PkgSeer

Vulnerability RUSTSEC-2026-0404

Unknown

17 days ago

Double free in `DCtx::try_clone`

4.1.4+zstd.1.5.2 - 7.3.0 and 8.0.0 - 8.1.0

Summary

Double free in `DCtx::try_clone`

Details

DCtx::try_clone (experimental feature, deprecated) is a plain copy of the C context. A context owning a dictionary (from load_dictionary, ref_prefix or init_using_dict) or a dictionary table (ref_ddict with RefMultipleDDicts) ended up with both copies freeing it. A context cloned mid-frame resumed on uninitialized stream state. The clone also silently lost the WindowLogMax limit.

The flaw was corrected by refusing to clone such contexts, and by carrying over the parameters the copy leaves out.

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

Use-after-free with `CParameter::StableInBuffer`

4.1.0+zstd.1.5.0 - 7.3.0 and 8.0.0 - 8.1.0 RUSTSEC-2026-0395

`Seekable` reads a NULL or out-of-bounds seek table

7.2.2 - 7.3.0 and 8.0.0 - 8.1.0 RUSTSEC-2026-0396

`OutBuffer::around_pos` exposes uninitialized memory

4.0.0+zstd.1.4.9 - 7.3.0 and 8.0.0 - 8.1.0 RUSTSEC-2026-0397

`Seekable::decompress` sets a `Vec` length beyond its capacity for offsets past the end

7.2.2 - 7.3.0 and 8.0.0 - 8.1.0 RUSTSEC-2026-0398

Use-after-free through `init_using_cdict` and `init_using_ddict`

3.0.0+zstd.1.4.8 - 7.3.0 and 8.0.0 - 8.1.0 RUSTSEC-2026-0399

View all vulnerabilities for these packages

Impacted packages

zstd-safe

Timeline

Published

17 days ago

Fixed (8.2.0)

16 days ago

Fixed (7.4.0)

1 day ago

Last Modified

4 hours ago