{
  "aliases": [],
  "categories": [
    "memory-exposure"
  ],
  "crate": "zstd-safe",
  "cves": [],
  "cvss": 0.0,
  "database_specific": {
    "severity": ""
  },
  "date": "2026-10-16",
  "deb_packages": [
    {
      "crate_name": "debian-repro-status",
      "deb_name": "debian-repro-status",
      "version": "0.4.0-3"
    },
    {
      "crate_name": "doxx",
      "deb_name": "doxx",
      "version": "0.1.4+ds-1"
    },
    {
      "crate_name": "git-cinnabar",
      "deb_name": "git-cinnabar",
      "version": "0.7.3-2+b2"
    },
    {
      "crate_name": "zstd-safe",
      "deb_name": "librust-zstd-safe-dev",
      "version": "7.2.4-1+b1"
    },
    {
      "crate_name": "miniserve",
      "deb_name": "miniserve",
      "version": "0.35.0-6"
    },
    {
      "crate_name": "protonup-rs",
      "deb_name": "protonup-rs",
      "version": "0.15.0-1+b2"
    },
    {
      "crate_name": "rebuildctl",
      "deb_name": "rebuildctl",
      "version": "0.28.0-2"
    },
    {
      "crate_name": "rebuilderd",
      "deb_name": "rebuilderd",
      "version": "0.28.0+ds-2+b2"
    },
    {
      "crate_name": "rebuilderd-worker",
      "deb_name": "rebuilderd-worker",
      "version": "0.28.0-1+b2"
    },
    {
      "crate_name": null,
      "deb_name": "rustup",
      "version": "1.27.1-8+b2"
    },
    {
      "crate_name": "samply",
      "deb_name": "samply",
      "version": "0.13.1-1+b2"
    },
    {
      "crate_name": null,
      "deb_name": "ty",
      "version": "0.0.85+ruff0.16.10+ds-2"
    }
  ],
  "description": "When decompression fails inside a legacy (zstd v0.4 to v0.7) frame, the\nbundled zstd library reports the output buffer as fully written although\nnothing was written. `DCtx::decompress_stream` committed that position even\non error, and for a `Vec<u8>` destination this extended the vector's length\nover uninitialized memory.\n\nLegacy support is enabled by default. A 5- or 6-byte corrupt legacy frame is\nenough: through `zstd::stream::write::Decoder`, up to 32 KiB of stale heap\nmemory is then passed to the wrapped writer on the next `write()` or\n`flush()`, or when an `auto_flush()`/`on_flush()` decoder is dropped. Whether\nthis reaches an attacker depends on where the application sends the\ndecompressed output. `zstd::stream::read::Decoder`, `zstd::decode_all` and\nthe bulk API are not affected.\n\nBefore zstd-safe 4.0.0, output buffers could only be initialized slices.\nThe zstd crate's own writer had the same flaw from 0.4.22 to 0.7.x, which is\ncovered by a separate advisory.\n\nThe flaw was corrected by only committing the buffer positions of a\nsuccessful call.",
  "id": "RUSTSEC-2026-0403",
  "keywords": [
    "uninitialized-memory",
    "decompression",
    "legacy"
  ],
  "patched_versions": [
    "^7.4.0",
    ">=8.2.0"
  ],
  "source": "debian_rustsec",
  "title": "Uninitialized memory exposed when streaming decompression of a legacy frame fails",
  "url": "https://github.com/gyscos/zstd-rs/commit/006e1d1ad1eeaf6b5d4c28329e70217adabcec43"
}