{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for sccache",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for sccache fixes the following issues:\n\n- CVE-2024-12224: idna: idna accepts Punycode labels that do not produce any non-ASCII when decoded (bsc#1243868).\n- CVE-2026-25541: bytes: integer overflow in \u0027BytesMut:reserve\u0027 can lead to undefined behavior and crashes\n  (bsc#1274146).\n- CVE-2026-25727: time: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion\n  (bsc#1257923).\n- CVE-2026-41676: openssl: `Deriver:derive` and `PkeyCtxRef:derive` can overflow short buffers on OpenSSL 1.1.1\n  (bsc#1270206).\n- CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length in rust-\n  openssl crate (bsc#1270559).\n- CVE-2026-41678: openssl: incorrect bounds assertion in aes key wrap in rust-openssl crate (bsc#1270693).\n- CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check in rust-openssl crate\n  (bsc#1270736).\n- CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent\n  memory in rust-openssl crate (bsc#1270869).\n- CVE-2026-42327: openssl: arbitrary code execution via specially crafted certificate in rust-openssl crate\n  (bsc#1270512).\n- CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding in rust-openssl crate\n  (bsc#1270938).\n- CVE-2026-45784: openssl: out-of-bounds write in `CipherCtxRef::cipher_update_inplace` for AES-KW-PAD ciphers in rust-\n  openssl crate (bsc#1270948).\n- CVE-2026-66746: rouille: HTTP Response Splitting via Unvalidated Response Header Values (bsc#1273881).\n- CVE-2026-66754: rouille: remove_prefix function that allows remote unauthenticated attackers to crash the server by\n  sending a crafted percent-encoded URL (bsc#1273884).\n- CVE-2026-67181: rouille: HTTP Request Smuggling via Transfer-Encoding Desynchronization (bsc#1273886).\n- CVE-2026-67182: rouille: HTTP Request Smuggling Enables Front-End Access Control Bypass (bsc#1273888).\n- CVE-2026-93599: rustls-webpki: panic via empty BIT STRING (bsc#1282211).\n- CVE-2026-93600: rustls-webpki: name constraints URI validation bypass (bsc#1282211).\n- CVE-2026-93601: rustls-webpki: name constraint bypass (bsc#1282211).\n- CVE-2026-93602: rustls-webpki: CRL revocation check bypass (bsc#1282211).\n\nChanges for sccache:\n\nUpdate to version 0.18.0~2:\n * Add experimental concurrent cache support\n * chore: Remove dependency status badge (#2856)\n * Don\u0027t hand the jobserver to children that can\u0027t use it\n * dist: refuse to trim rlibs from crates that also emit a cdylib\n * fix(cache): avoid duplicate multilevel reads\n * Strip basedirs from the compiler arguments too\n * tests/integration: replace MinIO with Silo\n * ci: dump sccache logs on integration failures\n * multilevel: a chain with any writable level is writable\n * Fix parsing of #line directives\n * Release 0.18.0\n * daemonize: use an allow-list approach to inherited FDs\n * gcc, clang: make the assembler part of the cache key\n * support cl.exe /openmp:llvm\n * support all current /fsanitize*, /fsanitize-coverage*, and /fno-sanitize* args\n * support MSVC /feature argument\n * msvc: support lots of flags (#2832)\n * Update shlex dependency to version 2 (#2836)\n * gcc: mark flags as TooHard if need to cache something else (#2833)\n * clang: support more CLI options (#2834)\n * msvc: support arm64EC and fastfail flags (#2830)\n * chore: fix typo in comment (#2829)\n * nvcc: accept the --diag-error/--diag-suppress/--diag-warn family (#2816)\n * cache: allow skipping capability checks (#2822)\n * Bump opendal to 0.58.1 and fix fallout (fixes local GCS cache usage) (#2715)\n * nvcc (Windows): protect escaped quotes in dryrun lines before flattening backslashes (#2811)\n * Add an agent (#2812)\n * Add support for d20bforceinline. (#2807)\n * feat: add Microsoft Entra ID (passwordless) auth for the Azure Blob backend (#2802)\n * Bump MSRV to 1.91.0 (#2793)\n * Fix `nvcc` dryrun parsing for CUDA 13.3 (#2722)\n * test: Fixed hardcoded binary path in test\n * Release 0.17.0\n * tests: pin libc in the dist test crate\n * doc: clarify server-side outputs and drop \u0027recommended mode\u0027 claim\n * doc: document SCCACHE_CLIENT_SIDE env var\n * doc: document client-side and direct modes in Architecture.md\n * Fix description of Unix socket-based Redis connection\n * server: remove redundant async block in start_compile_task\n * server: simplify bind() request loops with ? instead of manual match arms\n * Add support for arg files in Rust (#2782)\n * feat: support S3 SSE-KMS with AWS-managed and customer-managed keys (#2770)\n * abort compile tasks and associated subprocesses when a client disconnects\n * treat -ivfsoverlay as a preprocessor-only argument\n * gcc: refine response-file tokenizer visibility and whitespace handling\n * integration: convert cmake 4.x modules XFAIL test to a passing test\n * gcc/clang: cache and distribute builds using quoted @response files\n * fix: Fix ToolchainPackager cfg gate to build on ppc64le/s390x\n * fix: make gcc diagnostics color output work the same as for rustc\n * implement client-side mode\n * split handle_compile_response so that the compilation result can be handled separately\n * implement IpcStorage -- Storage backend over IPC\n * extend wire protocol with storage RPCs\n * implement AddAssign for ServerStats and related types\n * add Storage::get_path for direct file access\n * implement get_raw/put_raw on MultiLevelStorage\n * add client_side_mode config flag (SCCACHE_CLIENT_SIDE)\n * Extract new_client_runtime() helper to DRY up client runtime creation\n * Clarify single-threaded runtime rationale comment (grammar)\n * fix: use single-threaded tokio runtime in sccache dist-client\n * fix: use single-threaded tokio runtime in sccache client\n * fix: handle disabled cache backend features in multilevel chain\n * Fix ldd output parsing: remove .exists() check that failed on systems where the symlink source path does not exist locally (e.g. aarch64)\n * Fix cfg guard for PanicToolchainPackager to also cover non-x86_64 Linux architectures (e.g. aarch64)\n * Release 0.16.0\n * fix: strip SCCACHE_BASEDIRS from escaped-backslash paths on Windows (#2736)\n * Ignore empty-set environment values (#2639)\n * feat: all backends support making them as read-only (#2705)\n * Enable RE on Linux-aarch64 (#2668)\n * Slightly improve logging (#2734)\n * chore: encode jwt key and cert digest with base64 in logs (#2712)\n * chore: make clippy happy (#2727)\n * feat: avoid sccache wrapper when resolving compiler (#2720)\n * Fall back to direct cache write if tempfile creation on the same fs fails (#2369)\n * remove too noisy bench\n * feat(nvcc): support argument: `--dependency-output` (#2708)\n * fix: add newline when printing dist-status to stdout\n * Revert \"Classify .s files as AssemblerToPreprocess so #include/#ifdef are hon...\"\n * Don\u0027t wait depfiles for gcc/clang preprocessed inputs\n * Classify .s files as AssemblerToPreprocess so #include/#ifdef are honored\n * prepare release 0.15.0\n * Add cargo-binstall metadata for prebuilt binary installation\n * Fix coverage\n * fix: handle directories in dep-info source file hashing\n * docs(Rust.md): Add caveats from README\n * Add retry for dists docker image build\n * ci: set crt-static for riscv64 musl targets\n * feat: Add loongarch64 support\n * feat: Implement multi-tier caching with fallback and backfilling (#2581)\n * msvc: add support for Y-, YI, Zf flags\n * Group tests logging in CI\n * Add failing test for cmake-modules + cmake 4 version\n * Unfold ninja output in the test\n * Add a comment for maintaining integration tests\n * Move cmake-modules to integration tests\n * fix: exclude CARGO_ENCODED_RUSTFLAGS from env var hash (#2651)\n * chore(deps): update rust crate quinn-proto to v0.11.14\n * Fix sync GCS initialization\n * clippy: fix from_iter_instead_of_collect lint\n * fix: add Win32_Security feature to windows-sys dependency\n * build(deps): bump actions/download-artifact from 5 to 8\n * msvc: Append the default .pdb extension for the /Fd argument (#2621)\n * build(deps): bump actions/upload-artifact from 4 to 7\n * clippy: fix ref_option lint\n * ci: install grcov from prebuilt binary instead of cargo install\n * ci: use default toolchain to install grcov\n * ci: fix artifact_failure action when target dir does not exist\n * Remove benchmark normalize_win_path_utf8 (#2634)\n * Revert \"actions: add security audit workflow (#2594)\" (#2603)\n * partial c++20 module support (#2516)\n * clippy: fix ptr_as_ptr lint (#2611)\n * Add support for `d1nodatetime` \u0026 `await:strict` MSVC flags (#2617)\n * chore: switch thirtyfour_sync to thirtyfour (#2613)\n * clippy: fix manual_string_new lint (#2609)\n * clippy: fix unnecessary_semicolon lint (#2615)\n * clippy: fix explicit_into_iter_loop lint (#2616)\n * Avoid double-caching when ccache is installed in PATH (#2524)\n * clippy: fix cloned_instead_of_copied lint (#2605)\n * clippy: fix semicolon_if_nothing_returned lint (#2601)\n * Move PreprocessorCacheModeConfig to src/config.rs (#2604)\n * clippy: fix cloned_ref_to_slice_refs lint (#2602)\n * prepare the new release (#2600)\n * chore: update to toml 0.9 (#2599)\n * ci: Add coverage to integration tests, report it to Codecov.io (#2598)\n * Preparation for multilevel caching (#2597)\n * Add sccache-dist to flake.nix (#2579)\n * fixup! cargo fmt\n * fixup! rustfmt update\n * Extract FileObjectSource, CacheRead and CacheWrite to cache_io.rs\n * chore: update to nix 0.30\n * Add a helper method to get a correct backend name\n * Add cos feature gate to RemoteStorage\n * Simplify profiles for integration tests\n * clippy: fix implicit_clone lint (#2584)\n * actions: add security audit workflow (#2594)\n * docs: fix examples showing an xz-compress toolchain archive (#2587)\n * add benches for normalize_win_path strip_basedirs (#2588)\n * snap: update to core24 (#2570)\n * Add .rustfmt.toml for consistent style between `rustfmt` and `cargo fmt` (#2582)\n * add comments about auth token requirements (#2583)\n * chore: update to tokio-serde 0.9 (#2585)\n * ci: update freebsd to 15.0 (#2586)\n * distributed compilation support for asm \u0026 preprocessor outputs (#2557)\n * remove unused declaration (#2577)\n * Extract LazyDiskCache to a separated file (#2573)\n * Revert \"ci: show diff for toml_format\" (#2578)\n * Open Add SCCACHE_BASEDIRS support\n * ci: show diff for toml_format\n * chore: update to syslog 7\n * refactor: use matrix to reduce deduplication\n * fix: remove outdated `analysis` mode\n * Unbreak the s390x CI\n * ci: add macos-15-intel for prebuilt binary (#2555)\n * Integration tests (#2564)\n * Fix code review.\n * Impl for COS.\n * build(deps): bump opendal from 0.54.0 to 0.55.0\n * Move integration tests related stuff to subdir\n * Add Objective C Header for consistency\n * github action: fix the syntax - fails in the ci\n * sccache: prepare a new release\n * msvc: add msbuild support test\n * msvc: fix detect_showincludes_prefix with MSBuild\n * chore: update to gzp 2\n * build(deps): bump rsa from 0.9.6 to 0.9.10\n * codspeed: evaluate the memory benchmarking\n * remove too quick benchmarks\n * codspeed: move to simulation mode\n * Add realistic LRU cache access pattern benchmarks\n * Add compression characteristics benchmarks\n * Add build workflow simulation benchmarks\n * Add hash computation scenario benchmarks\n * Add batch cache entry benchmarks\n * Add cache artifact serialization benchmarks\n * Add /etc/ld.so.conf.d (if present) to compiler package\n * Assembly language support\n * fix(ci): pin serde_json to avoid zmij dependency\n * fix(ci): update zmij to fix s390x cross-compilation\n * Fix the run of the CI\n * run the benchmark in the ci\n * add benchmarks\n * dedup some code\n * Fix hash logging prefix\n * Add support for C preprocessor output\n * Add GCC pipe flag support\n * Improve save-temps gcc flags detection\n * MSVC: support forward slash as an output dir marker\n * add clang -fplugin=x regression test\n * canbeconcatenated is not accounted for in cmp\n * Reversed the order for looking `rustc`, added comment\n * Fix failing test_rlib_dep_reader_call for omit CARGO_HOME\n * fix: don\u0027t hash -parallel-jobs in Clang\n * docs: add installation steps for nix (#2523)\n * Support clang -fexperimental-assignment-tracking option (#2517)\n * add a nix flake (#2518)\n * Switch from the unmaintained daemonize crate to a maintained fork\n * chore: update to fs-err 3\n * Fix grammar of error message\n * Add server name info to stderr of remote jobs that ran, but failed\n * Remove another pointless destructuring\n * try to unbreak the ci\n * fix s390x build error\n * Add riscv64 support\n * fix: make aarch64-pc-windows-msvc also zip not tar.gz\n * Free up disk space in CI\n * MSVC on Windows only\n * Avoid \u0027No space left on device\u0027 errors in CI\n * GitHub dropped macos-13 runners\n * Proper function pointer to int cast\n * Avoid unused structs with dist-server disabled\n * no check cfg (#2507)\n * chore: switch once_cell crate to standard library (#2499)\n * Avoid unreliable assert_cmd::cargo::cargo_bin (#2489)\n * Fix build on macOS which doesn\u0027t have separate 32-bit dirent (#2492)\n * Fix Clippy warnings (#2490)\n * docs: bump MSRV to 1.85.0\n * msvc: handle \u0027/FoRelease\\\u0027 command-line argument\n * chore: drop tower dependency\n * chore: update to itertools 0.14\n * Use generator in CMAKE_MSVC_DEBUG_INFORMATION_FORMAT in README\n * Update directories to 6.0\n * Configuration.md - note logging env variables\n * chore: update to env_logger 0.11\n * deps: update blake3\n * prepare version 0.12.0\n * Update README with winget installation instructions\n * Skip CARGO_BUILD_JOBS in hash keys\n * build(deps): bump object from 0.36.7 to 0.37.1\n * Adjust