recent OpenSSL 3.2.\n * Fix various (mostly false positive) issues detected by Coverity.\n\n- License: Replace legacy 'AND SUSE-GPL-2.0-with-openssl-exception' with\n 'WITH cryptsetup-OpenSSL-exception' (the official SPDX exception).\n\n- update to 2.7.2:\n * Fix activation of OPAL-only encrypted LUKS device with tokens\n * Fix formatting of OPAL devices with 4096-byte sector size\n * Fix incorrect OPAL locking range alignment calculation if\n used over an unaligned device partition.\n * Do not check the passphrase quality for OPAL Admin PIN,\n as this passphrase already exists.\n * Update license for FAQ document to CC BY-SA 4.0.\n NOTE: Please note that with OPAL-only (--hw-opal-only)\n encryption, the configured OPAL administrator PIN (passphrase)\n allows unlocking all configured locking ranges without LUKS\n keyslot decryption (without knowledge of LUKS passphrase).\n Because of many observed problems with compatibility, cryptsetup\n currently DOES NOT use OPAL single-user mode, which would allow\n such decoupling of OPAL admin PIN access.\n\n- Update to 2.7.1:\n * Fix interrupted LUKS1 decryption resume.\n With the replacement of the cryptsetup-reencrypt tool by the cryptsetup\n reencrypt command, resuming the interrupted LUKS1 decryption operation\n could fail. LUKS2 was not affected.\n * Allow --link-vk-to-keyring with --test-passphrase option.\n This option allows uploading the volume key in a user-specified kernel\n keyring without activating the device.\n * Fix crash when --active-name was used in decryption initialization.\n * Updates and changes to man pages, including indentation, sorting options\n alphabetically, fixing mistakes in crypt_set_keyring_to_link, and fixing\n some typos.\n * Fix compilation with libargon2 when --disable-internal-argon2 was used.\n * Do not require installed argon2.h header and never compile internal\n libargon2 code if the crypto library directly supports Argon2.\n * Fixes to regression tests to support older Linux distributions.\n","status":"published","published":"2026-07-06T08:57:14Z","modified":"2026-07-07T08:30:06.264578719Z","updated_at":"2026-11-02T15:54:04.987808Z"},{"id":"SUSE-SU-2026:2807-1","title":"Security update for rust-keylime","description":"This update for rust-keylime fixes the following issues\n\n- Update to version 0.2.9+49\n- Update openssl to 0.10.81\n- CVE-2026-41676: openssl: `Deriver:derive` and `PkeyCtxRef:derive` can overflow short buffers on OpenSSL 1.1.1 (bsc#1270174).\n- CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length in rust-openssl crate (bsc#1270614).\n- CVE-2026-41678: openssl: incorrect bounds assertion in aes key wrap in rust-openssl crate (bsc#1270699).\n- CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check in rust-openssl crate (bsc#1270792).\n- CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent memory in rust-openssl crate (bsc#1270842).\n- CVE-2026-42327: openssl: arbitrary code execution via specially crafted certificate in rust-openssl crate (bsc#1270523).\n- CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding in rust-openssl crate (bsc#1270903).\n- CVE-2026-45784: openssl: out-of-bounds write in `CipherCtxRef::cipher_update_inplace` for AES-KW-PAD ciphers in rust-openssl crate (bsc#1270999).\n","status":"published","published":"2026-07-09T04:47:12Z","modified":"2026-07-10T10:00:06.009671009Z","updated_at":"2026-11-02T15:54:04.987808Z"},{"id":"SUSE-SU-2026:2825-1","title":"Security update for rust-keylime","description":"This update for rust-keylime fixes the following issues\n\n- Update to version 0.2.9+49\n- Update openssl to 0.10.81\n- CVE-2026-41676: openssl: `Deriver:derive` and `PkeyCtxRef:derive` can overflow short buffers on OpenSSL 1.1.1 (bsc#1270174).\n- CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length in rust-openssl crate (bsc#1270614).\n- CVE-2026-41678: openssl: incorrect bounds assertion in aes key wrap in rust-openssl crate (bsc#1270699).\n- CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check in rust-openssl crate (bsc#1270792).\n- CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent memory in rust-openssl crate (bsc#1270842).\n- CVE-2026-42327: openssl: arbitrary code execution via specially crafted certificate in rust-openssl crate (bsc#1270523).\n- CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding in rust-openssl crate (bsc#1270903).\n- CVE-2026-45784: openssl: out-of-bounds write in `CipherCtxRef::cipher_update_inplace` for AES-KW-PAD ciphers in rust-openssl crate (bsc#1270999).\n","status":"published","published":"2026-07-09T18:18:08Z","modified":"2026-07-10T10:00:07.676333333Z","updated_at":"2026-11-02T15:54:04.987808Z"}]},"sources_more":{"osv":17}}