Skip to content
OpenAdvisories
Unscored RUSTSEC-2026-0399

Use-after-free through `init_using_cdict` and `init_using_ddict`

Published Oct 16, 2026 · Updated Nov 2, 2026 · Assigned by RUSTSEC

Description

`CCtx::init_using_cdict` and `DCtx::init_using_ddict` (`experimental`
feature, deprecated) took the dictionary as `&CDict<'b>` and `&DDict<'b>`
with only `'b: 'a`, so the dictionary itself could be dropped while the
context still pointed at it. The same mistake in other constructors was
fixed earlier (<https://github.com/gyscos/zstd-rs/issues/365>).

The flaw was corrected by taking `&'a CDict<'b>` and `&'a DDict<'b>`.

Affected packages

EcosystemPackageAffectedFixedRecord
crates.io zstd-safe >= 3.0.0, < 7.4.0 · >= 8.0.0-0, < 8.2.0 7.4.0, 8.2.0 RUSTSEC-2026-0399

References