https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 23:37:58 +0000 https://cve.radiocsirt.org/vuln/cve-2025-4574 <p><strong>Affected:</strong> crossbeam-channel, Red Hat Directory Server 11, Red Hat Directory Server 12, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift AI (RHOAI), Red Hat OpenShift Container Platform 4, Red Hat Satellite 6 and 2 more</p> <p>In crossbeam-channel rust crate, the internal `Channel` type&#39;s `Drop` method has a race condition which could, in some circumstances, lead to a double-free that could result in memory corruption.</p> <p><strong>Affected:</strong> crossbeam-channel, Red Hat Directory Server 11, Red Hat Directory Server 12, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift AI (RHOAI), Red Hat OpenShift Container Platform 4, Red Hat Satellite 6 and 2 more</p> <p>In crossbeam-channel rust crate, the internal `Channel` type&#39;s `Drop` method has a race condition which could, in some circumstances, lead to a double-free that could result in memory corruption.</p> https://cve.radiocsirt.org/vuln/cve-2025-4574 https://cve.radiocsirt.org/vuln/ghsa-pg9f-39pc-qf8g <p><strong>Affected:</strong> crates.io: crossbeam-channel</p> <p>The internal `Channel` type&#39;s `Drop` method has a race which could, in some circumstances, lead to a double-free. This could result in memory corruption.</p> <p>Quoting from the [upstream description in merge request \#1187](https://github.com/crossbeam-rs/crossbeam/pull/1187#issue-2980761131):</p> <p>&gt; The problem lies in the fact that `dicard_all_messages` contained two paths that could lead to `head.block` being read but only one of them would swap the value. This meant that `dicard_all_messages` could end up observing a non-null block pointer (and therefore attempting to free it) without setting `head.block` to null. This would then lead to `Channel::drop` making a second attempt at dropping the same pointer.</p> <p>The bug was introduced while fixing a memory leak, in upstream [MR \#1084](https://github.com/crossbeam-rs/crossbeam/pull/1084), first published in 0.5.12.</p> <p>The fix is in upstream [MR \#1187](https://github.com/crossbeam-rs/crossbeam/pull/1187) and has been published in 0.5.15</p> <p><strong>Affected:</strong> crates.io: crossbeam-channel</p> <p>The internal `Channel` type&#39;s `Drop` method has a race which could, in some circumstances, lead to a double-free. This could result in memory corruption.</p> <p>Quoting from the [upstream description in merge request \#1187](https://github.com/crossbeam-rs/crossbeam/pull/1187#issue-2980761131):</p> <p>&gt; The problem lies in the fact that `dicard_all_messages` contained two paths that could lead to `head.block` being read but only one of them would swap the value. This meant that `dicard_all_messages` could end up observing a non-null block pointer (and therefore attempting to free it) without setting `head.block` to null. This would then lead to `Channel::drop` making a second attempt at dropping the same pointer.</p> <p>The bug was introduced while fixing a memory leak, in upstream [MR \#1084](https://github.com/crossbeam-rs/crossbeam/pull/1084), first published in 0.5.12.</p> <p>The fix is in upstream [MR \#1187](https://github.com/crossbeam-rs/crossbeam/pull/1187) and has been published in 0.5.15</p> https://cve.radiocsirt.org/vuln/ghsa-pg9f-39pc-qf8g