Skip to content
Fencer Intel
medium 6.5

CVE-2025-4574 json

Crossbeam-channel: crossbeam-channel vulnerable to double free on drop

published last yr. modified 4d ago also EUVD-2025-14635 , GHSA-pg9f-39pc-qf8g , RUSTSEC-2025-0024

cvss
6.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.6%
EPSS 0.6% chance of exploitation in 30 days, percentile 47%
public exploits
0
none known

Summary

In crossbeam-channel rust crate, the internal `Channel` type's `Drop` method has a race condition which could, in some circumstances, lead to a double-free that could result in memory corruption.

Patch / fix

  • crates.io crossbeam-channel 0.5.15
  • crossbeam-rs crossbeam-channel 0.5.15
  • rust-crossbeam-channel Debian 14, Debian 13 0.5.15-1

debian advisories DEBIAN-CVE-2025-4574

  • gstreamer-devtools SLES for SAP applications 16.0, SLES 16.0 1.26.7-160000.2.1
  • cargo-c SLES for SAP applications 16.0, SLES 16.0 0.10.15-160000.1.1
  • python-maturin openSUSE Leap 15.6 1.4.0-150600.3.6.1

suse advisories SUSE-SU-2026:23572-1SUSE-SU-2026:20096-1SUSE-SU-2025:01591-1

  • zed openSUSE Tumbleweed 1.24.2-1.1
  • python-ruff openSUSE Tumbleweed 0.16.10-1.1
  • gstreamer-devtools openSUSE Leap 16.0 1.26.7-160000.2.1
  • cargo-c openSUSE Leap 16.0 0.10.15-160000.1.1
  • cargo-audit openSUSE Tumbleweed 0.21.2~git0.18e58c2-2.1
  • cargo-c openSUSE Tumbleweed 0.10.3~git0.ee7d7ef-4.1

opensuse advisories openSUSE-SU-2026:12355-1openSUSE-SU-2026:12042-1openSUSE-SU-2026:21689-1openSUSE-SU-2026:20060-1openSUSE-SU-2025:15550-1openSUSE-SU-2025:15551-1

  • rust Azure Linux 3.0 1.75.0-16
  • kata-containers-cc Azure Linux 3.0 3.15.0.aks0-15
  • rust Azure Linux 3.0 1.86.0-3
  • azl-compliance CBL-Mariner 2.0 1.0.2-2
  • kata-containers Azure Linux 3.0 3.18.0.kata0-1

azure linux advisories AZL-61830AZL-61839AZL-61845AZL-61848AZL-61855

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Is CVE-2025-4574 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-4574 updated cvss 6.5

crossbeam-channel: crossbeam-channel Vulnerable to Double Free on Drop

  • Red Hat Enterprise Linux 7 firefox Red Hat Enterprise Linux 8 firefox, thunderbird Red Hat Enterprise Linux 9 rust, cargo, clippy, firefox, rustfmt, rust-gdb, +21 more Red Hat Enterprise Linux 10 rust, firefox, 389-ds-base, thunderbird, rust-afterburn, trustee-guest-components Red Hat OpenShift AI (RHOAI) rhoai/odh-feast-operator-rhel8, rhoai/odh-feature-server-rhel8 Red Hat OpenShift Container Platform 4 conmon-rs, kata-containers
    +1 more products
    Red Hat Satellite 6 python-maturin, python3.12-maturin
    affected: workaround, no fix available “Fix deferred”
  • Red Hat Trusted Artifact Signer rhtas/tuffer-rhel9, rhtas/tuftool-rhel9 Red Hat Trusted Profile Analyzer rhtpa/rhtpa-trustification-service-rhel9
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Directory Server 11 389-ds-base Red Hat Directory Server 12 389-ds-base Red Hat Enterprise Linux 7 thunderbird Red Hat Enterprise Linux 8 rls, rust, cargo, clippy, rustfmt, rust-gdb, +16 more Red Hat Enterprise Linux 9 librsvg2, rpm-ostree, librsvg2-tools, rpm-ostree-libs Red Hat Enterprise Linux 10 gjs
    +1 more products
    Red Hat OpenShift Container Platform 4 afterburn, rpm-ostree, rust-afterburn, rpm-ostree-libs, afterburn-dracut, coreos-installer, +2 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
last yr.

Exploit prediction

0.56% chance of exploitation in the next 30 days, higher than 47% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
CNA 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Affected packages

ecosystem package affected fixed in
crates.io crossbeam-channel
>=0.5.12, <0.5.15
>=0.5.12-0, <0.5.15
0.5.15

Affected products

  • crossbeam-rs crossbeam-channel
  • Red Hat Red Hat Directory Server 11
  • Red Hat Red Hat Directory Server 12
  • Red Hat Red Hat Enterprise Linux 10
  • Red Hat Red Hat Enterprise Linux 7
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat OpenShift AI (RHOAI)
  • Red Hat Red Hat OpenShift Container Platform 4
  • Red Hat Red Hat Satellite 6
  • Red Hat Red Hat Trusted Artifact Signer
  • Red Hat Red Hat Trusted Profile Analyzer

Classification

Weakness

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.