{
  "aliases": [],
  "categories": [
    "memory-exposure",
    "memory-corruption"
  ],
  "crate": "zstd-safe",
  "cves": [],
  "cvss": 0.0,
  "database_specific": {
    "severity": ""
  },
  "date": "2026-10-16",
  "deb_packages": [
    {
      "crate_name": "debian-repro-status",
      "deb_name": "debian-repro-status",
      "version": "0.4.0-3"
    },
    {
      "crate_name": "doxx",
      "deb_name": "doxx",
      "version": "0.1.4+ds-1"
    },
    {
      "crate_name": "git-cinnabar",
      "deb_name": "git-cinnabar",
      "version": "0.7.3-2+b2"
    },
    {
      "crate_name": "zstd-safe",
      "deb_name": "librust-zstd-safe-dev",
      "version": "7.2.4-1+b1"
    },
    {
      "crate_name": "miniserve",
      "deb_name": "miniserve",
      "version": "0.35.0-6"
    },
    {
      "crate_name": "protonup-rs",
      "deb_name": "protonup-rs",
      "version": "0.15.0-1+b2"
    },
    {
      "crate_name": "rebuildctl",
      "deb_name": "rebuildctl",
      "version": "0.28.0-2"
    },
    {
      "crate_name": "rebuilderd",
      "deb_name": "rebuilderd",
      "version": "0.28.0+ds-2+b2"
    },
    {
      "crate_name": "rebuilderd-worker",
      "deb_name": "rebuilderd-worker",
      "version": "0.28.0-1+b2"
    },
    {
      "crate_name": null,
      "deb_name": "rustup",
      "version": "1.27.1-8+b2"
    },
    {
      "crate_name": "samply",
      "deb_name": "samply",
      "version": "0.13.1-1+b2"
    },
    {
      "crate_name": null,
      "deb_name": "ty",
      "version": "0.0.85+ruff0.16.10+ds-2"
    }
  ],
  "description": "`ZSTD_seekable_decompress` shortens the requested length to the end of the\ndata without checking that the offset is before it. For an offset past the\nend, it returns a wrapped-around length without writing anything, and\n`Seekable::decompress` passed that length to `Vec::set_len`.\n\nWith the `seekable` feature, whoever supplies the archive, or chooses the\noffset, can leave the caller's `Vec<u8>` with a length far beyond its\ncapacity. Reading it then discloses neighbouring heap memory, and appending\nto it corrupts memory. Offsets near `u64::MAX` can also hang the call.\n\nThe flaw was corrected by clamping requests to the end of the data, and by\nchecking every count reported by the C library against the buffer capacity.",
  "id": "RUSTSEC-2026-0398",
  "keywords": [
    "seekable",
    "out-of-bounds"
  ],
  "patched_versions": [
    "^7.4.0",
    ">=8.2.0"
  ],
  "source": "debian_rustsec",
  "title": "`Seekable::decompress` sets a `Vec` length beyond its capacity for offsets past the end",
  "url": "https://github.com/gyscos/zstd-rs/commit/80506be743fae2ed0c2fe8b21c374c6a2eab0be7"
}