{"id":"RUSTSEC-2026-0406","aliases":[],"status":"published","title":"Use-after-free when changing a multithreaded context with an unfinished frame","description":"When a multithreaded frame (`zstdmt` feature, `CParameter::NbWorkers`) is\nleft unfinished, its jobs may still be running on the worker threads: the C\nlibrary only waits for them when the next frame starts, or when the context\nis freed. A session reset makes the context accept changes again in the\nmeantime, so:\n\n- unloading the dictionary (`load_dictionary`, `ref_cdict`, `ref_prefix`,\n  `disable_dictionary`, `init*`, or `reset` with parameters) freed the\n  dictionary a worker was still compressing against;\n- changing `NbWorkers` made the next frame resize the job table before\n  waiting for the old jobs.\n\nThe flaw was corrected by refusing these calls while a multithreaded frame\nis unfinished. The new `CCtx::wait_for_workers()` waits for the workers\nfirst.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2026-10-16T12:00:00Z","modified":"2026-11-02T09:30:03Z","fixes":[{"ecosystem":"crates.io","package":"zstd-safe","fixed_in":["7.4.0","8.2.0"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"crates.io","package":"zstd-safe","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"7.4.0"},{"introduced":"8.0.0-0"},{"fixed":"8.2.0"}]}]}],"references":[{"url":"https://crates.io/crates/zstd-safe","tags":["package"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0406.html","tags":["advisory"]},{"url":"https://github.com/gyscos/zstd-rs/commit/e224018a2389915d68ed17f30109bebad36e9734","tags":["web"]},{"url":"https://github.com/gyscos/zstd-rs/pull/384","tags":["web"]}],"sources":{"osv":[{"id":"RUSTSEC-2026-0406","title":"Use-after-free when changing a multithreaded context with an unfinished frame","description":"When a multithreaded frame (`zstdmt` feature, `CParameter::NbWorkers`) is\nleft unfinished, its jobs may still be running on the worker threads: the C\nlibrary only waits for them when the next frame starts, or when the context\nis freed. A session reset makes the context accept changes again in the\nmeantime, so:\n\n- unloading the dictionary (`load_dictionary`, `ref_cdict`, `ref_prefix`,\n  `disable_dictionary`, `init*`, or `reset` with parameters) freed the\n  dictionary a worker was still compressing against;\n- changing `NbWorkers` made the next frame resize the job table before\n  waiting for the old jobs.\n\nThe flaw was corrected by refusing these calls while a multithreaded frame\nis unfinished. The new `CCtx::wait_for_workers()` waits for the workers\nfirst.","status":"published","published":"2026-10-16T12:00:00Z","modified":"2026-11-02T09:30:03.59119471Z","updated_at":"2026-11-02T15:53:40.430679Z"}]}}