{"id":"RUSTSEC-2026-0400","title":"Use-after-free of a dictionary after a one-shot call on a context with an open stream","summary":"Use-after-free of a dictionary after a one-shot call on a context with an open stream","severity":"none","vendor":"zstd-safe","product":"zstd-safe","ecosystem":"rust","affected":["zstd-safe >= 3.0.1, < 8.2.0"],"patched":["zstd-safe 8.2.0"],"published":"2026-10-16","updated":"2026-10-26","sourceUpdated":"2026-10-26T14:00:05.692077560Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2026-0400","references":[{"url":"https://crates.io/crates/zstd-safe"},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0400.html"},{"url":"https://github.com/gyscos/zstd-rs/commit/d34502a0ed07f80ab2aa4c65059578e0466f2467"},{"url":"https://github.com/gyscos/zstd-rs/pull/384"}],"tags":["osv","rust"],"ingestedAt":"2026-10-27T16:20:12.104Z","slug":"RUSTSEC-2026-0400","body":"## Overview\n\nThe one-shot `DCtx` and `CCtx` methods assumed the C library resets the\ncontext, but it leaves an open stream as it is. When a stream was left\nunfinished on a context, a one-shot call such as `decompress_using_dict`\ncould leave the context pointing at the dictionary borrowed for that call,\nand the next streaming call resumed the stream against it after it was\nfreed: decompressed output then contained freed heap memory. On the\ncompression side, the stream resumed against the one-shot call's buffers.\n\nThis requires an application to use one context for both streaming and\none-shot calls without a reset in between. The flaw was corrected by\nresetting the session after one-shot calls whenever a stream may be open.\n\n## Affected packages\n\n- `zstd-safe >= 3.0.1, < 8.2.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `zstd-safe 8.2.0`","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}