ChangeIntel IT change radar
Public mode

No access to your tenant or devices. Every item links to its source. What this means

Sources need attention Customize Public modeDiscuss ChangeIntel on Discord
CVE-2025-4574

Crossbeam-channel: crossbeam-channel vulnerable to double free on drop

CVSS 3.1 6.5 MEDIUMEUVD CVSS 3.1 6.5 CVSS 3.1 · [email protected] · Secondary 6.5 MEDIUMCVSS_V4 Publisher rating MODERATEFixed by crossbeam-channel 0.5.15osv · severity unknownFixed by crossbeam-channel 0.5.15KEV status unknown
Original advisory

cve-program · CVE-2025-4574

Published

In crossbeam-channel rust crate, the internal `Channel` type's `Drop` method has a race condition which could, in some circumstances, lead to a double-free that could result in memory corruption.

Read the publisher's advisory

euvd · EUVD-2025-14635

Published

In crossbeam-channel rust crate, the internal `Channel` type's `Drop` method has a race condition which could, in some circumstances, lead to a double-free that could result in memory corruption.

Read the publisher's advisory

nvd · CVE-2025-4574

Published

In crossbeam-channel rust crate, the internal `Channel` type's `Drop` method has a race condition which could, in some circumstances, lead to a double-free that could result in memory corruption.

Read the publisher's advisory

osv · GHSA-pg9f-39pc-qf8g

Published

The internal `Channel` type's `Drop` method has a race which could, in some circumstances, lead to a double-free. This could result in memory corruption. Quoting from the [upstream description in merge request \#1187](https://github.com/crossbeam-rs/crossbeam/pull/1187#issue-2980761131): > The problem lies in the fact that `dicard_all_messages` contained two paths that could lead to `head.block` being read but only one of them would swap the value. This meant that `dicard_all_messages` could end up observing a non-null block pointer (and therefore attempting to free it) without setting `head.block` to null. This would then lead to `Channel::drop` making a second attempt at dropping the same pointer. The bug was introduced while fixing a memory leak, in upstream [MR \#1084](https://github.com/crossbeam-rs/crossbeam/pull/1084), first published in 0.5.12. The fix is in upstream [MR \#1187](https://github.com/crossbeam-rs/crossbeam/pull/1187) and has been published in 0.5.15

Read the publisher's advisory

osv · RUSTSEC-2025-0024

Published

The internal `Channel` type's `Drop` method has a race which could, in some circumstances, lead to a double-free. This could result in memory corruption. Quoting from the [upstream description in merge request \#1187](https://github.com/crossbeam-rs/crossbeam/pull/1187#issue-2980761131): > The problem lies in the fact that `dicard_all_messages` contained two paths that could lead to `head.block` being read but only one of them would swap the value. This meant that `dicard_all_messages` could end up observing a non-null block pointer (and therefore attempting to free it) without setting `head.block` to null. This would then lead to `Channel::drop` making a second attempt at dropping the same pointer. The bug was introduced while fixing a memory leak, in upstream [MR \#1084](https://github.com/crossbeam-rs/crossbeam/pull/1084), first published in 0.5.12. The fix is in upstream [MR \#1187](https://github.com/crossbeam-rs/crossbeam/pull/1187) and has been published in 0.5.15

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2025-4574

Published

crossbeam-channel

https://github.com/crossbeam-rs/crossbeam

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "versions": [
                        {
                            "status": "affected",
                            "version": "0.5.12",
                            "lessThan": "0.5.15",
                            "versionType": "semver"
                        }
                    ],
                    "packageName": "crossbeam-channel",
                    "collectionURL": "https://github.com/crossbeam-rs/crossbeam",
                    "defaultStatus": "unaffected"
                }

redhat-ds:11/389-ds-base

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Directory Server 11",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "redhat-ds:11/389-ds-base",
                    "defaultStatus": "unaffected",
                    "cpes": [
                        "cpe:/a:redhat:directory_server:11"
                    ]
                }

redhat-ds:12/389-ds-base

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Directory Server 12",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "redhat-ds:12/389-ds-base",
                    "defaultStatus": "unaffected",
                    "cpes": [
                        "cpe:/a:redhat:directory_server:12"
                    ]
                }

389-ds-base

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 10",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "389-ds-base",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:enterprise_linux:10"
                    ]
                }

firefox

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 10",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "firefox",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:enterprise_linux:10"
                    ]
                }

gjs

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 10",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "gjs",
                    "defaultStatus": "unaffected",
                    "cpes": [
                        "cpe:/a:redhat:enterprise_linux:10"
                    ]
                }

rust

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 10",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "rust",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:enterprise_linux:10"
                    ]
                }

rust-afterburn

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 10",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "rust-afterburn",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:enterprise_linux:10"
                    ]
                }

thunderbird

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 10",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "thunderbird",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:enterprise_linux:10"
                    ]
                }

trustee-guest-components

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 10",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "trustee-guest-components",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:enterprise_linux:10"
                    ]
                }

firefox

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 7",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "firefox",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/o:redhat:rhel_els:7"
                    ]
                }

thunderbird

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 7",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "thunderbird",
                    "defaultStatus": "unaffected",
                    "cpes": [
                        "cpe:/o:redhat:rhel_els:7"
                    ]
                }

389-ds:1.4/389-ds-base

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 8",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "389-ds:1.4/389-ds-base",
                    "defaultStatus": "unaffected",
                    "cpes": [
                        "cpe:/a:redhat:enterprise_linux:8"
                    ]
                }

389-ds-base

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 8",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "389-ds-base",
                    "defaultStatus": "unaffected",
                    "cpes": [
                        "cpe:/a:redhat:enterprise_linux:8"
                    ]
                }

firefox

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 8",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "firefox",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:enterprise_linux:8"
                    ]
                }

rpm-ostree

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 8",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "rpm-ostree",
                    "defaultStatus": "unaffected",
                    "cpes": [
                        "cpe:/a:redhat:enterprise_linux:8"
                    ]
                }

rust-toolset:rhel8/rust

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 8",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "rust-toolset:rhel8/rust",
                    "defaultStatus": "unaffected",
                    "cpes": [
                        "cpe:/a:redhat:enterprise_linux:8"
                    ]
                }

thunderbird

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 8",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "thunderbird",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:enterprise_linux:8"
                    ]
                }

389-ds-base

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 9",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "389-ds-base",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:enterprise_linux:9"
                    ]
                }

firefox

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 9",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "firefox",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:enterprise_linux:9"
                    ]
                }

librsvg2

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 9",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "librsvg2",
                    "defaultStatus": "unaffected",
                    "cpes": [
                        "cpe:/a:redhat:enterprise_linux:9"
                    ]
                }

rpm-ostree

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 9",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "rpm-ostree",
                    "defaultStatus": "unaffected",
                    "cpes": [
                        "cpe:/a:redhat:enterprise_linux:9"
                    ]
                }

rust

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 9",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "rust",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:enterprise_linux:9"
                    ]
                }

rust-afterburn

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 9",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "rust-afterburn",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:enterprise_linux:9"
                    ]
                }

rust-coreos-installer

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 9",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "rust-coreos-installer",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:enterprise_linux:9"
                    ]
                }

thunderbird

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 9",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "thunderbird",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:enterprise_linux:9"
                    ]
                }

trustee-guest-components

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 9",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "trustee-guest-components",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:enterprise_linux:9"
                    ]
                }

rhoai/odh-feast-operator-rhel8

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat OpenShift AI (RHOAI)",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "rhoai/odh-feast-operator-rhel8",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:openshift_ai"
                    ]
                }

rhoai/odh-feature-server-rhel8

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat OpenShift AI (RHOAI)",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "rhoai/odh-feature-server-rhel8",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:openshift_ai"
                    ]
                }

conmon-rs

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat OpenShift Container Platform 4",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "conmon-rs",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:openshift:4"
                    ]
                }

coreos-installer

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat OpenShift Container Platform 4",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "coreos-installer",
                    "defaultStatus": "unaffected",
                    "cpes": [
                        "cpe:/a:redhat:openshift:4"
                    ]
                }

kata-containers

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat OpenShift Container Platform 4",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "kata-containers",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:openshift:4"
                    ]
                }

rpm-ostree

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat OpenShift Container Platform 4",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "rpm-ostree",
                    "defaultStatus": "unaffected",
                    "cpes": [
                        "cpe:/a:redhat:openshift:4"
                    ]
                }

rust-afterburn

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat OpenShift Container Platform 4",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "rust-afterburn",
                    "defaultStatus": "unaffected",
                    "cpes": [
                        "cpe:/a:redhat:openshift:4"
                    ]
                }

python3.12-maturin

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Satellite 6",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "python3.12-maturin",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:satellite:6"
                    ]
                }

