RUSTSEC-2026-0397

`OutBuffer::around_pos` exposes uninitialized memory

Not rated yet crates.io

Severity: Not rated yet; No source has published a CVSS score yet
Exploit chance (EPSS): —; No score published
Known exploited: No; Not in CISA's catalog
Weakness: —; Not classified
Fix: 8.2.0; Upgrade zstd-safe to this version or later

Description

OutBuffer::around_pos accepted a position past the initialized length of a Vec<u8>. The next streaming call then marked everything before the position as initialized, so safe code could read stale heap memory between the vector's previous length and that position.

The flaw was corrected by zero-filling that gap.

Affected versions

crates.io

Package	Vulnerable	Fixed in
zstd-safe	`>= 4.0.0, < 7.4.0` `>= 8.0.0-0, < 8.2.0`	`7.4.0` `8.2.0`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

zstd-safe crates.io → `8.2.0`

cargo

cargo update -p zstd-safe --precise 8.2.0

References

Advisories

rustsec.org/advisories/RUSTSEC-2026-0397.html

Packages

crates.io/crates/zstd-safe

Timeline

Oct 16, 2026 Published
Nov 2, 2026 Last updated by the source

Advisory	Severity	Why it's related
RUSTSEC-2026-0406 Use-after-free when changing a multithreaded context with an unfinished frame	Not rated yet	Also affects zstd-safe
RUSTSEC-2026-0405 Out-of-bounds read with an out-of-range `InBuffer::pos`	Not rated yet	Also affects zstd-safe
RUSTSEC-2026-0404 Double free in `DCtx::try_clone`	Not rated yet	Also affects zstd-safe
RUSTSEC-2026-0403 Uninitialized memory exposed when streaming decompression of a legacy frame fails	Not rated yet	Also affects zstd-safe
RUSTSEC-2026-0402 Heap buffer overflow in `CCtx::try_clone` on a multithreaded context	Not rated yet	Also affects zstd-safe
RUSTSEC-2026-0401 Out-of-bounds read in `train_from_buffer` when sample sizes overflow	Not rated yet	Also affects zstd-safe
RUSTSEC-2026-0400 Use-after-free of a dictionary after a one-shot call on a context with an open stream	Not rated yet	Also affects zstd-safe
RUSTSEC-2026-0399 Use-after-free through `init_using_cdict` and `init_using_ddict`	Not rated yet	Also affects zstd-safe

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor