SUSE-SU-2026:20096-1
- Source
- https://www.suse.com/support/update/announcement/2026/suse-su-202620096-1/
- Import Source
- https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:20096-1.json
- JSON Data
- https://api.osv.dev/v1/vulns/SUSE-SU-2026:20096-1
- Upstream
- Related
- Published
- 2026-01-19T10:38:15Z
- Modified
- 2026-03-23T04:52:36Z
- Summary
- Security update for cargo-c
- Details
-
This update for cargo-c fixes the following issues:
- CVE-2025-4574: crossbeam-channel: Fixed double-free on drop in Channel::discard_all_messages (bsc#1243179)
- CVE-2025-58160: tracing-subscriber: Fixed log pollution (bsc#1249012)
- CVE-2024-12224: idna: Fixed improper validation of Punycode labels (bsc#1243851)
Other fixes:
- Fixed _service file to have proper versioning
- Update to version 0.10.15~git0.3e178d5:
- Bump actions/download-artifact from 4 to 5
- Update implib requirement from 0.3.5 to 0.4.0
- Add rlib to the targets when building tests
- Allow disabling emission of library version constants in header files
- Bump to cargo 0.90
- Fix static_libraries swallowing sequence of -framework flags
- Fix non-POSIX paths in Libdir under Windows
- Bump actions-rs-plus/clippy-check from 2.2.1 to 2.3.0
- Fix clippy lints
- Bump cargo-0.89, object-0.37.1, cbindgen-0.29
- References
-
- https://www.suse.com/support/update/announcement/2026/suse-su-202620096-1/
- https://bugzilla.suse.com/1243179
- https://bugzilla.suse.com/1243851
- https://bugzilla.suse.com/1249012
- https://www.suse.com/security/cve/CVE-2024-12224
- https://www.suse.com/security/cve/CVE-2025-4574
- https://www.suse.com/security/cve/CVE-2025-58160
Affected packages
SUSE:Linux Enterprise Server 16.0 / cargo-c
Package
- Name
- cargo-c
- Purl
- pkg:rpm/suse/cargo-c&distro=SUSE%20Linux%20Enterprise%20Server%2016.0