RUSTSEC-2026-0405

See a problem?
Please try reporting it to the source first.

Source

https://rustsec.org/advisories/RUSTSEC-2026-0405

Import Source

https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0405.json

JSON Data

https://api.osv.dev/v1/vulns/RUSTSEC-2026-0405

Published

2026-10-16T12:00:00Z

Modified

2026-10-26T14:00:05Z

Summary

Out-of-bounds read with an out-of-range `InBuffer::pos`

Details

InBuffer's fields are public, so safe code can set pos past the end of src. The position was passed to the C library unchecked, and ZSTD_seekable_compressStream, unlike the other streaming functions, does not validate it: it read past the end of the input slice, by up to the frame size, and compressed that memory into the output.

The flaw was corrected by checking the position before every call into the C library.

Database specific

{
    "license":  "CC0-1.0"
}

References

Affected packages

crates.io / zstd-safe

Package

Name: zstd-safe; View open source insights on deps.dev
Purl: pkg:cargo/zstd-safe

Affected ranges

Type: SEMVER
Events: Introduced

7.2.2

Fixed

8.2.0

Ecosystem specific

{
    "affected_functions":  null,
    "affects":  {
        "arch":  [],
        "functions":  [
            "zstd_safe::seekable::SeekableCStream::compress_stream"
        ],
        "os":  []
    }
}