{"id":"RUSTSEC-2026-0406","revision":"8a99ff98c0bc40b78538fc58eb59bdf5","records":[{"revision":"8a99ff98c0bc40b78538fc58eb59bdf5","observedAt":"2026-10-26T14:35:44.727+00:00","statement":{"source":"osv","id":"RUSTSEC-2026-0406","aliases":[],"title":"Use-after-free when changing a multithreaded context with an unfinished frame","description":"When a multithreaded frame (`zstdmt` feature, `CParameter::NbWorkers`) is\nleft unfinished, its jobs may still be running on the worker threads: the C\nlibrary only waits for them when the next frame starts, or when the context\nis freed. A session reset makes the context accept changes again in the\nmeantime, so:\n\n- unloading the dictionary (`load_dictionary`, `ref_cdict`, `ref_prefix`,\n  `disable_dictionary`, `init*`, or `reset` with parameters) freed the\n  dictionary a worker was still compressing against;\n- changing `NbWorkers` made the next frame resize the job table before\n  waiting for the old jobs.\n\nThe flaw was corrected by refusing these calls while a multithreaded frame\nis unfinished. The new `CCtx::wait_for_workers()` waits for the workers\nfirst.","state":0,"publishedAt":"2026-10-16T12:00:00+00:00","modifiedAt":"2026-10-26T14:00:05.0954271+00:00","affected":[{"ecosystem":"crates.io","name":"zstd-safe","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.0.0-0"},{"kind":"fixed","version":"8.2.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://crates.io/crates/zstd-safe","https://rustsec.org/advisories/RUSTSEC-2026-0406.html","https://github.com/gyscos/zstd-rs/commit/e224018a2389915d68ed17f30109bebad36e9734","https://github.com/gyscos/zstd-rs/pull/384"],"sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2026-0406","license":"OSV · upstream source license applies","key":"osv:RUSTSEC-2026-0406","identifiers":["RUSTSEC-2026-0406"]},"retained":false,"historicalAffected":[]}],"coverage":[]}