tests after the rust update\n * Fix CI by adding cargo-features and updating coverage test to use modern -Cinstrument-coverage\n * Fix more clippy warnings\n * bump rustc in the ci too\n * Fix rustc 1.85 clippy warnings\n * bump to rustc 1.85 / edition 2024. mandatory for reqsign-core and run rustfmt with the version\n * fix clippy warnings\n * bump opendal to 0.54.0 \u0026 reqsign to 0.18.0\n * github action: when creating a release, make it as draft before (#2458)\n * prepare version 0.11.0 (#2457)\n * document SCCACHE_LOG_MILLIS (#2456)\n * logging: add a option to log milliseconds (Closes: #2454) (#2455)\n * feat: handle human size prefixes (#2405)\n * fix: in stats, Compare values AND keys to have a fully deterministic order (#2403)\n * Add --diagnostic-width to test for args ignored in hash\n * Ignore --diagnostic-width argument when computing hash\n * build(deps): bump actions/checkout from 4 to 5\n * build(deps): bump actions/download-artifact from 4 to 5\n * build(deps): bump actions/github-script from 7 to 8\n * Fix rustfmt\n * Fix comments on request\n * Fix clippy and rustfmt\n * Add test for count toolchain and use Determenistic for create tar archive\n * Fix mtime for reproducable toolchains\n * build(deps): bump chrono from 0.4.41 to 0.4.42\n * fix typo in an environment variable name\n * Fix documentation of azure configuration\n * Account for clippy-driver having extra prefix `rustc`\n * Fix build on Android (in Termux)\n * add support for s390x build\n * chore: replace retry crate with backon\n * Remove or replace \"Windows 2019\" CI config\n * Needs another result unwrapping, it seems\n * Test: invoking symlink \"compiler\" to \"sccache\" invokes \"compiler\"\n * Add a comment about the problem with symlinks and current_exe()\n * Fix symbolic links to sccache on linux\n * Allow the CI configuration to disable clang++ for CUDA testing\n * Don\u0027t run tests using clang++ as CUDA compiler on Windows\n * add description to sccache-dist commands\n * Display a more user-friendly error when compiling on Linux/arm64\n * Clarify documentation about \"the hash\" (aka cache key)\n * Remove stray \u0027)\u0027\n * Remove documentation for removed limitations of preprocessor cache mode\n * Fix preprocessor cache mode when the compiler outputs a dep file\n * Partially revert \"Don\u0027t cache dep file (#2322)\"\n * Do not disable preprocessor cache mode if there is a dep file\n * Fix preprocessor cache mode with distributed builds (#2173)\n * Change self of generate_hash_key() from Box\u003cSelf\u003e to \u0026mut Self\n * Remove a few IMO pointless indirections / aliases\n * Remove workaround for #2173\n * Add test for bug #2173\n * chore: fix some minor issues in comments\n * build(deps): bump chrono from 0.4.40 to 0.4.41\n * build(deps): bump memchr from 2.7.1 to 2.7.5\n * check if we can use a specific version of rust to build grcov\n * Move comment that hadn\u0027t moved with its corresponding code\n * Rework direct mode documentation some more\n * Explain what preprocessor cache mode really does\n * Reword and correct the preprocessor cache mode documentation\n * chore: Remove not working mozilla code\n * Add support for -fsanitize-ignorelist\n * github storage: adjust the doc\n * github storage: ACTIONS_CACHE_URL =\u003e ACTIONS_RESULTS_URL\n * github storage: force version 2\n * Update codecov badge in README.md\n * Expand tests for dist-server\n * ci: Consolidate testing, coverage\n * ci: Update ubuntu-20.04 runners to ubuntu-22.04\n * chore: fix some comments\n * Give the --dist-status user some information about when a retry will happen.\n * Add support for Xclang flag \u0027-mrelax-all\u0027\n * Add support for Xclang flag \u0027-mconstructor-aliases\u0027\n * feat(utils): Add support for object \u003e= 0.33\n * fix(tests): Remove executable bit from oauth.rs\n * build(deps): bump openssl from 0.10.64 to 0.10.72\n * build(deps): bump tokio from 1.41.0 to 1.43.1\n * Improve the CARGO_INCREMENTAL checking (#2364)\n * build(deps): bump chrono from 0.4.38 to 0.4.40\n * build(deps): bump clap from 4.4.18 to 4.5.13\n * build(deps): bump ring from 0.17.7 to 0.17.13\n * Bail on `nvcc -time` and `nvcc -fdevice-time-trace` flags\n * test hip with librandomize_readdir\n * Add randomize_readdir test utility\n * fix non-strict HIP device lib order\n * Create config during testing to collect coverage data\n * Extend coverage to distributed tests\n * chore: replace num_cpus crate with available_parallelism in standard library (#2342)\n * Update CI coverage: grcov/codecov\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Leap-16.0-1793",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_21982-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1243868",
        "url": "https://bugzilla.suse.com/1243868"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1257923",
        "url": "https://bugzilla.suse.com/1257923"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1270206",
        "url": "https://bugzilla.suse.com/1270206"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1270512",
        "url": "https://bugzilla.suse.com/1270512"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1270559",
        "url": "https://bugzilla.suse.com/1270559"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1270693",
        "url": "https://bugzilla.suse.com/1270693"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1270736",
        "url": "https://bugzilla.suse.com/1270736"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1270869",
        "url": "https://bugzilla.suse.com/1270869"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1270938",
        "url": "https://bugzilla.suse.com/1270938"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1270948",
        "url": "https://bugzilla.suse.com/1270948"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1273881",
        "url": "https://bugzilla.suse.com/1273881"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1273884",
        "url": "https://bugzilla.suse.com/1273884"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1273886",
        "url": "https://bugzilla.suse.com/1273886"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1273888",
        "url": "https://bugzilla.suse.com/1273888"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1274146",
        "url": "https://bugzilla.suse.com/1274146"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1282211",
