# CVE-2026-67182: sccache: This update for sccache fixes the following issues: - CVE-2026-25541: bytes: integer overflow in 'BytesMut:reserve'... CVE-2026-67182 is fixed in sccache on 1 platform, first by SUSE-SU-2026:3674-1, released August 21, 2026. It is not reported as exploited. Patch Radar priority: Routine. - Web page: https://patchblox.com/security/cve/CVE-2026-67182 - Priority: Routine - CVSS: n/a - EPSS: 0.0063 - CISA KEV: not listed - Exploited (vendor report): no - Publicly disclosed: no - Published: Aug 21, 2026 ## Description This update for sccache fixes the following issues: - CVE-2026-25541: bytes: integer overflow in 'BytesMut:reserve' can lead to undefined behavior and crashes (bsc#1274146). - CVE-2026-66746: rouille: HTTP Response Splitting via Unvalidated Response Header Values (bsc#1273881). - CVE-2026-66754: rouille: remove_prefix function that allows remote unauthenticated attackers to crash the server by sending a crafted percent-encoded URL (bsc#1273884). - CVE-2026-67181: rouille: HTTP Request Smuggling via Transfer-Encoding Desynchronization (bsc#1273886). - CVE-2026-67182: rouille: HTTP Request Smuggling Enables Front-End Access Control Bypass (bsc#1273888). Changes for sccache: - Update to version 0.17.0~1: * Add experimental concurrent cache support * Release 0.17.0 * tests: pin libc in the dist test crate * doc: clarify server-side outputs and drop 'recommended mode' claim * doc: document SCCACHE_CLIENT_SIDE env var * doc: document client-side and direct modes in Architecture.md * Fix description of Unix socket-based Redis connection * server: remove redundant async block in start_compile_task * server: simplify bind() request loops with ? instead of manual match arms * Add support for arg files in Rust (#2782) * feat: support S3 SSE-KMS with AWS-managed and customer-managed keys (#2770) * abort compile tasks and associated subprocesses when a client disconnects * treat -ivfsoverlay as a preprocessor-only argument * gcc: refine response-file tokenizer visibility and whitespace handling * integration: convert cmake 4.x modules XFAIL test to a passing test * gcc/clang: cache and distribute builds using quoted @response files * fix: Fix ToolchainPackager cfg gate to build on ppc64le/s390x * fix: make gcc diagnostics color output work the same as for rustc * implement client-side mode * split handle_compile_response so that the compilation result can be handled separately * implement IpcStorage -- Storage backend over IPC * extend wire protocol with storage RPCs * implement AddAssign for ServerStats and related types * add Storage::get_path for direct file access * implement get_raw/put_raw on MultiLevelStorage * add client_side_mode config flag (SCCACHE_CLIENT_SIDE) * Extract new_client_runtime() helper to DRY up client runtime creation * Clarify single-threaded runtime rationale comment (grammar) * fix: use single-threaded tokio runtime in sccache dist-client * fix: use single-threaded tokio runtime in sccache client * fix: handle disabled cache backend features in multilevel chain * Fix ldd output parsing: remove .exists() check that failed on systems where the symlink source path does not exist locally (e.g. aarch64) * Fix cfg guard for PanicToolchainPackager to also cover non-x86_64 Linux architectures (e.g. aarch64) ## Where it's fixed | Platform | Product | Fixed in | Fix | Released | |---|---|---|---|---| | Linux | sccache opensuse-leap 16.0 | 0.18.0~2-160000.1.1 | [OPENSUSE-SU-2026:21982-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21982-1.md) | Sep 30, 2026 | | Linux | sccache sles 15.6 | 0.17.0~1-150600.10.14.1 | [SUSE-SU-2026:3674-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-3674-1.md) | Aug 21, 2026 | | Linux | sccache sles 15.7 | 0.17.0~1-150600.10.14.1 | [SUSE-SU-2026:3674-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-3674-1.md) | Aug 21, 2026 | | Linux | sccache sles 16.0 | 0.18.0~2-160000.1.1 | [SUSE-SU-2026:23983-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-23983-1.md) | Sep 30, 2026 | --- Data as of 2026-11-10T13:56:55Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.