Skip to content
OpenAdvisories
Unscored RUSTSEC-2026-0404

Double free in `DCtx::try_clone`

Published Oct 16, 2026 · Updated Nov 2, 2026 · Assigned by RUSTSEC

Description

`DCtx::try_clone` (`experimental` feature, deprecated) is a plain copy of the
C context. A context owning a dictionary (from `load_dictionary`,
`ref_prefix` or `init_using_dict`) or a dictionary table (`ref_ddict` with
`RefMultipleDDicts`) ended up with both copies freeing it. A context cloned
mid-frame resumed on uninitialized stream state. The clone also silently lost
the `WindowLogMax` limit.

The flaw was corrected by refusing to clone such contexts, and by carrying
over the parameters the copy leaves out.

Affected packages

EcosystemPackageAffectedFixedRecord
crates.io zstd-safe >= 4.1.4, < 7.4.0 · >= 8.0.0-0, < 8.2.0 7.4.0, 8.2.0 RUSTSEC-2026-0404

References