        "url": "https://bugzilla.suse.com/1282211"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-12224 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-12224/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-25541 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-25541/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-25727 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-25727/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-41676 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-41676/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-41677 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-41677/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-41678 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-41678/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-41681 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-41681/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-41898 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-41898/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-42327 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-42327/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-44662 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-44662/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-45784 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-45784/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-66746 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-66746/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-66754 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-66754/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-67181 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-67181/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-67182 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-67182/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-93599 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-93599/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-93600 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-93600/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-93601 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-93601/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-93602 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-93602/"
      }
    ],
    "title": "Security update for sccache",
    "tracking": {
      "current_release_date": "2026-10-01T16:39:38Z",
      "generator": {
        "date": "2026-09-30T17:58:26Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2026:21982-1",
      "initial_release_date": "2026-09-30T17:58:26Z",
      "revision_history": [
        {
          "date": "2026-09-30T17:58:26Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-10-01T16:39:38Z",
          "number": "2",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "sccache-0:0.18.0~2-160000.1.1.aarch64",
                "product": {
                  "name": "sccache-0:0.18.0~2-160000.1.1.aarch64",
                  "product_id": "sccache-0:0.18.0~2-160000.1.1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/sccache@0.18.0~2-160000.1.1?arch=aarch64\u0026upstream=sccache-0:0.18.0~2-160000.1.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "sccache-0:0.18.0~2-160000.1.1.ppc64le",
                "product": {
                  "name": "sccache-0:0.18.0~2-160000.1.1.ppc64le",
                  "product_id": "sccache-0:0.18.0~2-160000.1.1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/sccache@0.18.0~2-160000.1.1?arch=ppc64le\u0026upstream=sccache-0:0.18.0~2-160000.1.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "sccache-0:0.18.0~2-160000.1.1.s390x",
                "product": {
                  "name": "sccache-0:0.18.0~2-160000.1.1.s390x",
                  "product_id": "sccache-0:0.18.0~2-160000.1.1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/sccache@0.18.0~2-160000.1.1?arch=s390x\u0026upstream=sccache-0:0.18.0~2-160000.1.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "sccache-0:0.18.0~2-160000.1.1.x86_64",
                "product": {
                  "name": "sccache-0:0.18.0~2-160000.1.1.x86_64",
                  "product_id": "sccache-0:0.18.0~2-160000.1.1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/sccache@0.18.0~2-160000.1.1?arch=x86_64\u0026upstream=sccache-0:0.18.0~2-160000.1.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Leap 16.0",
                "product": {
                  "name": "openSUSE Leap 16.0",
                  "product_id": "openSUSE Leap 16.0"
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "sccache-0:0.18.0~2-160000.1.1.aarch64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.aarch64"
        },
        "product_reference": "sccache-0:0.18.0~2-160000.1.1.aarch64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "sccache-0:0.18.0~2-160000.1.1.ppc64le as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.ppc64le"
        },
        "product_reference": "sccache-0:0.18.0~2-160000.1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "sccache-0:0.18.0~2-160000.1.1.s390x as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.s390x"
        },
        "product_reference": "sccache-0:0.18.0~2-160000.1.1.s390x",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "sccache-0:0.18.0~2-160000.1.1.x86_64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.x86_64"
        },
        "product_reference": "sccache-0:0.18.0~2-160000.1.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-12224",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-12224"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Improper Validation of Unsafe Equivalence in punycode by the idna crate from Servo rust-url allows an attacker to create a punycode hostname that one part of a system might treat as distinct while another part of that system would treat as equivalent to another hostname.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.aarch64",
          "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.s390x",
          "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-12224",
          "url": "https://www.suse.com/security/cve/CVE-2024-12224"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1243848 for CVE-2024-12224",
          "url": "https://bugzilla.suse.com/1243848"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.aarch64",
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.s390x",
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.2,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.aarch64",
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.s390x",
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-30T17:58:26Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2024-12224"
    },
    {
      "cve": "CVE-2026-25541",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-25541"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Bytes is a utility library for working with bytes. From version 1.2.1 to before 1.11.1, Bytes is vulnerable to integer overflow in BytesMut::reserve. In the unique reclaim path of BytesMut::reserve, if the condition \"v_capacity \u003e= new_cap + offset\" uses an unchecked addition. When new_cap + offset overflows usize in release builds, this condition may incorrectly pass, causing self.cap to be set to a value that exceeds the actual allocated capacity. Subsequent APIs such as spare_capacity_mut() then trust this corrupted cap value and may create out-of-bounds slices, leading to UB. This behavior is observable in release builds (integer overflow wraps), whereas debug builds panic due to overflow checks. This issue has been patched in version 1.11.1.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.aarch64",
