{"id":"TROVE-2025-013","revision":null,"records":[{"revision":"d1e9a936642448b1903641dd9f6ca0b8","observedAt":"2026-11-05T16:36:21.325+00:00","statement":{"source":"cve-program","id":"CVE-2025-4574","aliases":[],"title":"Crossbeam-channel: crossbeam-channel vulnerable to double free on drop","description":"In crossbeam-channel rust crate, the internal `Channel` type's `Drop` method has a race condition which could, in some circumstances, lead to a double-free that could result in memory corruption.","state":0,"publishedAt":"2025-05-13T21:47:24.951+00:00","modifiedAt":"2026-11-05T15:46:51.006+00:00","affected":[{"ecosystem":"https://github.com/crossbeam-rs/crossbeam","name":"crossbeam-channel","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"0.5.12\",\n                            \"lessThan\": \"0.5.15\",\n                            \"versionType\": \"semver\"\n                        }\n                    ],\n                    \"packageName\": \"crossbeam-channel\",\n                    \"collectionURL\": \"https://github.com/crossbeam-rs/crossbeam\",\n                    \"defaultStatus\": \"unaffected\"\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"redhat-ds:11/389-ds-base","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Directory Server 11\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"redhat-ds:11/389-ds-base\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:directory_server:11\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"redhat-ds:12/389-ds-base","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Directory Server 12\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"redhat-ds:12/389-ds-base\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:directory_server:12\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"389-ds-base","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Enterprise Linux 10\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"389-ds-base\",\n                    \"defaultStatus\": \"affected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:enterprise_linux:10\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"firefox","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Enterprise Linux 10\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"firefox\",\n                    \"defaultStatus\": \"affected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:enterprise_linux:10\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"gjs","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Enterprise Linux 10\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"gjs\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:enterprise_linux:10\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"rust","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Enterprise Linux 10\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"rust\",\n                    \"defaultStatus\": \"affected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:enterprise_linux:10\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"rust-afterburn","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Enterprise Linux 10\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"rust-afterburn\",\n                    \"defaultStatus\": \"affected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:enterprise_linux:10\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"thunderbird","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Enterprise Linux 10\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"thunderbird\",\n                    \"defaultStatus\": \"affected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:enterprise_linux:10\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"trustee-guest-components","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Enterprise Linux 10\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"trustee-guest-components\",\n                    \"defaultStatus\": \"affected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:enterprise_linux:10\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"firefox","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Enterprise Linux 7\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"firefox\",\n                    \"defaultStatus\": \"affected\",\n                    \"cpes\": [\n                        \"cpe:/o:redhat:rhel_els:7\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"thunderbird","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Enterprise Linux 7\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"thunderbird\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"cpes\": [\n                        \"cpe:/o:redhat:rhel_els:7\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"389-ds:1.4/389-ds-base","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Enterprise Linux 8\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"389-ds:1.4/389-ds-base\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:enterprise_linux:8\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"389-ds-base","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Enterprise Linux 