{"id":"RUSTSEC-2026-0400","revision":"d64cb6d788cb4ff687e555d17ad0f480","records":[{"revision":"d64cb6d788cb4ff687e555d17ad0f480","observedAt":"2026-10-26T14:35:44.727+00:00","statement":{"source":"osv","id":"RUSTSEC-2026-0400","aliases":[],"title":"Use-after-free of a dictionary after a one-shot call on a context with an open stream","description":"The one-shot `DCtx` and `CCtx` methods assumed the C library resets the\ncontext, but it leaves an open stream as it is. When a stream was left\nunfinished on a context, a one-shot call such as `decompress_using_dict`\ncould leave the context pointing at the dictionary borrowed for that call,\nand the next streaming call resumed the stream against it after it was\nfreed: decompressed output then contained freed heap memory. On the\ncompression side, the stream resumed against the one-shot call's buffers.\n\nThis requires an application to use one context for both streaming and\none-shot calls without a reset in between. The flaw was corrected by\nresetting the session after one-shot calls whenever a stream may be open.","state":0,"publishedAt":"2026-10-16T12:00:00+00:00","modifiedAt":"2026-10-26T14:00:05.6920776+00:00","affected":[{"ecosystem":"crates.io","name":"zstd-safe","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"3.0.1"},{"kind":"fixed","version":"8.2.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://crates.io/crates/zstd-safe","https://rustsec.org/advisories/RUSTSEC-2026-0400.html","https://github.com/gyscos/zstd-rs/commit/d34502a0ed07f80ab2aa4c65059578e0466f2467","https://github.com/gyscos/zstd-rs/pull/384"],"sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2026-0400","license":"OSV · upstream source license applies","key":"osv:RUSTSEC-2026-0400","identifiers":["RUSTSEC-2026-0400"]},"retained":false,"historicalAffected":[]}],"coverage":[]}