          "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.s390x",
          "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-25541",
          "url": "https://www.suse.com/security/cve/CVE-2026-25541"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1271347 for CVE-2026-25541",
          "url": "https://bugzilla.suse.com/1271347"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.aarch64",
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.s390x",
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.aarch64",
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.s390x",
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-30T17:58:26Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-25541"
    },
    {
      "cve": "CVE-2026-25727",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-25727"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "time provides date and time handling in Rust. From 0.3.6 to before 0.3.47, when user-provided input is provided to any type that parses with the RFC 2822 format, a denial of service attack via stack exhaustion is possible. The attack relies on formally deprecated and rarely-used features that are part of the RFC 2822 format used in a malicious manner. Ordinary, non-malicious input will never encounter this scenario. A limit to the depth of recursion was added in v0.3.47. From this version, an error will be returned rather than exhausting the stack.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.aarch64",
          "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.s390x",
          "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-25727",
          "url": "https://www.suse.com/security/cve/CVE-2026-25727"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1257901 for CVE-2026-25727",
          "url": "https://bugzilla.suse.com/1257901"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.aarch64",
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.s390x",
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.aarch64",
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.s390x",
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-30T17:58:26Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-25727"
    },
    {
      "cve": "CVE-2026-41676",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-41676"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "rust-openssl provides OpenSSL bindings for the Rust programming language.  From 0.9.27 to before 0.10.78, Deriver::derive (and PkeyCtxRef::derive) sets len = buf.len() and passes it as the in/out length to EVP_PKEY_derive, relying on OpenSSL to honor it. On OpenSSL 1.1.x, X25519, X448, DH and HKDF-extract ignore the incoming *keylen, unconditionally writing the full shared secret (32/56/prime-size bytes). A caller passing a short slice gets a heap/stack overflow from safe code. OpenSSL 3.x providers do check, so this only impacts older OpenSSL. This vulnerability is fixed in 0.10.78.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.aarch64",
          "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.s390x",
          "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-41676",
          "url": "https://www.suse.com/security/cve/CVE-2026-41676"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1270137 for CVE-2026-41676",
          "url": "https://bugzilla.suse.com/1270137"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1271911 for CVE-2026-41676",
          "url": "https://bugzilla.suse.com/1271911"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.aarch64",
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.s390x",
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.aarch64",
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.s390x",
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-30T17:58:26Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-41676"
    },
    {
      "cve": "CVE-2026-41677",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-41677"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "rust-openssl provides OpenSSL bindings for the Rust programming language.  From 0.9.0 to before 0.10.78, the *_from_pem_callback APIs did not validate the length returned by the user\u0027s callback. A password callback that returns a value larger than the buffer it was given can cause some versions of OpenSSL to over-read this buffer. OpenSSL 3.x is not affected by this. This vulnerability is fixed in 0.10.78.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.aarch64",
          "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.s390x",
          "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-41677",
          "url": "https://www.suse.com/security/cve/CVE-2026-41677"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1270540 for CVE-2026-41677",
          "url": "https://bugzilla.suse.com/1270540"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1271911 for CVE-2026-41677",
          "url": "https://bugzilla.suse.com/1271911"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.aarch64",
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.s390x",
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.aarch64",
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.s390x",
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-30T17:58:26Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-41677"
    },
    {
      "cve": "CVE-2026-41678",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-41678"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "rust-openssl provides OpenSSL bindings for the Rust programming language.  From  to before 0.10.78, aes::unwrap_key() contains an incorrect assertion: it checks that out.len() + 8 \u003c= in_.len(), but this condition is reversed. The intended invariant is out.len() \u003e= in_.len() - 8, ensuring the output buffer is large enough. Because of the inverted check, the function only accepts buffers at or below the minimum required size and rejects larger ones. If a smaller buffer is provided the function will write past the end of out by in_.len() - 8 - out.len() bytes, causing an out-of-bounds write from a safe public function. This vulnerability is fixed in 0.10.78.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.aarch64",
          "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.s390x",
          "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-41678",
          "url": "https://www.suse.com/security/cve/CVE-2026-41678"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1270641 for CVE-2026-41678",
