# CVE-2023-26964: sccache: This update for sccache fixes the following issues:  Update to version 0.15.0~17.  - CVE-2023-26964: hyper,h2: high r...

CVE-2023-26964 is fixed in 3 products on 1 platform, first by DEBIAN-CVE-2023-26964, released April 11, 2023. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2023-26964
- Priority: High
- CVSS: 7.5 (high)
- EPSS: 0.0112
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Apr 11, 2023

## Description

This update for sccache fixes the following issues:  Update to version 0.15.0~17.  - CVE-2023-26964: hyper,h2: high resource consumption due to stream stacking when H2 component processes   `HTTP2 RST_STREAM` frames (bsc#1210346). - CVE-2024-32650: rust-rustls: infinite loop in `rustls::conn::ConnectionCommon:complete_io()` when processing client   input network input (bsc#1223238). - CVE-2025-3416: openssl: use-after-free in `Md::fetch` and `Cipher::fetch` (bsc#1242611). - CVE-2026-25727: time: stack exhaustion in the RFC 2822 date parser when processing certain user provided input   (bsc#1257923). - CVE-2026-41676: openssl: short buffer overflow via `Deriver:derive` and `PkeyCtxRef:derive` when using OpenSSL 1.1.1   (bsc#1270206). - CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length   (bsc#1270559). - CVE-2026-41678: openssl: OOB write due to incorrect bounds assertion in `aes::unwrap_key()` (bsc#1270693). - CVE-2026-41681: openssl: stack corruption due to `MdCtxRef::digest_final()` writing past caller buffer with no length   check (bsc#1270736). - CVE-2026-41898: openssl: information leak to network peers due to unchecked callback-returned length in PSK and   cookie generate trampolines (bsc#1270869). - CVE-2026-42327: openssl: undefined behavior in `X509Ref::ocsp_responders` when processing certificates with non-UTF-8   OCSP URLs (bsc#1270512). - CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding (bsc#1270938). - CVE-2026-45784: openssl: out-of-bounds write in `CipherCtxRef::cipher_update_inplace` for AES-KW-PAD ciphers   (bsc#1270948).

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | kanidm opensuse-leap 15.6 | 1.3.3~git0.f075d13-bp156.4.1 | [OPENSUSE-SU-2024:0294-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2024-0294-1.md) | Sep 9, 2024 |
| Linux | rust-h2 Debian 12.15 (bookworm) | 0.3.13-2 | [DEBIAN-CVE-2023-26964](https://patchblox.com/security/data/fix/linux/debian-cve-2023-26964.md) | Apr 11, 2023 |
| Linux | rust-h2 Debian 13.5 (trixie) | 0.3.13-2 | [DEBIAN-CVE-2023-26964](https://patchblox.com/security/data/fix/linux/debian-cve-2023-26964.md) | Apr 11, 2023 |
| Linux | rust-h2 Debian 14 | 0.3.13-2 | [DEBIAN-CVE-2023-26964](https://patchblox.com/security/data/fix/linux/debian-cve-2023-26964.md) | Apr 11, 2023 |
| Linux | sccache sles 15.6 | 0.16.0~0-150600.10.11.1 | [SUSE-SU-2026:3022-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-3022-1.md) | Jul 15, 2026 |
| Linux | sccache sles 15.7 | 0.16.0~0-150600.10.11.1 | [SUSE-SU-2026:3022-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-3022-1.md) | Jul 15, 2026 |

---

Data as of 2026-11-08T13:06:02Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.