RUSTSEC-2026-0404None▾ SunlitDouble free in `DCtx::try_clone`
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
DCtx::try_clone (experimental feature, deprecated) is a plain copy of the
C context. A context owning a dictionary (from load_dictionary,
ref_prefix or init_using_dict) or a dictionary table (ref_ddict with
RefMultipleDDicts) ended up with both copies freeing it. A context cloned
mid-frame resumed on uninitialized stream state. The clone also silently lost
the WindowLogMax limit.
The flaw was corrected by refusing to clone such contexts, and by carrying over the parameters the copy leaves out.
zstd-safe >= 8.0.0-0, < 8.2.0Upgrade to a patched release:
zstd-safe 8.2.0Connected by shared product, vendor, weakness, or advisory.
RUSTSEC-2026-0406NoneUse-after-free when changing a multithreaded context with an unfinished frame
RUSTSEC-2026-0405NoneOut-of-bounds read with an out-of-range `InBuffer::pos`
RUSTSEC-2026-0403NoneUninitialized memory exposed when streaming decompression of a legacy frame fails
RUSTSEC-2026-0402NoneHeap buffer overflow in `CCtx::try_clone` on a multithreaded context
RUSTSEC-2026-0401NoneOut-of-bounds read in `train_from_buffer` when sample sizes overflow
RUSTSEC-2026-0399NoneUse-after-free through `init_using_cdict` and `init_using_ddict`