CVE-2025-4574

MediumCVSS 6.5/10Last modified Nov 5, 2026

Description

In crossbeam-channel rust crate, the internal `Channel` type's `Drop` method has a race condition which could, in some circumstances, lead to a double-free that could result in memory corruption.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Weakness enumeration

Affected software

VendorProductVersions
——>= 0.5.12, < 0.5.15
Red HatRed Hat Directory Server 11—
Red HatRed Hat Directory Server 12—
Red HatRed Hat Enterprise Linux 10—
Red HatRed Hat Enterprise Linux 10—
Red HatRed Hat Enterprise Linux 10—
Red HatRed Hat Enterprise Linux 10—
Red HatRed Hat Enterprise Linux 10—
Red HatRed Hat Enterprise Linux 10—
Red HatRed Hat Enterprise Linux 10—
Red HatRed Hat Enterprise Linux 7—
Red HatRed Hat Enterprise Linux 7—
Red HatRed Hat Enterprise Linux 8—
Red HatRed Hat Enterprise Linux 8—
Red HatRed Hat Enterprise Linux 8—
Red HatRed Hat Enterprise Linux 8—
Red HatRed Hat Enterprise Linux 8—
Red HatRed Hat Enterprise Linux 8—
Red HatRed Hat Enterprise Linux 9—
Red HatRed Hat Enterprise Linux 9—
Red HatRed Hat Enterprise Linux 9—
Red HatRed Hat Enterprise Linux 9—
Red HatRed Hat Enterprise Linux 9—
Red HatRed Hat Enterprise Linux 9—
Red HatRed Hat Enterprise Linux 9—
Red HatRed Hat Enterprise Linux 9—
Red HatRed Hat Enterprise Linux 9—
Red HatRed Hat OpenShift AI (RHOAI)—
Red HatRed Hat OpenShift AI (RHOAI)—
Red HatRed Hat OpenShift Container Platform 4—
Red HatRed Hat OpenShift Container Platform 4—
Red HatRed Hat OpenShift Container Platform 4—
Red HatRed Hat OpenShift Container Platform 4—
Red HatRed Hat OpenShift Container Platform 4—
Red HatRed Hat Satellite 6—
Red HatRed Hat Satellite 6—
Red HatRed Hat Trusted Artifact Signer—
Red HatRed Hat Trusted Artifact Signer—
Red HatRed Hat Trusted Profile Analyzer—
Red HatRed Hat Trusted Profile Analyzer—

References

Timeline

Published
May 13, 2025
Last modified
Nov 5, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-457469.8In ZKT ZKBio CVSecurity 6.4.1_R an unauthenticated attacker can craft JWT token using the hardcoded secret to authenticate to the service coCVE-2025-45756.5Issue summary: Use of -addreject option with the openssl x509 application adds a trusted use instead of a rejected use for a certificate. ICVE-2025-457516.1SourceCodester Web Based Pharmacy Product Management System 1.0 is vulnerable to Cross Site Scripting (XSS) in add-admin.php via the FullnamCVE-2025-457527.2A vulnerability in SeedDMS 6.0.32 allows an attacker with admin privileges to execute arbitrary PHP code by exploiting the zip import functiCVE-2025-457537.2A vulnerability in Vtiger CRM Open Source Edition v8.3.0 allows an attacker with admin privileges to execute arbitrary PHP code by exploitinCVE-2025-457545.4A stored cross-site scripting (XSS) vulnerability exists in SeedDMS 6.0.32. This vulnerability allows an attacker to inject malicious JavaScCVE-2025-457556.1A Stored Cross-Site Scripting (XSS) vulnerability exists in Vtiger CRM Open Source Edition v8.3.0, exploitable via the Services Import featuCVE-2025-45766.1A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.133, and Liferay DXP 2025.Q1.0 through 2025.QCVE-2025-457643.2jsrsasign v11.1.0 was discovered to contain weak encryption. NOTE: this issue has been disputed by a third party who believes that CVE IDs cCVE-2025-457659.1ruby-jwt v3.0.0.beta1 was discovered to contain weak encryption. NOTE: the Supplier's perspective is "keysize is not something that is enforCVE-2025-457667.0poco v1.14.1-release was discovered to contain weak encryption. NOTE: this issue has been disputed on the basis that key lengths are expecteCVE-2025-457677.0jose v6.0.10 was discovered to contain weak encryption. NOTE: this is disputed by a third party because the claim of "do not meet recommende
CVE-2025-4574: Medium severity, CVSS 6.5 | Vulnix