{"id":"RUSTSEC-2026-0398","revision":"a5593f59e5234de7a04c76a2684f824e","records":[{"revision":"a5593f59e5234de7a04c76a2684f824e","observedAt":"2026-10-26T14:35:44.727+00:00","statement":{"source":"osv","id":"RUSTSEC-2026-0398","aliases":[],"title":"`Seekable::decompress` sets a `Vec` length beyond its capacity for offsets past the end","description":"`ZSTD_seekable_decompress` shortens the requested length to the end of the\ndata without checking that the offset is before it. For an offset past the\nend, it returns a wrapped-around length without writing anything, and\n`Seekable::decompress` passed that length to `Vec::set_len`.\n\nWith the `seekable` feature, whoever supplies the archive, or chooses the\noffset, can leave the caller's `Vec<u8>` with a length far beyond its\ncapacity. Reading it then discloses neighbouring heap memory, and appending\nto it corrupts memory. Offsets near `u64::MAX` can also hang the call.\n\nThe flaw was corrected by clamping requests to the end of the data, and by\nchecking every count reported by the C library against the buffer capacity.","state":0,"publishedAt":"2026-10-16T12:00:00+00:00","modifiedAt":"2026-10-26T14:00:05.0920829+00:00","affected":[{"ecosystem":"crates.io","name":"zstd-safe","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"7.2.2"},{"kind":"fixed","version":"8.2.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://crates.io/crates/zstd-safe","https://rustsec.org/advisories/RUSTSEC-2026-0398.html","https://github.com/gyscos/zstd-rs/commit/80506be743fae2ed0c2fe8b21c374c6a2eab0be7","https://github.com/gyscos/zstd-rs/pull/384"],"sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2026-0398","license":"OSV · upstream source license applies","key":"osv:RUSTSEC-2026-0398","identifiers":["RUSTSEC-2026-0398"]},"retained":false,"historicalAffected":[]}],"coverage":[]}