---
id: RUSTSEC-2026-0404
title: 'Double free in `DCtx::try_clone`'
summary: 'Double free in `DCtx::try_clone`'
severity: none
vendor: zstd-safe
product: zstd-safe
ecosystem: rust
affected:
  - 'zstd-safe >= 8.0.0-0, < 8.2.0'
patched:
  - zstd-safe 8.2.0
published: '2026-10-16'
updated: '2026-11-02'
sourceUpdated: '2026-11-02T09:30:04.168804805Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/RUSTSEC-2026-0404'
references:
  - url: 'https://crates.io/crates/zstd-safe'
  - url: 'https://rustsec.org/advisories/RUSTSEC-2026-0404.html'
  - url: >-
      https://github.com/gyscos/zstd-rs/commit/cee6529b553ec600a8e152aaca15a91598820ecf
  - url: 'https://github.com/gyscos/zstd-rs/pull/384'
tags:
  - osv
  - rust
ingestedAt: '2026-10-27T16:20:12.116Z'
---

## Overview

`DCtx::try_clone` (`experimental` feature, deprecated) is a plain copy of the
C context. A context owning a dictionary (from `load_dictionary`,
`ref_prefix` or `init_using_dict`) or a dictionary table (`ref_ddict` with
`RefMultipleDDicts`) ended up with both copies freeing it. A context cloned
mid-frame resumed on uninitialized stream state. The clone also silently lost
the `WindowLogMax` limit.

The flaw was corrected by refusing to clone such contexts, and by carrying
over the parameters the copy leaves out.

## Affected packages

- `zstd-safe >= 8.0.0-0, < 8.2.0`

## Remediation

Upgrade to a patched release:

- `zstd-safe 8.2.0`