RUSTSEC-2026-0399
Use-after-free through `init_using_cdict` and `init_using_ddict`
CCtx::init_using_cdict and DCtx::init_using_ddict (experimental
feature, deprecated) took the dictionary as &CDict<'b> and &DDict<'b>
with only 'b: 'a, so the dictionary itself could be dropped while the
context still pointed at it. The same mistake in other constructors was
fixed earlier (https://github.com/gyscos/zstd-rs/issues/365).
The flaw was corrected by taking &'a CDict<'b> and &'a DDict<'b>.
What each source reports
OSV No score
Use-after-free through `init_using_cdict` and `init_using_ddict`
CCtx::init_using_cdict and DCtx::init_using_ddict (experimental
feature, deprecated) took the dictionary as &CDict<'b> and &DDict<'b>
with only 'b: 'a, so the dictionary itself could be dropped while the
context still pointed at it. The same mistake in other constructors was
fixed earlier (https://github.com/gyscos/zstd-rs/issues/365).
The flaw was corrected by taking &'a CDict<'b> and &'a DDict<'b>.
- Record
RUSTSEC-2026-0399- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
zstd-safecrates.io |
3.0.0 up to 7.4.0, 8.0.0-0 up to 8.2.0 | 7.4.08.2.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
RUSTSEC-2026-0399 is a vulnerability with no CVSS score yet in zstd-safe, published October 16, 2026. No source lists public exploit code. Fixed in zstd-safe 7.4.0.