RUSTSEC-2026-0397

See a problem?
Please try reporting it to the source first.

Source

https://rustsec.org/advisories/RUSTSEC-2026-0397

Import Source

https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0397.json

JSON Data

https://api.osv.dev/v1/vulns/RUSTSEC-2026-0397

Published

2026-10-16T12:00:00Z

Modified

2026-10-26T14:00:05Z

Summary

`OutBuffer::around_pos` exposes uninitialized memory

Details

OutBuffer::around_pos accepted a position past the initialized length of a Vec<u8>. The next streaming call then marked everything before the position as initialized, so safe code could read stale heap memory between the vector's previous length and that position.

The flaw was corrected by zero-filling that gap.

Database specific

{
    "license":  "CC0-1.0"
}

References

Affected packages

crates.io / zstd-safe

Package

Name: zstd-safe; View open source insights on deps.dev
Purl: pkg:cargo/zstd-safe

Affected ranges

Type: SEMVER
Events: Introduced

4.0.0

Fixed

8.2.0

Ecosystem specific

{
    "affected_functions":  null,
    "affects":  {
        "arch":  [],
        "functions":  [
            "zstd_safe::OutBuffer::around_pos"
        ],
        "os":  []
    }
}