{"id":"RUSTSEC-2026-0399","revision":"d8f13e3fbeb44223b9ef483a9847a04c","records":[{"revision":"d8f13e3fbeb44223b9ef483a9847a04c","observedAt":"2026-10-26T14:35:44.727+00:00","statement":{"source":"osv","id":"RUSTSEC-2026-0399","aliases":[],"title":"Use-after-free through `init_using_cdict` and `init_using_ddict`","description":"`CCtx::init_using_cdict` and `DCtx::init_using_ddict` (`experimental`\nfeature, deprecated) took the dictionary as `&CDict<'b>` and `&DDict<'b>`\nwith only `'b: 'a`, so the dictionary itself could be dropped while the\ncontext still pointed at it. The same mistake in other constructors was\nfixed earlier (<https://github.com/gyscos/zstd-rs/issues/365>).\n\nThe flaw was corrected by taking `&'a CDict<'b>` and `&'a DDict<'b>`.","state":0,"publishedAt":"2026-10-16T12:00:00+00:00","modifiedAt":"2026-10-26T14:00:05.7924311+00:00","affected":[{"ecosystem":"crates.io","name":"zstd-safe","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"3.0.0"},{"kind":"fixed","version":"8.2.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://crates.io/crates/zstd-safe","https://rustsec.org/advisories/RUSTSEC-2026-0399.html","https://github.com/gyscos/zstd-rs/commit/e00e7928e3e98953fc43418af6d73f6aae2378fb","https://github.com/gyscos/zstd-rs/pull/384"],"sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2026-0399","license":"OSV · upstream source license applies","key":"osv:RUSTSEC-2026-0399","identifiers":["RUSTSEC-2026-0399"]},"retained":false,"historicalAffected":[]}],"coverage":[]}