8\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"389-ds-base\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:enterprise_linux:8\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"firefox","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Enterprise Linux 8\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"firefox\",\n                    \"defaultStatus\": \"affected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:enterprise_linux:8\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"rpm-ostree","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Enterprise Linux 8\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"rpm-ostree\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:enterprise_linux:8\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"rust-toolset:rhel8/rust","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Enterprise Linux 8\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"rust-toolset:rhel8/rust\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:enterprise_linux:8\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"thunderbird","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Enterprise Linux 8\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"thunderbird\",\n                    \"defaultStatus\": \"affected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:enterprise_linux:8\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"389-ds-base","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Enterprise Linux 9\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"389-ds-base\",\n                    \"defaultStatus\": \"affected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:enterprise_linux:9\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"firefox","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Enterprise Linux 9\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"firefox\",\n                    \"defaultStatus\": \"affected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:enterprise_linux:9\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"librsvg2","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Enterprise Linux 9\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"librsvg2\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:enterprise_linux:9\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"rpm-ostree","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Enterprise Linux 9\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"rpm-ostree\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:enterprise_linux:9\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"rust","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Enterprise Linux 9\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"rust\",\n                    \"defaultStatus\": \"affected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:enterprise_linux:9\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"rust-afterburn","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Enterprise Linux 9\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"rust-afterburn\",\n                    \"defaultStatus\": \"affected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:enterprise_linux:9\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"rust-coreos-installer","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Enterprise Linux 9\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"rust-coreos-installer\",\n                    \"defaultStatus\": \"affected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:enterprise_linux:9\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"thunderbird","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Enterprise Linux 9\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"thunderbird\",\n                    \"defaultStatus\": \"affected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:enterprise_linux:9\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"trustee-guest-components","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Enterprise Linux 9\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"trustee-guest-components\",\n                    \"defaultStatus\": \"affected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:enterprise_linux:9\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"rhoai/odh-feast-operator-rhel8","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat OpenShift AI (RHOAI)\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"rhoai/odh-feast-operator-rhel8\",\n                    \"defaultStatus\": \"affected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:openshift_ai\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"rhoai/odh-feature-server-rhel8","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat OpenShift AI (RHOAI)\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"rhoai/odh-feature-server-rhel8\",\n                    \"defaultStatus\": \"affected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:openshift_ai\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"conmon-rs","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat OpenShift Container Platform 4\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"conmon-rs\",\n                    \"defaultStatus\": \"affected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:openshift:4\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"coreos-installer","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat OpenShift Container Platform 4\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"coreos-installer\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:openshift:4\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"kata-containers","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat OpenShift Container Platform 4\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"kata-containers\",\n                    \"defaultStatus\": \"affected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:openshift:4\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"rpm-ostree","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat OpenShift Container Platform 4\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"rpm-ostree\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:openshift:4\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"rust-afterburn","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat OpenShift Container Platform 4\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"rust-afterburn\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:openshift:4\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"python3.12-maturin","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Satellite 6\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"python3.12-maturin\",\n                    \"defaultStatus\": \"affected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:satellite:6\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"python-maturin","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Satellite 6\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"python-maturin\",\n                    \"defaultStatus\": \"affected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:satellite:6\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"rhtas/tuffer-rhel9","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Trusted Artifact Signer\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"rhtas/tuffer-rhel9\",\n                    \"defaultStatus\": \"affected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:trusted_artifact_signer:1\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"rhtas/tuftool-rhel9","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Trusted Artifact Signer\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"rhtas/tuftool-rhel9\",\n                    \"defaultStatus\": \"affected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:trusted_artifact_signer:1\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"rhtpa/rhtpa-trustification-service-rhel9","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Trusted Profile Analyzer\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"rhtpa/rhtpa-trustification-service-rhel9\",\n                    \"defaultStatus\": \"affected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:trusted_profile_analyzer:1\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"rhtpa/rhtpa-trustification-service-rhel9","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Trusted Profile Analyzer\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"rhtpa/rhtpa-trustification-service-rhel9\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:trusted_profile_analyzer:2\"\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","score":6.5,"severity":"MEDIUM"}],"references":["https://access.redhat.com/security/cve/CVE-2025-4574","https://bugzilla.redhat.com/show_bug.cgi?id=2358890","https://github.com/advisories/GHSA-pg9f-39pc-qf8g","https://github.com/crossbeam-rs/crossbeam/pull/1187"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-4574","license":"CVE Program Terms of Use","key":"cve-program:CVE-2025-4574","identifiers":["CVE-2025-4574"]},"retained":false,"historicalAffected":[]},{"revision":"6257ec54c9854a08872b684e6b25947c","observedAt":"2026-11-15T04:31:51.426+00:00","statement":{"source":"euvd","id":"EUVD-2025-14635","aliases":["CVE-2025-4574","GHSA-pg9f-39pc-qf8g"],"title":"In crossbeam-channel rust crate, the internal `Channel` type's `Drop` method has a race condition which could, in some circumstances, lead to a double-free that could result in memory corruption.","description":"In crossbeam-channel rust crate, the internal `Channel` type's `Drop` method has a race condition which could, in some circumstances, lead to a double-free that could result in memory corruption.