          "url": "https://bugzilla.suse.com/1270641"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1271911 for CVE-2026-41678",
          "url": "https://bugzilla.suse.com/1271911"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.aarch64",
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.s390x",
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.aarch64",
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.s390x",
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-30T17:58:26Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-41678"
    },
    {
      "cve": "CVE-2026-41681",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-41681"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "rust-openssl provides OpenSSL bindings for the Rust programming language.  From 0.10.39 to before 0.10.78, EVP_DigestFinal() always writes EVP_MD_CTX_size(ctx) to the out buffer. If out is smaller than that, MdCtxRef::digest_final() writes past its end, usually corrupting the stack. This is reachable from safe Rust. This vulnerability is fixed in 0.10.78.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.aarch64",
          "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.s390x",
          "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-41681",
          "url": "https://www.suse.com/security/cve/CVE-2026-41681"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1270719 for CVE-2026-41681",
          "url": "https://bugzilla.suse.com/1270719"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1271911 for CVE-2026-41681",
          "url": "https://bugzilla.suse.com/1271911"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.aarch64",
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.s390x",
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.aarch64",
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.s390x",
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-30T17:58:26Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-41681"
    },
    {
      "cve": "CVE-2026-41898",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-41898"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "rust-openssl provides OpenSSL bindings for the Rust programming language.  From 0.9.24 to before 0.10.78, the FFI trampolines behind SslContextBuilder::set_psk_client_callback, set_psk_server_callback, set_cookie_generate_cb, and set_stateless_cookie_generate_cb forwarded the user closure\u0027s returned usize directly to OpenSSL without checking it against the \u0026mut [u8] that was handed to the closure. This can lead to buffer overflows and other unintended consequences. This vulnerability is fixed in 0.10.78.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.aarch64",
          "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.s390x",
          "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-41898",
          "url": "https://www.suse.com/security/cve/CVE-2026-41898"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1270798 for CVE-2026-41898",
          "url": "https://bugzilla.suse.com/1270798"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1271911 for CVE-2026-41898",
          "url": "https://bugzilla.suse.com/1271911"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.aarch64",
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.s390x",
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.aarch64",
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.s390x",
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-30T17:58:26Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-41898"
    },
    {
      "cve": "CVE-2026-42327",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-42327"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.9.7 to before 0.10.79, X509Ref::ocsp_responders returns OCSP responder URLs from a certificate\u0027s AIA extension as OpensslString, whose Deref\u003cTarget = str\u003e wraps the raw bytes with str::from_utf8_unchecked. OpenSSL does not enforce that the underlying IA5String is ASCII, so a certificate with non-UTF-8 bytes in its OCSP accessLocation causes safe Rust code to construct a \u0026str that violates the UTF-8 invariant - resulting in undefined behavior. This vulnerability is fixed in 0.10.79.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.aarch64",
          "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.s390x",
          "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-42327",
          "url": "https://www.suse.com/security/cve/CVE-2026-42327"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1270454 for CVE-2026-42327",
          "url": "https://bugzilla.suse.com/1270454"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1271911 for CVE-2026-42327",
          "url": "https://bugzilla.suse.com/1271911"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.aarch64",
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.s390x",
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.aarch64",
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.s390x",
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-30T17:58:26Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-42327"
    },
    {
      "cve": "CVE-2026-44662",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-44662"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.10.0 to before 0.10.79, CipherCtxRef::cipher_update, CipherCtxRef::cipher_update_vec, and symm::Crypter::update incorrectly sized output buffers when used with AES key-wrap-with-padding ciphers (EVP_aes_{128,192,256}_wrap_pad). For a non-multiple-of-8 input, OpenSSL writes up to 7 bytes past the end of the caller\u0027s buffer or Vec, producing attacker-controllable heap corruption when the plaintext length is attacker-influenced. This only impacts users using AES key-wrap-with-padding ciphers. This vulnerability is fixed in 0.10.79.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.aarch64",
          "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.s390x",
          "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-44662",
          "url": "https://www.suse.com/security/cve/CVE-2026-44662"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1270872 for CVE-2026-44662",
          "url": "https://bugzilla.suse.com/1270872"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1271911 for CVE-2026-44662",
          "url": "https://bugzilla.suse.com/1271911"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.aarch64",
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.s390x",
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.aarch64",
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.s390x",
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-30T17:58:26Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-44662"
    },
    {
