{
  "cveId": "CVE-2026-66746",
  "url": "https://patchblox.com/security/cve/CVE-2026-66746",
  "summary": "CVE-2026-66746 is fixed in sccache on 1 platform, first by SUSE-SU-2026:3674-1, released August 21, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "sccache: This update for sccache fixes the following issues:\n\n- CVE-2026-25541: bytes: integer overflow in \u0027BytesMut:reserve\u0027...",
  "description": "This update for sccache fixes the following issues:\n\n- CVE-2026-25541: bytes: integer overflow in \u0027BytesMut:reserve\u0027 can lead to undefined \n  behavior and crashes (bsc#1274146).\n- CVE-2026-66746: rouille: HTTP Response Splitting via Unvalidated Response \n  Header Values (bsc#1273881).\n- CVE-2026-66754: rouille: remove_prefix function that allows remote unauthenticated \n  attackers to crash the server by sending a crafted percent-encoded URL (bsc#1273884).\n- CVE-2026-67181: rouille: HTTP Request Smuggling via Transfer-Encoding \n  Desynchronization (bsc#1273886).\n- CVE-2026-67182: rouille: HTTP Request Smuggling Enables Front-End Access Control \n  Bypass (bsc#1273888).\n\nChanges for sccache:\n\n- Update to version 0.17.0~1:\n \n * Add experimental concurrent cache support\n * Release 0.17.0\n * tests: pin libc in the dist test crate\n * doc: clarify server-side outputs and drop \u0027recommended mode\u0027 claim\n * doc: document SCCACHE_CLIENT_SIDE env var\n * doc: document client-side and direct modes in Architecture.md\n * Fix description of Unix socket-based Redis connection\n * server: remove redundant async block in start_compile_task\n * server: simplify bind() request loops with ? instead of manual match arms\n * Add support for arg files in Rust (#2782)\n * feat: support S3 SSE-KMS with AWS-managed and customer-managed keys (#2770)\n * abort compile tasks and associated subprocesses when a client disconnects\n * treat -ivfsoverlay as a preprocessor-only argument\n * gcc: refine response-file tokenizer visibility and whitespace handling\n * integration: convert cmake 4.x modules XFAIL test to a passing test\n * gcc/clang: cache and distribute builds using quoted @response files\n * fix: Fix ToolchainPackager cfg gate to build on ppc64le/s390x\n * fix: make gcc diagnostics color output work the same as for rustc\n * implement client-side mode\n * split handle_compile_response so that the compilation result can be handled \n   separately\n * implement IpcStorage -- Storage backend over IPC\n * extend wire protocol with storage RPCs\n * implement AddAssign for ServerStats and related types\n * add Storage::get_path for direct file access\n * implement get_raw/put_raw on MultiLevelStorage\n * add client_side_mode config flag (SCCACHE_CLIENT_SIDE)\n * Extract new_client_runtime() helper to DRY up client runtime creation\n * Clarify single-threaded runtime rationale comment (grammar)\n * fix: use single-threaded tokio runtime in sccache dist-client\n * fix: use single-threaded tokio runtime in sccache client\n * fix: handle disabled cache backend features in multilevel chain\n * Fix ldd output parsing: remove .exists() check that failed on systems where the \n   symlink source path does not exist locally (e.g. aarch64)\n * Fix cfg guard for PanicToolchainPackager to also cover non-x86_64 Linux \n   architectures (e.g. aarch64)",
  "published": "2026-08-21T09:04:42Z",
  "severity": "",
  "epss": 0.0034,
  "epssPercentile": 0.27683,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "sccache",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "0.18.0~2-160000.1.1",
      "fix": "OPENSUSE-SU-2026:21982-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-21982-1",
      "released": "2026-09-30T17:58:26Z"
    },
    {
      "platform": "linux",
      "product": "sccache",
      "release": "sles 15.6",
      "fixedVersion": "0.17.0~1-150600.10.14.1",
      "fix": "SUSE-SU-2026:3674-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-3674-1",
      "released": "2026-08-21T09:04:42Z"
    },
    {
      "platform": "linux",
      "product": "sccache",
      "release": "sles 15.7",
      "fixedVersion": "0.17.0~1-150600.10.14.1",
      "fix": "SUSE-SU-2026:3674-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-3674-1",
      "released": "2026-08-21T09:04:42Z"
    },
    {
      "platform": "linux",
      "product": "sccache",
      "release": "sles 16.0",
      "fixedVersion": "0.18.0~2-160000.1.1",
      "fix": "SUSE-SU-2026:23983-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-23983-1",
      "released": "2026-09-30T17:49:13Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-10T13:56:55Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}