PkgSeer

Vulnerability RUSTSEC-2026-0399

Unknown

17 days ago

Use-after-free through `init_using_cdict` and `init_using_ddict`

3.0.0+zstd.1.4.8 - 7.3.0 and 8.0.0 - 8.1.0

Summary

Use-after-free through `init_using_cdict` and `init_using_ddict`

Details

CCtx::init_using_cdict and DCtx::init_using_ddict (experimental feature, deprecated) took the dictionary as &CDict<'b> and &DDict<'b> with only 'b: 'a, so the dictionary itself could be dropped while the context still pointed at it. The same mistake in other constructors was fixed earlier ( https://github.com/gyscos/zstd-rs/issues/365).

The flaw was corrected by taking &'a CDict<'b> and &'a DDict<'b>.

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

Use-after-free with `CParameter::StableInBuffer`

4.1.0+zstd.1.5.0 - 7.3.0 and 8.0.0 - 8.1.0 RUSTSEC-2026-0395

`Seekable` reads a NULL or out-of-bounds seek table

7.2.2 - 7.3.0 and 8.0.0 - 8.1.0 RUSTSEC-2026-0396

`OutBuffer::around_pos` exposes uninitialized memory

4.0.0+zstd.1.4.9 - 7.3.0 and 8.0.0 - 8.1.0 RUSTSEC-2026-0397

`Seekable::decompress` sets a `Vec` length beyond its capacity for offsets past the end

7.2.2 - 7.3.0 and 8.0.0 - 8.1.0 RUSTSEC-2026-0398

Use-after-free of a dictionary after a one-shot call on a context with an open stream

3.0.1+zstd.1.4.9 - 7.3.0 and 8.0.0 - 8.1.0 RUSTSEC-2026-0400

View all vulnerabilities for these packages

Impacted packages

zstd-safe

Timeline

Published

17 days ago

Fixed (8.2.0)

16 days ago

Fixed (7.4.0)

1 day ago

Last Modified

4 hours ago