SUSE-SU-2026:23983-1: sccache&distro=SUSE Linux Enterprise Server 16.0 SUSE Linux Enterprise

Vulnerability summary

SUSE-SU-2026:23983-1 is a vulnerability in sccache&distro=SUSE Linux Enterprise Server 16.0 SUSE Linux Enterprise with no CVSS score yet.

Timeline

1. 30-09-2026
   PublishedVulnerability first disclosed.
2. 06-10-2026
   Last modifiedVulnerability information updated.

Description

Security update for sccache This update for sccache fixes the following issues: - CVE-2024-12224: idna: idna accepts Punycode labels that do not produce any non-ASCII when decoded (bsc#1243868). - CVE-2026-25541: bytes: integer overflow in 'BytesMut:reserve' can lead to undefined behavior and crashes (bsc#1274146). - CVE-2026-25727: time: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion (bsc#1257923). - CVE-2026-41676: openssl: `Deriver:derive` and `PkeyCtxRef:derive` can overflow short buffers on OpenSSL 1.1.1 (bsc#1270206). - CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length in rust- openssl crate (bsc#1270559). - CVE-2026-41678: openssl: incorrect bounds assertion in aes key wrap in rust-openssl crate (bsc#1270693). - CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check in rust-openssl crate (bsc#1270736). - CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent memory in rust-openssl crate (bsc#1270869). - CVE-2026-42327: openssl: arbitrary code execution via specially crafted certificate in rust-openssl crate (bsc#1270512). - CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding in rust-openssl crate (bsc#1270938). - CVE-2026-45784: openssl: out-of-bounds write in `CipherCtxRef::cipher_update_inplace` for AES-KW-PAD ciphers in rust- openssl crate (bsc#1270948). - CVE-2026-66746: rouille: HTTP Response Splitting via Unvalidated Response Header Values (bsc#1273881). - CVE-2026-66754: rouille: remove_prefix function that allows remote unauthenticated attackers to crash the server by sending a crafted percent-encoded URL (bsc#1273884). - CVE-2026-67181: rouille: HTTP Request Smuggling via Transfer-Encoding Desynchronization (bsc#1273886). - CVE-2026-67182: rouille: HTTP Request Smuggling Enables Front-End Access Control Bypass (bsc#1273888). - CVE-2026-93599: rustls-webpki: panic via empty BIT STRING (bsc#1282211). - CVE-2026-93600: rustls-webpki: name constraints URI validation bypass (bsc#1282211). - CVE-2026-93601: rustls-webpki: name constraint bypass (bsc#1282211). - CVE-2026-93602: rustls-webpki: CRL revocation check bypass (bsc#1282211). Changes for sccache: Update to version 0.18.0~2: * Add experimental concurrent cache support * chore: Remove dependency status badge (#2856) * Don't hand the jobserver to children that can't use it * dist: refuse to trim rlibs from crates that also emit a cdylib * fix(cache): avoid duplicate multilevel reads * Strip basedirs from the compiler arguments too * tests/integration: replace MinIO with Silo * ci: dump sccache logs on integration failures * multilevel: a chain with any writable level is writable * Fix parsing of #line directives * Release 0.18.0 * daemonize: use an allow-list approach to inherited FDs * gcc, clang: make the assembler part of the cache key * support cl.exe /openmp:llvm * support all current /fsanitize*, /fsanitize-coverage*, and /fno-sanitize* args * support MSVC /feature argument * msvc: support lots of flags (#2832) * Update shlex dependency to version 2 (#2836) * gcc: mark flags as TooHard if need to cache something else (#2833) * clang: support more CLI options (#2834) * msvc: support arm64EC and fastfail flags (#2830) * chore: fix typo in comment (#2829) * nvcc: accept the --diag-error/--diag-suppress/--diag-warn family (#2816) * cache: allow skipping capability checks (#2822) * Bump opendal to 0.58.1 and fix fallout (fixes local GCS cache usage) (#2715) * nvcc (Windows): protect escaped quotes in dryrun lines before flattening backslashes (#2811) * Add an agent (#2812) * Add support for d20bforceinline. (#2807) * feat: add Microsoft Entra ID (passwordless) auth for the Azure Blob backend (#2802) * Bump MSRV to 1.91.0 (#2793) * Fix `nvcc` dryrun parsing for CUDA 13.3 (#2722) * test: Fixed hardcoded binary path in test * Release 0.17.0 * tests: pin libc in the dist test crate * doc: clarify server-side outputs and drop 'recommended mode' claim * doc: document SCCACHE_CLIENT_SIDE env var * doc: document client-side and direct modes in Architecture.md * Fix description of Unix socket-based Redis connection * server: remove redundant async block in start_compile_task * server: simplify bind() request loops with ? instead of manual match arms * Add support for arg files in Rust (#2782) * feat: support S3 SSE-KMS with AWS-managed and customer-managed keys (#2770) * abort compile tasks and associated subprocesses when a client disconnects * treat -ivfsoverlay as a preprocessor-only argument * gcc: refine response-file tokenizer visibility and whitespace handling * integration: convert cmake 4.x modules XFAIL test to a passing test * gcc/clang: cache and distribute builds using quoted @response files * fix: Fix ToolchainPackager cfg gate to build on ppc64le/s390x * fix: make gcc diagnostics color output work the same as for rustc * implement client-side mode * split handle_compile_response so that the compilation result can be handled separately * implement IpcStorage -- Storage backend over IPC * extend wire protocol with storage RPCs * implement AddAssign for ServerStats and related types * add Storage::get_path for direct file access * implement get_raw/put_raw on MultiLevelStorage * add client_side_mode config flag (SCCACHE_CLIENT_SIDE) * Extract new_client_runtime() helper to DRY up client runtime creation * Clarify single-threaded runtime rationale comment (grammar) * fix: use single-threaded tokio runtime in sccache dist-client * fix: use single-threaded tokio runtime in sccache client * fix: handle disabled cache backend features in multilevel chain * Fix ldd output parsing: remove .exists() check that failed on systems where the symlink source path does not exist locally (e.g. aarch64) * Fix cfg guard for PanicToolchainPackager to also cover non-x86_64 Linux architectures (e.g. aarch64) * Release 0.16.0 * fix: strip SCCACHE_BASEDIRS from escaped-backslash paths on Windows (#2736) * Ignore empty-set environment values (#2639) * feat: all backends support making them as read-only (#2705) * Enable RE on Linux-aarch64 (#2668) * Slightly improve logging (#2734) * chore: encode jwt key and cert digest with base64 in logs (#2712) * chore: make clippy happy (#2727) * feat: avoid sccache wrapper when resolving compiler (#2720) * Fall back to direct cache write if tempfile creation on the same fs fails (#2369) * remove too noisy bench * feat(nvcc): support argument: `--dependency-output` (#2708) * fix: add newline when printing dist-status to stdout * Revert "Classify .s files as AssemblerToPreprocess so #include/#ifdef are hon..." * Don't wait depfiles for gcc/clang preprocessed inputs * Classify .s files as AssemblerToPreprocess so #include/#ifdef are honored * prepare release 0.15.0 * Add cargo-binstall metadata for prebuilt binary installation * Fix coverage * fix: handle directories in dep-info source file hashing * docs(Rust.md): Add caveats from README * Add retry for dists docker image build * ci: set crt-static for riscv64 musl targets * feat: Add loongarch64 support * feat: Implement multi-tier caching with fallback and backfilling (#2581) * msvc: add support for Y-, YI, Zf flags * Group tests logging in CI * Add failing test for cmake-modules + cmake 4 version * Unfold ninja output in the test * Add a comment for maintaining integration tests * Move cmake-modules to integration tests * fix: exclude CARGO_ENCODED_RUSTFLAGS from env var hash (#2651) * chore(deps): update rust crate quinn-proto to v0.11.14 * Fix sync GCS initialization * clippy: fix from_iter_instead_of_collect lint * fix: add Win32_Security feature to windows-sys dependency * build(deps): bump actions/download-artifact from 5 to 8 * msvc: Append the default .pdb extension for the /Fd argument (#2621) * build(deps): bump actions/upload-artifact from 4 to 7 * clippy: fix ref_option lint * ci: install grcov from prebuilt binary instead of cargo install * ci: use default toolchain to install grcov * ci: fix artifact_failure action when target dir does not exist * Remove benchmark normalize_win_path_utf8 (#2634) * Revert "actions: add security audit workflow (#2594)" (#2603) * partial c++20 module support (#2516) * clippy: fix ptr_as_ptr lint (#2611) * Add support for `d1nodatetime` & `await:strict` MSVC flags (#2617) * chore: switch thirtyfour_sync to thirtyfour (#2613) * clippy: fix manual_string_new lint (#2609) * clippy: fix unnecessary_semicolon lint (#2615) * clippy: fix explicit_into_iter_loop lint (#2616) * Avoid double-caching when ccache is installed in PATH (#2524) * clippy: fix cloned_instead_of_copied lint (#2605) * clippy: fix semicolon_if_nothing_returned lint (#2601) * Move PreprocessorCacheModeConfig to src/config.rs (#2604) * clippy: fix cloned_ref_to_slice_refs lint (#2602) * prepare the new release (#2600) * chore: update to toml 0.9 (#2599) * ci: Add coverage to integration tests, report it to Codecov.io (#2598) * Preparation for multilevel caching (#2597) * Add sccache-dist to flake.nix (#2579) * fixup! cargo fmt * fixup! rustfmt update * Extract FileObjectSource, CacheRead and CacheWrite to cache_io.rs * chore: update to nix 0.30 * Add a helper method to get a correct backend name * Add cos feature gate to RemoteStorage * Simplify profiles for integration tests * clippy: fix implicit_clone lint (#2584) * actions: add security audit workflow (#2594) * docs: fix examples showing an xz-compress toolchain archive (#2587) * add benches for normalize_win_path strip_basedirs (#2588) * snap: update to core24 (#2570) * Add .rustfmt.toml for consistent style between `rustfmt` and `cargo fmt` (#2582) * add comments about auth token requirements (#2583) * chore: update to tokio-serde 0.9 (#2585) * ci: update freebsd to 15.0 (#2586) * distributed compilation support for asm & preprocessor outputs (#2557) * remove unused declaration (#2577) * Extract LazyDiskCache to a separated file (#2573) * Revert "ci: show diff for toml_format" (#2578) * Open Add SCCACHE_BASEDIRS support * ci: show diff for toml_format * chore: update to syslog 7 * refactor: use matrix to reduce deduplication * fix: remove outdated `analysis` mode * Unbreak the s390x CI * ci: add macos-15-intel for prebuilt binary (#2555) * Integration tests (#2564) * Fix code review. * Impl for COS. * build(deps): bump opendal from 0.54.0 to 0.55.0 * Move integration tests related stuff to subdir * Add Objective C Header for consistency * github action: fix the syntax - fails in the ci * sccache: prepare a new release * msvc: add msbuild support test * msvc: fix detect_showincludes_prefix with MSBuild * chore: update to gzp 2 * build(deps): bump rsa from 0.9.6 to 0.9.10 * codspeed: evaluate the memory benchmarking * remove too quick benchmarks * codspeed: move to simulation mode * Add realistic LRU cache access pattern benchmarks * Add compression characteristics benchmarks * Add build workflow simulation benchmarks * Add hash computation scenario benchmarks * Add batch cache entry benchmarks * Add cache artifact serialization benchmarks * Add /etc/ld.so.conf.d (if present) to compiler package * Assembly language support * fix(ci): pin serde_json to avoid zmij dependency * fix(ci): update zmij to fix s390x cross-compilation * Fix the run of the CI * run the benchmark in the ci * add benchmarks * dedup some code * Fix hash logging prefix * Add support for C preprocessor output * Add GCC pipe flag support * Improve save-temps gcc flags detection * MSVC: support forward slash as an output dir marker * add clang -fplugin=x regression test * canbeconcatenated is not accounted for in cmp * Reversed the order for looking `rustc`, added comment * Fix failing test_rlib_dep_reader_call for omit CARGO_HOME * fix: don't hash -parallel-jobs in Clang * docs: add installation steps for nix (#2523) * Support clang -fexperimental-assignment-tracking option (#2517) * add a nix flake (#2518) * Switch from the unmaintained daemonize crate to a maintained fork * chore: update to fs-err 3 * Fix grammar of error message * Add server name info to stderr of remote jobs that ran, but failed * Remove another pointless destructuring * try to unbreak the ci * fix s390x build error * Add riscv64 support * fix: make aarch64-pc-windows-msvc also zip not tar.gz * Free up disk space in CI * MSVC on Windows only * Avoid 'No space left on device' errors in CI * GitHub dropped macos-13 runners * Proper function pointer to int cast * Avoid unused structs with dist-server disabled * no check cfg (#2507) * chore: switch once_cell crate to standard library (#2499) * Avoid unreliable assert_cmd::cargo::cargo_bin (#2489) * Fix build on macOS which doesn't have separate 32-bit dirent (#2492) * Fix Clippy warnings (#2490) * docs: bump MSRV to 1.85.0 * msvc: handle '/FoRelease\' command-line argument * chore: drop tower dependency * chore: update to itertools 0.14 * Use generator in CMAKE_MSVC_DEBUG_INFORMATION_FORMAT in README * Update directories to 6.0 * Configuration.md - note logging env variables * chore: update to env_logger 0.11 * deps: update blake3 * prepare version 0.12.0 * Update README with