      "cve": "CVE-2026-45784",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-45784"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.10.50 until 0.10.80, CipherCtxRef::cipher_update_inplace in openssl/src/cipher_ctx.rs incorrectly sized output buffers when used with AES key-wrap-with-padding ciphers EVP_aes_{128,192,256}_wrap_pad. For a non-multiple-of-8 input, OpenSSL writes up to 7 bytes past the end of the caller\u0027s buffer or Vec, producing attacker-controllable heap corruption when the plaintext length is attacker-influenced. This issue is fixed in version 0.10.80.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.aarch64",
          "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.s390x",
          "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-45784",
          "url": "https://www.suse.com/security/cve/CVE-2026-45784"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1270946 for CVE-2026-45784",
          "url": "https://bugzilla.suse.com/1270946"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.aarch64",
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.s390x",
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.aarch64",
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.s390x",
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-30T17:58:26Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-45784"
    },
    {
      "cve": "CVE-2026-66746",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-66746"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Rouille 0.4.0 through 3.6.2 contains an HTTP response splitting vulnerability that allows remote attackers to inject arbitrary response headers by embedding carriage return (0x0D) or line feed (0x0A) bytes into attacker-controlled input. Attackers can exploit percent-decoded query parameters reflected into response headers or inject bare LF characters into Cookie header values that are interpolated directly into Set-Cookie response headers, enabling cache poisoning, session fixation, and security header override attacks such as bypassing CSP or CORS policies.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.aarch64",
          "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.s390x",
          "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-66746",
          "url": "https://www.suse.com/security/cve/CVE-2026-66746"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1273878 for CVE-2026-66746",
          "url": "https://bugzilla.suse.com/1273878"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.aarch64",
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.s390x",
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.aarch64",
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.s390x",
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-30T17:58:26Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-66746"
    },
    {
      "cve": "CVE-2026-66754",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-66754"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Rouille 0.1.6 through 3.6.2 contains a reachable assertion vulnerability in the Request::remove_prefix function that allows remote unauthenticated attackers to crash the server by sending a crafted percent-encoded URL. Attackers can send a request whose decoded path matches a configured prefix while the raw percent-encoded path does not, causing the assert! to fail and triggering either a 500 error or full process termination depending on the panic configuration.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.aarch64",
          "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.s390x",
          "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-66754",
          "url": "https://www.suse.com/security/cve/CVE-2026-66754"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1273883 for CVE-2026-66754",
          "url": "https://bugzilla.suse.com/1273883"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.aarch64",
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.s390x",
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.aarch64",
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.s390x",
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-30T17:58:26Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-66754"
    },
    {
      "cve": "CVE-2026-67181",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-67181"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Rouille 0.3.3 through 3.6.2 contains an HTTP request smuggling vulnerability that allows remote attackers to desynchronize HTTP message boundaries by exploiting improper header forwarding in the proxy implementation. The proxy in src/proxy.rs forwards the client\u0027s Transfer-Encoding header to upstream backends unchanged while transmitting a body already de-chunked by tiny_http, enabling CL.TE desynchronization attacks where attackers control where the backend believes the request body ends.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.aarch64",
          "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.s390x",
          "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-67181",
          "url": "https://www.suse.com/security/cve/CVE-2026-67181"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1273885 for CVE-2026-67181",
          "url": "https://bugzilla.suse.com/1273885"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.aarch64",
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.s390x",
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.aarch64",
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.s390x",
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-30T17:58:26Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-67181"
    },
    {
      "cve": "CVE-2026-67182",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-67182"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Rouille 0.3.3 through 3.6.2 contains an HTTP request smuggling vulnerability that allows remote attackers to bypass access controls by injecting bare line feed characters (0x0A) into client-supplied request header values that are copied verbatim to upstream connections without validation. Attackers can craft a header value containing a complete additional HTTP request that is interpreted as a separate request by backends such as Go net/http and Python http.server, causing the backend to process a smuggled request with attacker-chosen method, path, and headers that bypasses the rouille handler\u0027s access control logic.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.aarch64",
          "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.s390x",
          "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-67182",
          "url": "https://www.suse.com/security/cve/CVE-2026-67182"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1273887 for CVE-2026-67182",
          "url": "https://bugzilla.suse.com/1273887"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.aarch64",
