Fedora 43 : rust-backtrace / rust-object / rust-object0.37 / rust-object0.38 / etc (2026-9e7597548d)

The remote Fedora 43 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-9e7597548d advisory. - Update the object crate to version 0.40.0. - Add a compat package for version 0.39 of the object crate. - Update the ruzstd crate to version 0.9.1. This...

Fedora 44 : rust-backtrace / rust-object / rust-object0.37 / rust-object0.38 / etc (2026-09783712f4)

The remote Fedora 44 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-09783712f4 advisory. - Update the object crate to version 0.40.0. - Add a compat package for version 0.39 of the object crate. - Update the ruzstd crate to version 0.9.1. This...

Fedora 46 : rust-backtrace / rust-object / rust-object0.37 / rust-object0.38 / etc (2026-d591b1e061)

The remote Fedora 46 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-d591b1e061 advisory. - Update the object crate to version 0.40.0. - Add a compat package for version 0.39 of the object crate. - Update the ruzstd crate to version 0.9.1. This...

RUSTSEC-2026-0344 Decompression bomb in `ruzstd`: a tiny input can exhaust memory (OOM)

A crafted .zst input under 128 KB can force ruzstd to allocate several gigabytes at once, crashing the process with an out-of-memory condition. Since ruzstd is a decoder for untrusted input, a single small file is enough to take down anything decoding it. The compressed size of a block was capped...

aff4 (>=0.1.2, <=0.2.6), aff4-forensic (0.1.0) +103 more potentially affected by unknown CVE via ruzstd (>=0.2.2, <=0.8.3)

ruzstd CARGO version =0.2.2, =0.1.2, =0.1.0, =0.1.0, =0.0.1, =0.3.75, =0.7.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.8.0, =0.6.6, =0.26.0, =0.26.1 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0344...

Decompression bomb in `ruzstd`: a tiny input can exhaust memory (OOM)

A crafted .zst input under 128 KB can force ruzstd to allocate several gigabytes at once, crashing the process with an out-of-memory condition. Since ruzstd is a decoder for untrusted input, a single small file is enough to take down anything decoding it. The compressed size of a block was capped...

PT-2026-120744

A crafted .zst input under 128 KB can force ruzstd to allocate several gigabytes at once, crashing the process with an out-of-memory condition. Since ruzstd is a decoder for untrusted input, a single small file is enough to take down anything decoding it. The compressed size of a block was capped...

Fedora 41 : retsnoop / rust-rbspy (2024-aa246ab1a3)

The remote Fedora 41 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2024-aa246ab1a3 advisory. Rebuild affected applications with ruzstd v0.7.3 to address RUSTSEC-2024-0400. Tenable has extracted the preceding description block directly from the Fedora...

Fedora 40 : retsnoop / rust-rbspy (2024-ccce2763b0)

The remote Fedora 40 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2024-ccce2763b0 advisory. Rebuild affected applications with ruzstd v0.7.3 to address RUSTSEC-2024-0400. Tenable has extracted the preceding description block directly from the Fedora...

`ruzstd` uninit and out-of-bounds memory reads

Affected versions of ruzstd miscalculate the length of the allocated and init section of its internal RingBuffer, leading to uninitialized or out-of-bounds reads in copybytesovershooting of up to 15 bytes. This may result in up to 15 bytes of memory contents being written into the decoded data wh...

GHSA-X3F4-45XF-RJM7 `ruzstd` uninit and out-of-bounds memory reads

Affected versions of ruzstd miscalculate the length of the allocated and init section of its internal RingBuffer, leading to uninitialized or out-of-bounds reads in copybytesovershooting of up to 15 bytes. This may result in up to 15 bytes of memory contents being written into the decoded data wh...

PT-2024-40516

Name of the Vulnerable Software and Affected Versions ruzstd affected versions not specified Description The issue arises from miscalculations in the length of the allocated and init section of the internal RingBuffer in ruzstd. This leads to uninitialized or out-of-bounds reads in copy bytes...

RUSTSEC-2024-0400 `ruzstd` uninit and out-of-bounds memory reads

Affected versions of ruzstd miscalculate the length of the allocated and init section of its internal RingBuffer, leading to uninitialized or out-of-bounds reads in copybytesovershooting of up to 15 bytes. This may result in up to 15 bytes of memory contents being written into the decoded data wh...

`ruzstd` uninit and out-of-bounds memory reads

Affected versions of ruzstd miscalculate the length of the allocated and init section of its internal RingBuffer, leading to uninitialized or out-of-bounds reads in copybytesovershooting of up to 15 bytes. This may result in up to 15 bytes of memory contents being written into the decoded data wh...

PT-2024-40946 · Ruzstd · Ruzstd

Name of the Vulnerable Software and Affected Versions: ruzstd affected versions not specified Description: The issue arises from miscalculations in the length of the allocated and init section of the internal RingBuffer in ruzstd. This leads to uninitialized or out-of-bounds reads in copy bytes...