RUSTSEC-2026-0406
Use-after-free when changing a multithreaded context with an unfinished frame
When a multithreaded frame (zstdmt feature, CParameter::NbWorkers) is
left unfinished, its jobs may still be running on the worker threads: the C
library only waits for them when the next frame starts, or when the context
is freed. A session reset makes the context accept changes again in the
meantime, so:
- unloading the dictionary (
load_dictionary,ref_cdict,ref_prefix,disable_dictionary,init*, orresetwith parameters) freed the dictionary a worker was still compressing against; - changing
NbWorkersmade the next frame resize the job table before waiting for the old jobs.
The flaw was corrected by refusing these calls while a multithreaded frame
is unfinished. The new CCtx::wait_for_workers() waits for the workers
first.
What each source reports
OSV No score
Use-after-free when changing a multithreaded context with an unfinished frame
When a multithreaded frame (zstdmt feature, CParameter::NbWorkers) is
left unfinished, its jobs may still be running on the worker threads: the C
library only waits for them when the next frame starts, or when the context
is freed. A session reset makes the context accept changes again in the
meantime, so:
- unloading the dictionary (
load_dictionary,ref_cdict,ref_prefix,disable_dictionary,init*, orresetwith parameters) freed the dictionary a worker was still compressing against; - changing
NbWorkersmade the next frame resize the job table before waiting for the old jobs.
The flaw was corrected by refusing these calls while a multithreaded frame
is unfinished. The new CCtx::wait_for_workers() waits for the workers
first.
- Record
RUSTSEC-2026-0406- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
zstd-safecrates.io |
0.0.0-0 up to 7.4.0, 8.0.0-0 up to 8.2.0 | 7.4.08.2.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
RUSTSEC-2026-0406 is a vulnerability with no CVSS score yet in zstd-safe, published October 16, 2026. No source lists public exploit code. Fixed in zstd-safe 7.4.0.