Use-after-free through `init_using_cdict` and `init_using_ddict`

CCtx::initusingcdict and DCtx::initusingddict experimental feature, deprecated took the dictionary as &CDict and &DDict with only 'b: 'a, so the dictionary itself could be dropped while the context still pointed at it. The same mistake in other constructors was fixed earlier . The flaw was...

RUSTSEC-2026-0403 Uninitialized memory exposed when streaming decompression of a legacy frame fails

When decompression fails inside a legacy zstd v0.4 to v0.7 frame, the bundled zstd library reports the output buffer as fully written although nothing was written. DCtx::decompressstream committed that position even on error, and for a Vec destination this extended the vector's length over...

Double free in `DCtx::try_clone`

DCtx::tryclone experimental feature, deprecated is a plain copy of the C context. A context owning a dictionary from loaddictionary, refprefix or initusingdict or a dictionary table refddict with RefMultipleDDicts ended up with both copies freeing it. A context cloned mid-frame resumed on...

Uninitialized memory exposed when streaming decompression of a legacy frame fails

When decompression fails inside a legacy zstd v0.4 to v0.7 frame, the bundled zstd library reports the output buffer as fully written although nothing was written. DCtx::decompressstream committed that position even on error, and for a Vec destination this extended the vector's length over...

RUSTSEC-2026-0404 Double free in `DCtx::try_clone`

DCtx::tryclone experimental feature, deprecated is a plain copy of the C context. A context owning a dictionary from loaddictionary, refprefix or initusingdict or a dictionary table refddict with RefMultipleDDicts ended up with both copies freeing it. A context cloned mid-frame resumed on...

RUSTSEC-2026-0400 Use-after-free of a dictionary after a one-shot call on a context with an open stream

The one-shot DCtx and CCtx methods assumed the C library resets the context, but it leaves an open stream as it is. When a stream was left unfinished on a context, a one-shot call such as decompressusingdict could leave the context pointing at the dictionary borrowed for that call, and the next...

PT-2026-125062

When decompression fails inside a legacy zstd v0.4 to v0.7 frame, the bundled zstd library reports the output buffer as fully written although nothing was written. DCtx::decompress stream committed that position even on error, and for a Vec destination this extended the vector's length over...

PT-2026-125063

DCtx::try clone experimental feature, deprecated is a plain copy of the C context. A context owning a dictionary from load dictionary, ref prefix or init using dict or a dictionary table ref ddict with RefMultipleDDicts ended up with both copies freeing it. A context cloned mid-frame resumed on...

PT-2026-125059

The one-shot DCtx and CCtx methods assumed the C library resets the context, but it leaves an open stream as it is. When a stream was left unfinished on a context, a one-shot call such as decompress using dict could leave the context pointing at the dictionary borrowed for that call, and the next...

PT-2026-125058

CCtx::init using cdict and DCtx::init using ddict experimental feature, deprecated took the dictionary as &CDict and &DDict with only 'b: 'a, so the dictionary itself could be dropped while the context still pointed at it. The same mistake in other constructors was fixed earlier . The flaw was...