GHSA-pg9f-39pc-qf8gPublished

Crossbeam-channel: crossbeam-channel vulnerable to double free on drop

cve-program · CVE-2025-4574

Published

crossbeam-channel

https://github.com/crossbeam-rs/crossbeam

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "versions": [
                        {
                            "status": "affected",
                            "version": "0.5.12",
                            "lessThan": "0.5.15",
                            "versionType": "semver"
                        }
                    ],
                    "packageName": "crossbeam-channel",
                    "collectionURL": "https://github.com/crossbeam-rs/crossbeam",
                    "defaultStatus": "unaffected"
                }

redhat-ds:11/389-ds-base

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Directory Server 11",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "redhat-ds:11/389-ds-base",
                    "defaultStatus": "unaffected",
                    "cpes": [
                        "cpe:/a:redhat:directory_server:11"
                    ]
                }

redhat-ds:12/389-ds-base

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Directory Server 12",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "redhat-ds:12/389-ds-base",
                    "defaultStatus": "unaffected",
                    "cpes": [
                        "cpe:/a:redhat:directory_server:12"
                    ]
                }

389-ds-base

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 10",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "389-ds-base",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:enterprise_linux:10"
                    ]
                }

firefox

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 10",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "firefox",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:enterprise_linux:10"
                    ]
                }

gjs

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 10",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "gjs",
                    "defaultStatus": "unaffected",
                    "cpes": [
                        "cpe:/a:redhat:enterprise_linux:10"
                    ]
                }

rust

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 10",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "rust",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:enterprise_linux:10"
                    ]
                }

rust-afterburn

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 10",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "rust-afterburn",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:enterprise_linux:10"
                    ]
                }

thunderbird

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 10",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "thunderbird",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:enterprise_linux:10"
                    ]
                }

trustee-guest-components

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 10",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "trustee-guest-components",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:enterprise_linux:10"
                    ]
                }

firefox

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 7",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "firefox",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/o:redhat:rhel_els:7"
                    ]
                }

thunderbird

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 7",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "thunderbird",
                    "defaultStatus": "unaffected",
                    "cpes": [
                        "cpe:/o:redhat:rhel_els:7"
                    ]
                }

389-ds:1.4/389-ds-base

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 8",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "389-ds:1.4/389-ds-base",
                    "defaultStatus": "unaffected",
                    "cpes": [
                        "cpe:/a:redhat:enterprise_linux:8"
                    ]
                }

389-ds-base

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 8",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "389-ds-base",
                    "defaultStatus": "unaffected",
                    "cpes": [
                        "cpe:/a:redhat:enterprise_linux:8"
                    ]
                }

firefox

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 8",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "firefox",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:enterprise_linux:8"
                    ]
                }

rpm-ostree

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 8",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "rpm-ostree",
                    "defaultStatus": "unaffected",
                    "cpes": [
                        "cpe:/a:redhat:enterprise_linux:8"
                    ]
                }

rust-toolset:rhel8/rust

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 8",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "rust-toolset:rhel8/rust",
                    "defaultStatus": "unaffected",
                    "cpes": [
                        "cpe:/a:redhat:enterprise_linux:8"
                    ]
                }

thunderbird

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 8",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "thunderbird",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:enterprise_linux:8"
                    ]
                }

389-ds-base

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 9",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "389-ds-base",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:enterprise_linux:9"
                    ]
                }

firefox

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 9",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "firefox",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:enterprise_linux:9"
                    ]
                }

librsvg2

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 9",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "librsvg2",
                    "defaultStatus": "unaffected",
                    "cpes": [
                        "cpe:/a:redhat:enterprise_linux:9"
                    ]
                }

rpm-ostree

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 9",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "rpm-ostree",
                    "defaultStatus": "unaffected",
                    "cpes": [
                        "cpe:/a:redhat:enterprise_linux:9"
                    ]
                }

rust

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 9",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "rust",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:enterprise_linux:9"
                    ]
                }

rust-afterburn

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 9",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "rust-afterburn",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:enterprise_linux:9"
                    ]
                }

rust-coreos-installer

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 9",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "rust-coreos-installer",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:enterprise_linux:9"
                    ]
                }

thunderbird

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 9",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "thunderbird",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:enterprise_linux:9"
                    ]
                }

trustee-guest-components

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 9",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "trustee-guest-components",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:enterprise_linux:9"
                    ]
                }

rhoai/odh-feast-operator-rhel8

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat OpenShift AI (RHOAI)",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "rhoai/odh-feast-operator-rhel8",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:openshift_ai"
                    ]
                }

rhoai/odh-feature-server-rhel8

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat OpenShift AI (RHOAI)",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "rhoai/odh-feature-server-rhel8",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:openshift_ai"
                    ]
                }

