RUSTSEC-2026-0406

See a problem?
Please try reporting it to the source first.

Source

https://rustsec.org/advisories/RUSTSEC-2026-0406

Import Source

https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0406.json

JSON Data

https://api.osv.dev/v1/vulns/RUSTSEC-2026-0406

Published

2026-10-16T12:00:00Z

Modified

2026-10-26T14:00:05Z

Summary

Use-after-free when changing a multithreaded context with an unfinished frame

Details

When a multithreaded frame (zstdmt feature, CParameter::NbWorkers) is left unfinished, its jobs may still be running on the worker threads: the C library only waits for them when the next frame starts, or when the context is freed. A session reset makes the context accept changes again in the meantime, so:

unloading the dictionary (load_dictionary, ref_cdict, ref_prefix, disable_dictionary, init*, or reset with parameters) freed the dictionary a worker was still compressing against;
changing NbWorkers made the next frame resize the job table before waiting for the old jobs.

The flaw was corrected by refusing these calls while a multithreaded frame is unfinished. The new CCtx::wait_for_workers() waits for the workers first.

Database specific

{
    "license":  "CC0-1.0"
}

References

Affected packages

crates.io / zstd-safe

Package

Name: zstd-safe; View open source insights on deps.dev
Purl: pkg:cargo/zstd-safe

Affected ranges

Type: SEMVER
Events: Introduced

0.0.0-0

Fixed

8.2.0

Ecosystem specific

{
    "affected_functions":  null,
    "affects":  {
        "arch":  [],
        "functions":  [
            "zstd_safe::CCtx::disable_dictionary",
            "zstd_safe::CCtx::init",
            "zstd_safe::CCtx::load_dictionary",
            "zstd_safe::CCtx::ref_cdict",
            "zstd_safe::CCtx::ref_prefix",
            "zstd_safe::CCtx::reset",
            "zstd_safe::CCtx::set_parameter"
        ],
        "os":  []
    }
}