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.s390x",
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.aarch64",
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.s390x",
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-30T17:58:26Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-67182"
    },
    {
      "cve": "CVE-2026-93599",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-93599"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "rustls-webpki through 0.103.12 (and 0.104.0-alpha releases before 0.104.0-alpha.7) contains a reachable panic in bit_string_flags() in src/der.rs. The input guard fails to reject a named-bit BIT STRING whose content is exactly [0x00] (zero padding bits and no data bytes), so raw_bits.len() - 1 underflows on the empty slice and the subsequent index operation panics (subtract-with-overflow in debug, index-out-of-bounds in release). The condition is reachable through the public API BorrowedCertRevocationList::from_der() when a CRL contains an issuingDistributionPoint extension with such an onlySomeReasons value. Exploitation requires an application that explicitly opts in to CRL revocation checking by passing RevocationOptions to verify_for_usage() and that parses CRL bytes obtained from a source the attacker can influence; the default rustls configuration, which does not use RevocationOptions, is unaffected. A crafted CRL causes a denial of service via the panic. Fixed in 0.103.13 and 0.104.0-alpha.7.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.aarch64",
          "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.s390x",
          "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-93599",
          "url": "https://www.suse.com/security/cve/CVE-2026-93599"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1282202 for CVE-2026-93599",
          "url": "https://bugzilla.suse.com/1282202"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.aarch64",
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.s390x",
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.aarch64",
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.s390x",
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-30T17:58:26Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-93599"
    },
    {
      "cve": "CVE-2026-93600",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-93600"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "rustls-webpki (rustls/webpki) versions 0.101.0 through 0.103.11 and 0.104.0-alpha releases before 0.104.0-alpha.6 ignore X.509 name constraints that apply to URI names, causing such constraints to be accepted rather than enforced. Because name constraints are restrictions on otherwise properly issued certificates, the flaw is only reachable after successful signature verification and requires a misissued certificate to exploit; the library also provides no API for asserting URI names, and URI name constraints are otherwise unimplemented. Versions 0.103.12 and 0.104.0-alpha.6 reject URI name constraints unconditionally.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.aarch64",
          "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.s390x",
          "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-93600",
          "url": "https://www.suse.com/security/cve/CVE-2026-93600"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1282202 for CVE-2026-93600",
          "url": "https://bugzilla.suse.com/1282202"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.aarch64",
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.s390x",
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 2.2,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.aarch64",
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.s390x",
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-30T17:58:26Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-93600"
    },
    {
      "cve": "CVE-2026-93601",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-93601"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "rustls-webpki (the Rust webpki fork used by rustls) versions \u003e= 0.101.0 and prior to 0.103.12 and 0.104.0-alpha.6 incorrectly accepted permitted-subtree DNS name constraints for certificates asserting a wildcard name. For example, a name constraint of accept.example.com was treated as satisfied by a certificate for *.example.com, which could feasibly assert reject.example.com - a name outside the permitted subtree. Because name constraints are restrictions applied to otherwise properly issued certificates, the issue is only reachable after signature verification succeeds and requires a misissued wildcard certificate to exploit.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.aarch64",
          "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.s390x",
          "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-93601",
          "url": "https://www.suse.com/security/cve/CVE-2026-93601"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1282202 for CVE-2026-93601",
          "url": "https://bugzilla.suse.com/1282202"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.aarch64",
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.s390x",
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.aarch64",
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.s390x",
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-30T17:58:26Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-93601"
    },
    {
      "cve": "CVE-2026-93602",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-93602"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "rustls-webpki versions before 0.103.10 and 0.104.0-alpha.5 contain faulty CRL authority-matching logic that compares only the first distributionPoint against each CRL\u0027s IssuingDistributionPoint, ignoring additional distributionPoints. Attackers with a compromised trusted issuing authority can present revoked certificates that pass revocation checks under UnknownStatusPolicy::Allow, or cause incorrect errors under the default deny policy.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.aarch64",
          "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.s390x",
          "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-93602",
          "url": "https://www.suse.com/security/cve/CVE-2026-93602"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1282202 for CVE-2026-93602",
          "url": "https://bugzilla.suse.com/1282202"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.aarch64",
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.s390x",
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.aarch64",
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.s390x",
            "openSUSE Leap 16.0:sccache-0:0.18.0~2-160000.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-30T17:58:26Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-93602"
    }
  ]
}