RUSTSEC-2026-0404

See a problem?
Please try reporting it to the source first.

Source

https://rustsec.org/advisories/RUSTSEC-2026-0404

Import Source

https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0404.json

JSON Data

https://api.osv.dev/v1/vulns/RUSTSEC-2026-0404

Published

2026-10-16T12:00:00Z

Modified

2026-10-26T14:00:05Z

Summary

Double free in `DCtx::try_clone`

Details

DCtx::try_clone (experimental feature, deprecated) is a plain copy of the C context. A context owning a dictionary (from load_dictionary, ref_prefix or init_using_dict) or a dictionary table (ref_ddict with RefMultipleDDicts) ended up with both copies freeing it. A context cloned mid-frame resumed on uninitialized stream state. The clone also silently lost the WindowLogMax limit.

The flaw was corrected by refusing to clone such contexts, and by carrying over the parameters the copy leaves out.

Database specific

{
    "license":  "CC0-1.0"
}

References

Affected packages

crates.io / zstd-safe

Package

Name: zstd-safe; View open source insights on deps.dev
Purl: pkg:cargo/zstd-safe

Affected ranges

Type: SEMVER
Events: Introduced

4.1.4

Fixed

8.2.0

Ecosystem specific

{
    "affected_functions":  null,
    "affects":  {
        "arch":  [],
        "functions":  [
            "zstd_safe::DCtx::try_clone"
        ],
        "os":  []
    }
}