python-maturin

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Satellite 6",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "python-maturin",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:satellite:6"
                    ]
                }

rhtas/tuffer-rhel9

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Trusted Artifact Signer",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "rhtas/tuffer-rhel9",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:trusted_artifact_signer:1"
                    ]
                }

rhtas/tuftool-rhel9

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Trusted Artifact Signer",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "rhtas/tuftool-rhel9",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:trusted_artifact_signer:1"
                    ]
                }

rhtpa/rhtpa-trustification-service-rhel9

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Trusted Profile Analyzer",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "rhtpa/rhtpa-trustification-service-rhel9",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:trusted_profile_analyzer:1"
                    ]
                }

rhtpa/rhtpa-trustification-service-rhel9

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Trusted Profile Analyzer",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "rhtpa/rhtpa-trustification-service-rhel9",
                    "defaultStatus": "unaffected",
                    "cpes": [
                        "cpe:/a:redhat:trusted_profile_analyzer:2"
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON

euvd · EUVD-2025-14635

Published

EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON.

Original publisher date fields

datePublished: May 13, 2025, 9:47:24 PM

dateUpdated: Nov 5, 2026, 3:46:51 PM

9 related source bulletins · separate from aliases

openSUSE-SU-2026:12042-1: python313-ruff-0.16.10-1.1 on GA media

CVE-2025-4574

msrc_CVE-2025-4574: Crossbeam-channel: crossbeam-channel vulnerable to double free on drop

CVE-2025-4574

openSUSE-SU-2025:15551-1: cargo-c-0.10.3~git0.ee7d7ef-4.1 on GA media

CVE-2024-12224 · CVE-2025-4574 · CVE-2025-58160

SUSE-SU-2025:01591-1: Security update for python-maturin

CVE-2025-3416 · CVE-2025-4574

SUSE-SU-2026:20096-1: Security update for cargo-c

CVE-2024-12224 · CVE-2025-4574 · CVE-2025-58160

openSUSE-SU-2026:20060-1: Security update for cargo-c

CVE-2024-12224 · CVE-2025-4574 · CVE-2025-58160

openSUSE-SU-2025:15550-1: cargo-audit-0.21.2~git0.18e58c2-2.1 on GA media

CVE-2024-12224 · CVE-2025-4574 · CVE-2025-58160

openSUSE-SU-2026:21689-1: Security update for gstreamer-devtools

CVE-2025-4574 · CVE-2025-58160 · CVE-2026-25541 · CVE-2026-25727 · CVE-2026-72813 · CVE-2026-72814

SUSE-SU-2026:23572-1: Security update for gstreamer-devtools

CVE-2025-4574 · CVE-2025-58160 · CVE-2026-25541 · CVE-2026-25727 · CVE-2026-72813 · CVE-2026-72814

No normalized affected-package data is projected for this source revision. The original publisher record may contain additional product and version evidence; this does not establish that a package is unaffected.

Original source record · Cite this exact observation · Complete original publisher JSON

nvd · CVE-2025-4574

Published

NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON.

Source analysis status: Deferred

Weakness classifications: CWE-415

Original publisher date fields

published: 2025-05-13T22:15:25.143

lastModified: 2026-11-05T16:17:18.877

No normalized affected-package data is projected for this source revision. The original publisher record may contain additional product and version evidence; this does not establish that a package is unaffected.

Original source record · Cite this exact observation · Complete original publisher JSON

osv · GHSA-pg9f-39pc-qf8g

Published

crossbeam-channel

crates.io

SEMVER · introduced 0.5.12 → fixed 0.5.15

Original source record · Cite this exact observation · Complete original publisher JSON

osv · RUSTSEC-2025-0024

Published

crossbeam-channel

crates.io

SEMVER · introduced 0.5.12-0 → fixed 0.5.15

Original source record · Cite this exact observation · Complete original publisher JSON

ChangeIntel

An IT change radar: releases, security, known issues, retirements, documentation changes, and service status from public sources. Every item links to supporting evidence; dates and statuses can change after they are read.

Sources read 15 Nov 16:58 UTC · 254 of 275 readable · 250 fully read · documentation 469/469 current

No accounts or analytics; your preferences stay in your browser. Information, not advice. ChangeIntel is an independent tool and is not affiliated with or endorsed by Microsoft, Apple, Google, Broadcom (VMware), Jamf, Oracle, Mozilla, or any other vendor it covers. Product names are trademarks of their owners.