{"id":"RUSTSEC-2026-0344","revision":"c42f0c7d4e2b48b9876f7a7d88f922c8","records":[{"revision":"c42f0c7d4e2b48b9876f7a7d88f922c8","observedAt":"2026-10-24T13:19:54.901+00:00","statement":{"source":"osv","id":"RUSTSEC-2026-0344","aliases":[],"title":"Decompression bomb in `ruzstd`: a tiny input can exhaust memory (OOM)","description":"A crafted `.zst` input under 128 KB can force `ruzstd` to allocate several gigabytes at once, crashing the process with an out-of-memory condition. Since `ruzstd` is a decoder for untrusted input, a single small file is enough to take down anything decoding it.\n\nThe compressed size of a block was capped at 128 KB, but a compressed block's **decompressed** size was never checked against `Block_Maximum_Size = min(Window_Size, 128 KiB)` (RFC 8878). In `execute_sequences` the output was built with no running bound and no flush between blocks, so one block could expand to gigabytes — bypassing both the configured window-size limit and the block-by-block streaming that would otherwise release memory. (A related `u32` counter overflow on such a block caused an additional panic.)\n\nThis is a denial of service only; memory access stays in bounds (no corruption, no RCE).\n\n`ruzstd` is also built as a dependency of the Rust standard library via `rustc-dep-of-std`; in the toolchain it is used only to load zstd-compressed debug symbols, so the toolchain-side impact is limited.\n\n**Fixed in 0.9.1** (commit `d3907c9`), which enforces the per-block output bound. Upgrade to `ruzstd >= 0.9.1`.","state":0,"publishedAt":"2026-10-11T12:00:00+00:00","modifiedAt":"2026-10-13T10:45:04.0809933+00:00","affected":[{"ecosystem":"crates.io","name":"ruzstd","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.0.0-0"},{"kind":"fixed","version":"0.9.1"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":null,"severity":null}],"references":["https://crates.io/crates/ruzstd","https://rustsec.org/advisories/RUSTSEC-2026-0344.html","https://github.com/KillingSpark/zstd-rs/commit/d3907c960ca4a1aa44cc38340137c5679dd98f5a"],"sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2026-0344","license":"OSV · upstream source license applies","key":"osv:RUSTSEC-2026-0344","identifiers":["RUSTSEC-2026-0344"]},"retained":false,"historicalAffected":[]}],"coverage":[]}