zstd-safe (crates.io)
Advisories
12
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 8.2.0 or later clears every advisory below that has a fix.
Upgrade commands
cargo
cargo update -p zstd-safe --precise 8.2.0Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| RUSTSEC-2026-0395 Use-after-free with `CParameter::StableInBuffer` |
Not rated yet | >= 4.1.0, < 8.2.0 | 8.2.0 |
| RUSTSEC-2026-0397 `OutBuffer::around_pos` exposes uninitialized memory |
Not rated yet | >= 4.0.0, < 8.2.0 | 8.2.0 |
| RUSTSEC-2026-0396 `Seekable` reads a NULL or out-of-bounds seek table |
Not rated yet | >= 7.2.2, < 8.2.0 | 8.2.0 |
| RUSTSEC-2026-0398 `Seekable::decompress` sets a `Vec` length beyond its capacity for offsets past the end |
Not rated yet | >= 7.2.2, < 8.2.0 | 8.2.0 |
| RUSTSEC-2026-0399 Use-after-free through `init_using_cdict` and `init_using_ddict` |
Not rated yet | >= 3.0.0, < 8.2.0 | 8.2.0 |
| RUSTSEC-2026-0400 Use-after-free of a dictionary after a one-shot call on a context with an open stream |
Not rated yet | >= 3.0.1, < 8.2.0 | 8.2.0 |
| RUSTSEC-2026-0401 Out-of-bounds read in `train_from_buffer` when sample sizes overflow |
Not rated yet | >= 0.0.0-0, < 8.2.0 | 8.2.0 |
| RUSTSEC-2026-0402 Heap buffer overflow in `CCtx::try_clone` on a multithreaded context |
Not rated yet | >= 4.1.4, < 8.2.0 | 8.2.0 |
| RUSTSEC-2026-0403 Uninitialized memory exposed when streaming decompression of a legacy frame fails |
Not rated yet | >= 4.0.0, < 8.2.0 | 8.2.0 |
| RUSTSEC-2026-0404 Double free in `DCtx::try_clone` |
Not rated yet | >= 4.1.4, < 8.2.0 | 8.2.0 |
| RUSTSEC-2026-0405 Out-of-bounds read with an out-of-range `InBuffer::pos` |
Not rated yet | >= 7.2.2, < 8.2.0 | 8.2.0 |
| RUSTSEC-2026-0406 Use-after-free when changing a multithreaded context with an unfinished frame |
Not rated yet | >= 0.0.0-0, < 8.2.0 | 8.2.0 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor