690 matches found
RUSTSEC-2026-0398 `Seekable::decompress` sets a `Vec` length beyond its capacity for offsets past the end
ZSTDseekabledecompress shortens the requested length to the end of the data without checking that the offset is before it. For an offset past the end, it returns a wrapped-around length without writing anything, and Seekable::decompress passed that length to Vec::setlen. With the seekable feature...
Uninitialized memory exposed by `write::Decoder` on a corrupt legacy frame
From 0.4.22 to 0.7.x, the writer behind zstd::stream::write::Decoder set its output buffer's length to its full capacity before each decompression call, then to the position the call reported, and only checked for an error afterwards. When decompression fails inside a legacy zstd v0.4 to v0.7...
PT-2026-125060
ZDICT trainFromBuffer is never told the length of the samples buffer, so train from buffer checked that the sample sizes add up to it. With overflow checks off, as in release builds, that sum wrapped around: sizes totalling 2^64 plus the buffer length passed the check, and the trainer read past t...
PT-2026-125058
CCtx::init using cdict and DCtx::init using ddict experimental feature, deprecated took the dictionary as &CDict and &DDict with only 'b: 'a, so the dictionary itself could be dropped while the context still pointed at it. The same mistake in other constructors was fixed earlier . The flaw was...
PT-2026-125069
On wasm32, zstd-sys provides malloc and free to the C library through a shim over Rust's allocator. The shim did not check for allocation failure: it wrote its size header to address 0 and returned address 4, which the C library used as a valid buffer. freeNULL also read below address 0. Whenever...
PT-2026-125061
CCtx::try clone experimental feature, deprecated copies tables sized from the context's applied parameters. Starting a multithreaded frame zstdmt feature replaces those parameters with the workers' without resizing the context's own tables, so after an abandoned single-threaded frame, the copy...
PT-2026-125057
ZSTD seekable decompress shortens the requested length to the end of the data without checking that the offset is before it. For an offset past the end, it returns a wrapped-around length without writing anything, and Seekable::decompress passed that length to Vec::set len. With the seekable...
PT-2026-125062
When decompression fails inside a legacy zstd v0.4 to v0.7 frame, the bundled zstd library reports the output buffer as fully written although nothing was written. DCtx::decompress stream committed that position even on error, and for a Vec destination this extended the vector's length over...
PT-2026-125051
From 0.4.22 to 0.7.x, the writer behind zstd::stream::write::Decoder set its output buffer's length to its full capacity before each decompression call, then to the position the call reported, and only checked for an error afterwards. When decompression fails inside a legacy zstd v0.4 to v0.7...
PT-2026-125065
When a multithreaded frame zstdmt feature, CParameter::NbWorkers is left unfinished, its jobs may still be running on the worker threads: the C library only waits for them when the next frame starts, or when the context is freed. A session reset makes the context accept changes again in the...
PT-2026-125064
InBuffer's fields are public, so safe code can set pos past the end of src. The position was passed to the C library unchecked, and ZSTD seekable compressStream, unlike the other streaming functions, does not validate it: it read past the end of the input slice, by up to the frame size, and...
PT-2026-125054
With CParameter::StableInBuffertrue experimental feature, the C library keeps a pointer to the input of one streaming call and reads from it in later calls, including flush stream and end stream, which take no input. An InBuffer only borrows its slice for one call, so safe code could free it in...
CLEANSTART-2026-DU71733 zstd-jni versions 1
CVE-2026-89046 affects multiple packages. zstd-jni versions 1. See references for individual vulnerability details...
CLEANSTART-2026-OH53916 zstd-jni versions 1
CVE-2026-90560 affects multiple packages. zstd-jni versions 1. See references for individual vulnerability details...
CLEANSTART-2026-UR93558 zstd-jni versions before 1
CVE-2026-87795 affects multiple packages. zstd-jni versions before 1. See references for individual vulnerability details...
CLEANSTART-2026-LQ70759 zstd-jni versions before 1
CVE-2026-87877 affects multiple packages. zstd-jni versions before 1. See references for individual vulnerability details...
CLEANSTART-2026-PD97726 zstd-jni versions 1
CVE-2026-89045 affects multiple packages. zstd-jni versions 1. See references for individual vulnerability details...
CLEANSTART-2026-BS35742 zstd-jni before 1
Security vulnerability affects the strimzi-kafka-operator package. zstd-jni before 1...
CLEANSTART-2026-JE63853 vulnerability has been found in luben zstd-jni up to 1
Security vulnerability affects the strimzi-kafka-operator package. A vulnerability has been found in luben zstd-jni up to 1...