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","score":6.5,"severity":null}],"references":["https://access.redhat.com/security/cve/CVE-2025-4574","https://bugzilla.redhat.com/show_bug.cgi?id=2358890","https://github.com/advisories/GHSA-pg9f-39pc-qf8g","https://github.com/crossbeam-rs/crossbeam/pull/1187"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-14635","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"May 13, 2025, 9:47:24 PM","dateUpdated":"Nov 5, 2026, 3:46:51 PM"},"relatedAdvisories":[{"id":"openSUSE-SU-2026:12042-1","title":"python313-ruff-0.16.10-1.1 on GA media","vulnerabilityIds":["CVE-2025-4574"]},{"id":"msrc_CVE-2025-4574","title":"Crossbeam-channel: crossbeam-channel vulnerable to double free on drop","vulnerabilityIds":["CVE-2025-4574"]},{"id":"openSUSE-SU-2025:15551-1","title":"cargo-c-0.10.3~git0.ee7d7ef-4.1 on GA media","vulnerabilityIds":["CVE-2024-12224","CVE-2025-4574","CVE-2025-58160"]},{"id":"SUSE-SU-2025:01591-1","title":"Security update for python-maturin","vulnerabilityIds":["CVE-2025-3416","CVE-2025-4574"]},{"id":"SUSE-SU-2026:20096-1","title":"Security update for cargo-c","vulnerabilityIds":["CVE-2024-12224","CVE-2025-4574","CVE-2025-58160"]},{"id":"openSUSE-SU-2026:20060-1","title":"Security update for cargo-c","vulnerabilityIds":["CVE-2024-12224","CVE-2025-4574","CVE-2025-58160"]},{"id":"openSUSE-SU-2025:15550-1","title":"cargo-audit-0.21.2~git0.18e58c2-2.1 on GA media","vulnerabilityIds":["CVE-2024-12224","CVE-2025-4574","CVE-2025-58160"]},{"id":"openSUSE-SU-2026:21689-1","title":"Security update for gstreamer-devtools","vulnerabilityIds":["CVE-2025-4574","CVE-2025-58160","CVE-2026-25541","CVE-2026-25727","CVE-2026-72813","CVE-2026-72814"]},{"id":"SUSE-SU-2026:23572-1","title":"Security update for gstreamer-devtools","vulnerabilityIds":["CVE-2025-4574","CVE-2025-58160","CVE-2026-25541","CVE-2026-25727","CVE-2026-72813","CVE-2026-72814"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2025-14635","identifiers":["EUVD-2025-14635","CVE-2025-4574","GHSA-pg9f-39pc-qf8g"]},"retained":false,"historicalAffected":[]},{"revision":"9d5e078db0b5417d83ae5f4a9c2c880b","observedAt":"2026-11-06T06:36:43.959+00:00","statement":{"source":"nvd","id":"CVE-2025-4574","aliases":[],"title":"In crossbeam-channel rust crate, the internal `Channel` type's `Drop` method has a race condition which could, in some circumstances, lead to a double-free that could result in memory corruption.","description":"In crossbeam-channel rust crate, the internal `Channel` type's `Drop` method has a race condition which could, in some circumstances, lead to a double-free that could result in memory corruption.","state":0,"publishedAt":"2025-05-13T22:15:25.143+00:00","modifiedAt":"2026-11-05T16:17:18.877+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · secalert@redhat.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","score":6.5,"severity":"MEDIUM"}],"references":["https://access.redhat.com/security/cve/CVE-2025-4574","https://bugzilla.redhat.com/show_bug.cgi?id=2358890","https://github.com/advisories/GHSA-pg9f-39pc-qf8g","https://github.com/crossbeam-rs/crossbeam/pull/1187"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-4574","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-415"],"productCriteria":[],"sourceDates":{"published":"2025-05-13T22:15:25.143","lastModified":"2026-11-05T16:17:18.877"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2025-4574","identifiers":["CVE-2025-4574"]},"retained":false,"historicalAffected":[]},{"revision":"7fd60ed39dc84a20be0a0bfb428603f8","observedAt":"2026-10-24T13:19:54.901+00:00","statement":{"source":"osv","id":"GHSA-pg9f-39pc-qf8g","aliases":["CVE-2025-4574","RUSTSEC-2025-0024","TROVE-2025-013"],"title":"crossbeam-channel Vulnerable to Double Free on Drop","description":"The internal `Channel` type's `Drop` method has a race\nwhich could, in some circumstances, lead to a double-free.\nThis could result in memory corruption.\n\nQuoting from the\n[upstream description in merge request \\#1187](https://github.com/crossbeam-rs/crossbeam/pull/1187#issue-2980761131):\n\n> The problem lies in the fact that `dicard_all_messages` contained two paths that could lead to `head.block` being read but only one of them would swap the value. This meant that `dicard_all_messages` could end up observing a non-null block pointer (and therefore attempting to free it) without setting `head.block` to null. This would then lead to `Channel::drop` making a second attempt at dropping the same pointer.\n\nThe bug was introduced while fixing a memory leak, in\nupstream [MR \\#1084](https://github.com/crossbeam-rs/crossbeam/pull/1084),\nfirst published in 0.5.12.\n\nThe fix is in\nupstream [MR \\#1187](https://github.com/crossbeam-rs/crossbeam/pull/1187)\nand has been published in 0.5.15","state":0,"publishedAt":"2025-04-10T14:30:39+00:00","modifiedAt":"2026-09-10T03:50:57.4099856+00:00","affected":[{"ecosystem":"crates.io","name":"crossbeam-channel","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.5.12"},{"kind":"fixed","version":"0.5.15"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://nvd.nist.gov/vuln/detail/CVE-2025-4574","https://github.com/crossbeam-rs/crossbeam/pull/1187","https://access.redhat.com/security/cve/CVE-2025-4574","https://bugzilla.redhat.com/show_bug.cgi?id=2358890","https://github.com/crossbeam-rs/crossbeam","https://rustsec.org/advisories/RUSTSEC-2025-0024.html"],"sourceUrl":"https://github.com/advisories/GHSA-pg9f-39pc-qf8g","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-pg9f-39pc-qf8g","identifiers":["GHSA-pg9f-39pc-qf8g","CVE-2025-4574","RUSTSEC-2025-0024","TROVE-2025-013"]},"retained":false,"historicalAffected":[]},{"revision":"c71a7e3b92ef4b49ba422cf747a98549","observedAt":"2026-10-24T13:19:54.901+00:00","statement":{"source":"osv","id":"RUSTSEC-2025-0024","aliases":["CVE-2025-4574","GHSA-pg9f-39pc-qf8g","TROVE-2025-013"],"title":"crossbeam-channel: double free on Drop","description":"The internal `Channel` type's `Drop` method has a race\nwhich could, in some circumstances, lead to a double-free.