winget installation instructions * Skip CARGO_BUILD_JOBS in hash keys * build(deps): bump object from 0.36.7 to 0.37.1 * Adjust tests after the rust update * Fix CI by adding cargo-features and updating coverage test to use modern -Cinstrument-coverage * Fix more clippy warnings * bump rustc in the ci too * Fix rustc 1.85 clippy warnings * bump to rustc 1.85 / edition 2024. mandatory for reqsign-core and run rustfmt with the version * fix clippy warnings * bump opendal to 0.54.0 & reqsign to 0.18.0 * github action: when creating a release, make it as draft before (#2458) * prepare version 0.11.0 (#2457) * document SCCACHE_LOG_MILLIS (#2456) * logging: add a option to log milliseconds (Closes: #2454) (#2455) * feat: handle human size prefixes (#2405) * fix: in stats, Compare values AND keys to have a fully deterministic order (#2403) * Add --diagnostic-width to test for args ignored in hash * Ignore --diagnostic-width argument when computing hash * build(deps): bump actions/checkout from 4 to 5 * build(deps): bump actions/download-artifact from 4 to 5 * build(deps): bump actions/github-script from 7 to 8 * Fix rustfmt * Fix comments on request * Fix clippy and rustfmt * Add test for count toolchain and use Determenistic for create tar archive * Fix mtime for reproducable toolchains * build(deps): bump chrono from 0.4.41 to 0.4.42 * fix typo in an environment variable name * Fix documentation of azure configuration * Account for clippy-driver having extra prefix `rustc` * Fix build on Android (in Termux) * add support for s390x build * chore: replace retry crate with backon * Remove or replace "Windows 2019" CI config * Needs another result unwrapping, it seems * Test: invoking symlink "compiler" to "sccache" invokes "compiler" * Add a comment about the problem with symlinks and current_exe() * Fix symbolic links to sccache on linux * Allow the CI configuration to disable clang++ for CUDA testing * Don't run tests using clang++ as CUDA compiler on Windows * add description to sccache-dist commands * Display a more user-friendly error when compiling on Linux/arm64 * Clarify documentation about "the hash" (aka cache key) * Remove stray ')' * Remove documentation for removed limitations of preprocessor cache mode * Fix preprocessor cache mode when the compiler outputs a dep file * Partially revert "Don't cache dep file (#2322)" * Do not disable preprocessor cache mode if there is a dep file * Fix preprocessor cache mode with distributed builds (#2173) * Change self of generate_hash_key() from Box<Self> to &mut Self * Remove a few IMO pointless indirections / aliases * Remove workaround for #2173 * Add test for bug #2173 * chore: fix some minor issues in comments * build(deps): bump chrono from 0.4.40 to 0.4.41 * build(deps): bump memchr from 2.7.1 to 2.7.5 * check if we can use a specific version of rust to build grcov * Move comment that hadn't moved with its corresponding code * Rework direct mode documentation some more * Explain what preprocessor cache mode really does * Reword and correct the preprocessor cache mode documentation * chore: Remove not working mozilla code * Add support for -fsanitize-ignorelist * github storage: adjust the doc * github storage: ACTIONS_CACHE_URL => ACTIONS_RESULTS_URL * github storage: force version 2 * Update codecov badge in README.md * Expand tests for dist-server * ci: Consolidate testing, coverage * ci: Update ubuntu-20.04 runners to ubuntu-22.04 * chore: fix some comments * Give the --dist-status user some information about when a retry will happen. * Add support for Xclang flag '-mrelax-all' * Add support for Xclang flag '-mconstructor-aliases' * feat(utils): Add support for object >= 0.33 * fix(tests): Remove executable bit from oauth.rs * build(deps): bump openssl from 0.10.64 to 0.10.72 * build(deps): bump tokio from 1.41.0 to 1.43.1 * Improve the CARGO_INCREMENTAL checking (#2364) * build(deps): bump chrono from 0.4.38 to 0.4.40 * build(deps): bump clap from 4.4.18 to 4.5.13 * build(deps): bump ring from 0.17.7 to 0.17.13 * Bail on `nvcc -time` and `nvcc -fdevice-time-trace` flags * test hip with librandomize_readdir * Add randomize_readdir test utility * fix non-strict HIP device lib order * Create config during testing to collect coverage data * Extend coverage to distributed tests * chore: replace num_cpus crate with available_parallelism in standard library (#2342) * Update CI coverage: grcov/codecov

No weakness data has been published for this record.