{"aliases":[],"categories":["memory-exposure","memory-corruption"],"crate":"zstd-safe","cves":[],"cvss":0.0,"database_specific":{"severity":""},"date":"2026-10-16","deb_packages":[{"crate_name":"debian-repro-status","deb_name":"debian-repro-status","version":"0.4.0-3"},{"crate_name":"doxx","deb_name":"doxx","version":"0.1.4+ds-1"},{"crate_name":"git-cinnabar","deb_name":"git-cinnabar","version":"0.7.3-2+b2"},{"crate_name":"zstd-safe","deb_name":"librust-zstd-safe-dev","version":"7.2.4-1+b1"},{"crate_name":"miniserve","deb_name":"miniserve","version":"0.35.0-6"},{"crate_name":"protonup-rs","deb_name":"protonup-rs","version":"0.15.0-1+b2"},{"crate_name":"rebuildctl","deb_name":"rebuildctl","version":"0.28.0-2"},{"crate_name":"rebuilderd","deb_name":"rebuilderd","version":"0.28.0+ds-2+b2"},{"crate_name":"rebuilderd-worker","deb_name":"rebuilderd-worker","version":"0.28.0-1+b2"},{"crate_name":null,"deb_name":"rustup","version":"1.27.1-8+b2"},{"crate_name":"samply","deb_name":"samply","version":"0.13.1-1+b2"},{"crate_name":null,"deb_name":"ty","version":"0.0.85+ruff0.16.10+ds-2"}],"description":"`ZSTD_seekable_decompress` shortens the requested length to the end of the\ndata without checking that the offset is before it. For an offset past the\nend, it returns a wrapped-around length without writing anything, and\n`Seekable::decompress` passed that length to `Vec::set_len`.\n\nWith the `seekable` feature, whoever supplies the archive, or chooses the\noffset, can leave the caller's `Vec<u8>` with a length far beyond its\ncapacity. Reading it then discloses neighbouring heap memory, and appending\nto it corrupts memory. Offsets near `u64::MAX` can also hang the call.\n\nThe flaw was corrected by clamping requests to the end of the data, and by\nchecking every count reported by the C library against the buffer capacity.","id":"RUSTSEC-2026-0398","keywords":["seekable","out-of-bounds"],"patched_versions":["^7.4.0",">=8.2.0"],"source":"debian_rustsec","title":"`Seekable::decompress` sets a `Vec` length beyond its capacity for offsets past the end","url":"https://github.com/gyscos/zstd-rs/commit/80506be743fae2ed0c2fe8b21c374c6a2eab0be7"}