RUSTSEC-2026-0402

See a problem?
Please try reporting it to the source first.

Source

https://rustsec.org/advisories/RUSTSEC-2026-0402

Import Source

https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0402.json

JSON Data

https://api.osv.dev/v1/vulns/RUSTSEC-2026-0402

Published

2026-10-16T12:00:00Z

Modified

2026-10-26T14:00:05Z

Summary

Heap buffer overflow in `CCtx::try_clone` on a multithreaded context

Details

CCtx::try_clone (experimental feature, deprecated) copies tables sized from the context's applied parameters. Starting a multithreaded frame (zstdmt feature) replaces those parameters with the workers' without resizing the context's own tables, so after an abandoned single-threaded frame, the copy wrote up to 512 KiB past a heap allocation, or read past one. This became reachable with the bundled zstd 1.5.6.

The flaw was corrected by refusing try_clone (and the unsafe compress_block) once NbWorkers was set on the context.

Database specific

{
    "license":  "CC0-1.0"
}

References

Affected packages

crates.io / zstd-safe

Package

Name: zstd-safe; View open source insights on deps.dev
Purl: pkg:cargo/zstd-safe

Affected ranges

Type: SEMVER
Events: Introduced

4.1.4

Fixed

8.2.0

Ecosystem specific

{
    "affected_functions":  null,
    "affects":  {
        "arch":  [],
        "functions":  [
            "zstd_safe::CCtx::try_clone"
        ],
        "os":  []
    }
}