{"id":"RUSTSEC-2026-0399","aliases":[],"status":"published","title":"Use-after-free through `init_using_cdict` and `init_using_ddict`","description":"`CCtx::init_using_cdict` and `DCtx::init_using_ddict` (`experimental`\nfeature, deprecated) took the dictionary as `\u0026CDict\u003c'b\u003e` and `\u0026DDict\u003c'b\u003e`\nwith only `'b: 'a`, so the dictionary itself could be dropped while the\ncontext still pointed at it. The same mistake in other constructors was\nfixed earlier (\u003chttps://github.com/gyscos/zstd-rs/issues/365\u003e).\n\nThe flaw was corrected by taking `\u0026'a CDict\u003c'b\u003e` and `\u0026'a DDict\u003c'b\u003e`.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2026-10-16T12:00:00Z","modified":"2026-11-02T09:30:03Z","fixes":[{"ecosystem":"crates.io","package":"zstd-safe","fixed_in":["7.4.0","8.2.0"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"crates.io","package":"zstd-safe","ranges":[{"type":"SEMVER","events":[{"introduced":"3.0.0"},{"fixed":"7.4.0"},{"introduced":"8.0.0-0"},{"fixed":"8.2.0"}]}]}],"references":[{"url":"https://crates.io/crates/zstd-safe","tags":["package"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0399.html","tags":["advisory"]},{"url":"https://github.com/gyscos/zstd-rs/commit/e00e7928e3e98953fc43418af6d73f6aae2378fb","tags":["web"]},{"url":"https://github.com/gyscos/zstd-rs/pull/384","tags":["web"]}],"sources":{"osv":[{"id":"RUSTSEC-2026-0399","title":"Use-after-free through `init_using_cdict` and `init_using_ddict`","description":"`CCtx::init_using_cdict` and `DCtx::init_using_ddict` (`experimental`\nfeature, deprecated) took the dictionary as `\u0026CDict\u003c'b\u003e` and `\u0026DDict\u003c'b\u003e`\nwith only `'b: 'a`, so the dictionary itself could be dropped while the\ncontext still pointed at it. The same mistake in other constructors was\nfixed earlier (\u003chttps://github.com/gyscos/zstd-rs/issues/365\u003e).\n\nThe flaw was corrected by taking `\u0026'a CDict\u003c'b\u003e` and `\u0026'a DDict\u003c'b\u003e`.","status":"published","published":"2026-10-16T12:00:00Z","modified":"2026-11-02T09:30:03.328955732Z","updated_at":"2026-11-02T15:53:40.430679Z"}]}}