Uninitialized memory exposed by `write::Decoder` on a corrupt legacy frame

From 0.4.22 to 0.7.x, the writer behind zstd::stream::write::Decoder set its output buffer's length to its full capacity before each decompression call, then to the position the call reported, and only checked for an error afterwards. When decompression fails inside a legacy zstd v0.4 to v0.7...

Uninitialized memory exposed when streaming decompression of a legacy frame fails

When decompression fails inside a legacy zstd v0.4 to v0.7 frame, the bundled zstd library reports the output buffer as fully written although nothing was written. DCtx::decompressstream committed that position even on error, and for a Vec destination this extended the vector's length over...

PT-2026-125062

When decompression fails inside a legacy zstd v0.4 to v0.7 frame, the bundled zstd library reports the output buffer as fully written although nothing was written. DCtx::decompress stream committed that position even on error, and for a Vec destination this extended the vector's length over...

PT-2026-125051

From 0.4.22 to 0.7.x, the writer behind zstd::stream::write::Decoder set its output buffer's length to its full capacity before each decompression call, then to the position the call reported, and only checked for an error afterwards. When decompression fails inside a legacy zstd v0.4 to v0.7...

CVE-2026-54580: Improper Validation of Integrity Check Value

mport is the MidnightBSD Package Manager. Prior to 2.7.8, libmport/util.c did not make every truncated, corrupt, or failed zstd stream fatal in mportdecompresszstd, and libmport/fetch.c did not consistently propagate those failures to index-fetch callers. A malicious or faulty mirror could supply...