\nThis could result in memory corruption.\n\nQuoting from the\n[upstream description in merge request \\#1187](https://github.com/crossbeam-rs/crossbeam/pull/1187#issue-2980761131):\n\n> The problem lies in the fact that `dicard_all_messages` contained two paths that could lead to `head.block` being read but only one of them would swap the value. This meant that `dicard_all_messages` could end up observing a non-null block pointer (and therefore attempting to free it) without setting `head.block` to null. This would then lead to `Channel::drop` making a second attempt at dropping the same pointer.\n\nThe bug was introduced while fixing a memory leak, in\nupstream [MR \\#1084](https://github.com/crossbeam-rs/crossbeam/pull/1084),\nfirst published in 0.5.12.\n\nThe fix is in\nupstream [MR \\#1187](https://github.com/crossbeam-rs/crossbeam/pull/1187)\nand has been published in 0.5.15","state":0,"publishedAt":"2025-04-08T12:00:00+00:00","modifiedAt":"2025-10-28T06:29:00.070713+00:00","affected":[{"ecosystem":"crates.io","name":"crossbeam-channel","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.5.12-0"},{"kind":"fixed","version":"0.5.15"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://crates.io/crates/crossbeam-channel","https://rustsec.org/advisories/RUSTSEC-2025-0024.html","https://github.com/crossbeam-rs/crossbeam/pull/1187"],"sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2025-0024","license":"OSV · upstream source license applies","key":"osv:RUSTSEC-2025-0024","identifiers":["RUSTSEC-2025-0024","CVE-2025-4574","GHSA-pg9f-39pc-qf8g","TROVE-2025-013"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-15T17:43:57.7477261+00:00","complete":true,"records":1781,"lastAttemptAt":"2026-11-15T17:43:57.7477261+00:00","lastSuccessAt":"2026-11-15T17:43:57.9319367+00:00","error":null,"lastVerifiedAt":"2026-11-15T17:43:57.9319376+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-7de4d7559a5263003f03d9f70577ab06f92ba4178309f26fce53e22a4a959294-85332baa2a2fe51044c7b11e74168cdf9ea3251563b394940fa4249a4ab5eea5","complete":true,"records":425838,"lastAttemptAt":"2026-11-15T17:43:56.7045831+00:00","lastSuccessAt":"2026-11-15T17:43:56.6887608+00:00","error":null,"lastVerifiedAt":"2026-11-15T17:43:56.7045831+00:00","snapshotPublishedAt":"2026-11-15T17:26:47+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-b236bb13999347ce987e1ca186c5d1f1","complete":false,"records":13821,"lastAttemptAt":"2026-11-15T17:54:40.0701718+00:00","lastSuccessAt":"2026-11-15T17:54:40.063+00:00","error":"54 identifier lookups failed; latest failures include AccessDenied (HTTP 403). Other identifiers were checked independently.","lastVerifiedAt":"2026-11-15T17:54:40.063+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13820,"expectedIdentifiers":13874,"failedIdentifiers":54},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-15T17:43:57.7477261+00:00","complete":true,"records":1125,"lastAttemptAt":"2026-11-15T17:43:57.7477261+00:00","lastSuccessAt":"2026-11-15T17:43:57.9327717+00:00","error":null,"lastVerifiedAt":"2026-11-15T17:43:57.9327718+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-31b467d979fb43bea77e4ea73320cf71","complete":true,"records":13833,"lastAttemptAt":"2026-11-15T17:44:08.5219832+00:00","lastSuccessAt":"2026-11-15T17:44:08.513+00:00","error":null,"lastVerifiedAt":"2026-11-15T17:44:08.513+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13874,"expectedIdentifiers":13874,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-64eea06dbd27de8464d5dbce1b78cc794cc59e2d901516ae0d3ea76e624cdae0","complete":true,"records":9955,"lastAttemptAt":"2026-11-15T17:43:57.6786653+00:00","lastSuccessAt":"2026-11-14T13:57:23.1208135+00:00","error":null,"lastVerifiedAt":"2026-11-15T17:43:57.6786653+00:00","snapshotPublishedAt":"2026-11-14T13:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-f4424d7d4861b1af1404bd15abcb83f295dcd003412a9340ca99dc8200aa148a","complete":true,"records":2014,"lastAttemptAt":"2026-11-15T17:43:57.373573+00:00","lastSuccessAt":"2026-11-13T19:57:08.2864435+00:00","error":null,"lastVerifiedAt":"2026-11-15T17:43:57.373573+00:00","snapshotPublishedAt":"2026-11-13T19:33:10+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-6086d649bcb454cdf302d7d9275177bda73550e1b6e446b3520e9b6266d3582c","complete":true,"records":3148,"lastAttemptAt":"2026-11-15T17:43:57.6970901+00:00","lastSuccessAt":"2026-11-15T11:05:17.1034234+00:00","error":null,"lastVerifiedAt":"2026-11-15T17:43:57.6970901+00:00","snapshotPublishedAt":"2026-11-15T10:03:04+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-ff18f36f13fcca3a20a3fb9274b59b8872d18869a99071730e1e79b625c8f612","complete":true,"records":232475,"lastAttemptAt":"2026-11-15T17:43:57.5611113+00:00","lastSuccessAt":"2026-11-15T11:05:10.4195883+00:00","error":null,"lastVerifiedAt":"2026-11-15T17:43:57.5611113+00:00","snapshotPublishedAt":"2026-11-15T10:33:06+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}