RUSTSEC-2026-0400

See a problem?
Please try reporting it to the source first.

Source

https://rustsec.org/advisories/RUSTSEC-2026-0400

Import Source

https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0400.json

JSON Data

https://api.osv.dev/v1/vulns/RUSTSEC-2026-0400

Published

2026-10-16T12:00:00Z

Modified

2026-10-26T14:00:05Z

Summary

Use-after-free of a dictionary after a one-shot call on a context with an open stream

Details

The one-shot DCtx and CCtx methods assumed the C library resets the context, but it leaves an open stream as it is. When a stream was left unfinished on a context, a one-shot call such as decompress_using_dict could leave the context pointing at the dictionary borrowed for that call, and the next streaming call resumed the stream against it after it was freed: decompressed output then contained freed heap memory. On the compression side, the stream resumed against the one-shot call's buffers.

This requires an application to use one context for both streaming and one-shot calls without a reset in between. The flaw was corrected by resetting the session after one-shot calls whenever a stream may be open.

Database specific

{
    "license":  "CC0-1.0"
}

References

Affected packages

crates.io / zstd-safe

Package

Name: zstd-safe; View open source insights on deps.dev
Purl: pkg:cargo/zstd-safe

Affected ranges

Type: SEMVER
Events: Introduced

3.0.1

Fixed

8.2.0

Ecosystem specific

{
    "affected_functions":  null,
    "affects":  {
        "arch":  [],
        "functions":  [
            "zstd_safe::DCtx::decompress",
            "zstd_safe::DCtx::decompress_using_ddict",
            "zstd_safe::DCtx::decompress_using_dict"
        ],
        "os":  []
    }
}