conmon-rs

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat OpenShift Container Platform 4",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "conmon-rs",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:openshift:4"
                    ]
                }

coreos-installer

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat OpenShift Container Platform 4",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "coreos-installer",
                    "defaultStatus": "unaffected",
                    "cpes": [
                        "cpe:/a:redhat:openshift:4"
                    ]
                }

kata-containers

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat OpenShift Container Platform 4",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "kata-containers",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:openshift:4"
                    ]
                }

rpm-ostree

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat OpenShift Container Platform 4",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "rpm-ostree",
                    "defaultStatus": "unaffected",
                    "cpes": [
                        "cpe:/a:redhat:openshift:4"
                    ]
                }

rust-afterburn

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat OpenShift Container Platform 4",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "rust-afterburn",
                    "defaultStatus": "unaffected",
                    "cpes": [
                        "cpe:/a:redhat:openshift:4"
                    ]
                }

python3.12-maturin

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Satellite 6",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "python3.12-maturin",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:satellite:6"
                    ]
                }

python-maturin

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Satellite 6",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "python-maturin",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:satellite:6"
                    ]
                }

rhtas/tuffer-rhel9

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Trusted Artifact Signer",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "rhtas/tuffer-rhel9",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:trusted_artifact_signer:1"
                    ]
                }

rhtas/tuftool-rhel9

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Trusted Artifact Signer",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "rhtas/tuftool-rhel9",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:trusted_artifact_signer:1"
                    ]
                }

rhtpa/rhtpa-trustification-service-rhel9

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Trusted Profile Analyzer",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "rhtpa/rhtpa-trustification-service-rhel9",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:trusted_profile_analyzer:1"
                    ]
                }

rhtpa/rhtpa-trustification-service-rhel9

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Trusted Profile Analyzer",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "rhtpa/rhtpa-trustification-service-rhel9",
                    "defaultStatus": "unaffected",
                    "cpes": [
                        "cpe:/a:redhat:trusted_profile_analyzer:2"
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON

euvd · EUVD-2025-14635

Published

EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON.

Original publisher date fields

datePublished: May 13, 2025, 9:47:24 PM

dateUpdated: Nov 5, 2026, 3:46:51 PM

9 related source bulletins · separate from aliases

openSUSE-SU-2026:12042-1: python313-ruff-0.16.10-1.1 on GA media

CVE-2025-4574

msrc_CVE-2025-4574: Crossbeam-channel: crossbeam-channel vulnerable to double free on drop

CVE-2025-4574

openSUSE-SU-2025:15551-1: cargo-c-0.10.3~git0.ee7d7ef-4.1 on GA media

CVE-2024-12224 · CVE-2025-4574 · CVE-2025-58160

SUSE-SU-2025:01591-1: Security update for python-maturin

CVE-2025-3416 · CVE-2025-4574

SUSE-SU-2026:20096-1: Security update for cargo-c

CVE-2024-12224 · CVE-2025-4574 · CVE-2025-58160

openSUSE-SU-2026:20060-1: Security update for cargo-c

CVE-2024-12224 · CVE-2025-4574 · CVE-2025-58160

openSUSE-SU-2025:15550-1: cargo-audit-0.21.2~git0.18e58c2-2.1 on GA media

CVE-2024-12224 · CVE-2025-4574 · CVE-2025-58160

openSUSE-SU-2026:21689-1: Security update for gstreamer-devtools

CVE-2025-4574 · CVE-2025-58160 · CVE-2026-25541 · CVE-2026-25727 · CVE-2026-72813 · CVE-2026-72814

SUSE-SU-2026:23572-1: Security update for gstreamer-devtools

CVE-2025-4574 · CVE-2025-58160 · CVE-2026-25541 · CVE-2026-25727 · CVE-2026-72813 · CVE-2026-72814

No normalized affected-package data is projected for this source revision. The original publisher record may contain additional product and version evidence; this does not establish that a package is unaffected.

Original source record · Cite this exact observation · Complete original publisher JSON

nvd · CVE-2025-4574

Published

NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON.

Source analysis status: Deferred

Weakness classifications: CWE-415

Original publisher date fields

published: 2025-05-13T22:15:25.143

lastModified: 2026-11-05T16:17:18.877

Original source record · Cite this exact observation · Complete original publisher JSON

osv · GHSA-pg9f-39pc-qf8g

Published

crossbeam-channel

crates.io

SEMVER · introduced 0.5.12 → fixed 0.5.15

Original source record · Cite this exact observation · Complete original publisher JSON

osv · RUSTSEC-2025-0024

Published

crossbeam-channel

crates.io

SEMVER · introduced 0.5.12-0 → fixed 0.5.15

Original source record · Cite this exact observation · Complete original publisher JSON