sccache: This update for sccache fixes the following issues: Update to version 0.15.0~17. - CVE-2023-26964: hyper,h2: high r...
CVE-2023-26964 is fixed in 3 products on 1 platform, first by DEBIAN-CVE-2023-26964, released April 11, 2023. It is not reported as exploited. Patch Radar priority: High.
This update for sccache fixes the following issues: Update to version 0.15.0~17. - CVE-2023-26964: hyper,h2: high resource consumption due to stream stacking when H2 component processes `HTTP2 RST_STREAM` frames (bsc#1210346). - CVE-2024-32650: rust-rustls: infinite loop in `rustls::conn::ConnectionCommon:complete_io()` when processing client input network input (bsc#1223238). - CVE-2025-3416: openssl: use-after-free in `Md::fetch` and `Cipher::fetch` (bsc#1242611). - CVE-2026-25727: time: stack exhaustion in the RFC 2822 date parser when processing certain user provided input (bsc#1257923). - CVE-2026-41676: openssl: short buffer overflow via `Deriver:derive` and `PkeyCtxRef:derive` when using OpenSSL 1.1.1 (bsc#1270206). - CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length (bsc#1270559). - CVE-2026-41678: openssl: OOB write due to incorrect bounds assertion in `aes::unwrap_key()` (bsc#1270693). - CVE-2026-41681: openssl: stack corruption due to `MdCtxRef::digest_final()` writing past caller buffer with no length check (bsc#1270736). - CVE-2026-41898: openssl: information leak to network peers due to unchecked callback-returned length in PSK and cookie generate trampolines (bsc#1270869). - CVE-2026-42327: openssl: undefined behavior in `X509Ref::ocsp_responders` when processing certificates with non-UTF-8 OCSP URLs (bsc#1270512). - CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding (bsc#1270938). - CVE-2026-45784: openssl: out-of-bounds write in `CipherCtxRef::cipher_update_inplace` for AES-KW-PAD ciphers (bsc#1270948).
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| kanidm · opensuse-leap 15.6 | 1.3.3~git0.f075d13-bp156.4.1 | OPENSUSE-SU-2024:0294-1 | Sep 9, 2024 |
| rust-h2 · Debian 12.15 (bookworm) | 0.3.13-2 | DEBIAN-CVE-2023-26964 | Apr 11, 2023 |
| rust-h2 · Debian 13.5 (trixie) | 0.3.13-2 | DEBIAN-CVE-2023-26964 | Apr 11, 2023 |
| rust-h2 · Debian 14 | 0.3.13-2 | DEBIAN-CVE-2023-26964 | Apr 11, 2023 |
| sccache · sles 15.6 | 0.16.0~0-150600.10.11.1 | SUSE-SU-2026:3022-1 | Jul 15, 2026 |
| sccache · sles 15.7 | 0.16.0~0-150600.10.11.1 | SUSE-SU-2026:3022-1 | Jul 15, 2026 |
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.