RUSTSEC-2026-0399

See a problem?
Please try reporting it to the source first.

Source

https://rustsec.org/advisories/RUSTSEC-2026-0399

Import Source

https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0399.json

JSON Data

https://api.osv.dev/v1/vulns/RUSTSEC-2026-0399

Published

2026-10-16T12:00:00Z

Modified

2026-10-26T14:00:05Z

Summary

Use-after-free through `init_using_cdict` and `init_using_ddict`

Details

CCtx::init_using_cdict and DCtx::init_using_ddict (experimental feature, deprecated) took the dictionary as &CDict<'b> and &DDict<'b> with only 'b: 'a, so the dictionary itself could be dropped while the context still pointed at it. The same mistake in other constructors was fixed earlier (https://github.com/gyscos/zstd-rs/issues/365).

The flaw was corrected by taking &'a CDict<'b> and &'a DDict<'b>.

Database specific

{
    "license":  "CC0-1.0"
}

References

Affected packages

crates.io / zstd-safe

Package

Name: zstd-safe; View open source insights on deps.dev
Purl: pkg:cargo/zstd-safe

Affected ranges

Type: SEMVER
Events: Introduced

3.0.0

Fixed

8.2.0

Ecosystem specific

{
    "affected_functions":  null,
    "affects":  {
        "arch":  [],
        "functions":  [
            "zstd_safe::CCtx::init_using_cdict",
            "zstd_safe::DCtx::init_using_ddict"
        ],
        "os":  []
    }
}