RUSTSEC-2026-0404

Double free in `DCtx::try_clone`

Not rated yet crates.io

Severity: Not rated yet; No source has published a CVSS score yet
Exploit chance (EPSS): —; No score published
Known exploited: No; Not in CISA's catalog
Weakness: —; Not classified
Fix: 8.2.0; Upgrade zstd-safe to this version or later

Description

DCtx::try_clone (experimental feature, deprecated) is a plain copy of the C context. A context owning a dictionary (from load_dictionary, ref_prefix or init_using_dict) or a dictionary table (ref_ddict with RefMultipleDDicts) ended up with both copies freeing it. A context cloned mid-frame resumed on uninitialized stream state. The clone also silently lost the WindowLogMax limit.

The flaw was corrected by refusing to clone such contexts, and by carrying over the parameters the copy leaves out.

Affected versions

crates.io

Package	Vulnerable	Fixed in
zstd-safe	`>= 4.1.4, < 8.2.0`	`8.2.0`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

zstd-safe crates.io → `8.2.0`

cargo

cargo update -p zstd-safe --precise 8.2.0

References

Advisories

rustsec.org/advisories/RUSTSEC-2026-0404.html

Packages

crates.io/crates/zstd-safe

Timeline

Oct 16, 2026 Published
Oct 26, 2026 Last updated by the source

Advisory	Severity	Why it's related
RUSTSEC-2026-0406 Use-after-free when changing a multithreaded context with an unfinished frame	Not rated yet	Also affects zstd-safe
RUSTSEC-2026-0405 Out-of-bounds read with an out-of-range `InBuffer::pos`	Not rated yet	Also affects zstd-safe
RUSTSEC-2026-0403 Uninitialized memory exposed when streaming decompression of a legacy frame fails	Not rated yet	Also affects zstd-safe
RUSTSEC-2026-0402 Heap buffer overflow in `CCtx::try_clone` on a multithreaded context	Not rated yet	Also affects zstd-safe
RUSTSEC-2026-0401 Out-of-bounds read in `train_from_buffer` when sample sizes overflow	Not rated yet	Also affects zstd-safe
RUSTSEC-2026-0400 Use-after-free of a dictionary after a one-shot call on a context with an open stream	Not rated yet	Also affects zstd-safe
RUSTSEC-2026-0399 Use-after-free through `init_using_cdict` and `init_using_ddict`	Not rated yet	Also affects zstd-safe
RUSTSEC-2026-0398 `Seekable::decompress` sets a `Vec` length beyond its capacity for offsets past the end	Not rated yet	Also affects zstd-safe

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor