Skip to content

zstd, zstd-safe: add the backported fixes in 0.13.4 and 7.4.0 #3479

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
djc merged 13 commits into from
Nov 2, 2026
+41 −41
Merged

zstd, zstd-safe: add the backported fixes in 0.13.4 and 7.4.0 #3479

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
13 commits
Select commit Hold shift + click to select a range
48eb452
RUSTSEC-2026-0391: also patched in zstd 0.13.4
gyscos Nov 1, 2026
d067384
RUSTSEC-2026-0395: also patched in zstd-safe 7.4.0
gyscos Nov 1, 2026
3563e29
RUSTSEC-2026-0396: also patched in zstd-safe 7.4.0
gyscos Nov 1, 2026
839bb2e
RUSTSEC-2026-0397: also patched in zstd-safe 7.4.0
gyscos Nov 1, 2026
303a769
RUSTSEC-2026-0398: also patched in zstd-safe 7.4.0
gyscos Nov 1, 2026
f9f343f
RUSTSEC-2026-0399: also patched in zstd-safe 7.4.0
gyscos Nov 1, 2026
75b5820
RUSTSEC-2026-0400: also patched in zstd-safe 7.4.0
gyscos Nov 1, 2026
3e7b814
RUSTSEC-2026-0401: also patched in zstd-safe 7.4.0
gyscos Nov 1, 2026
8673ad1
RUSTSEC-2026-0402: also patched in zstd-safe 7.4.0
gyscos Nov 1, 2026
ccb0653
RUSTSEC-2026-0403: also patched in zstd-safe 7.4.0
gyscos Nov 1, 2026
1ce1b86
RUSTSEC-2026-0404: also patched in zstd-safe 7.4.0
gyscos Nov 1, 2026
70943d1
RUSTSEC-2026-0405: also patched in zstd-safe 7.4.0
gyscos Nov 1, 2026
c8f409c
RUSTSEC-2026-0406: also patched in zstd-safe 7.4.0
gyscos Nov 1, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions crates/zstd-safe/RUSTSEC-2026-0395.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,10 +12,10 @@ keywords = ["use-after-free", "experimental"]
[affected]

[affected.functions]
"zstd_safe::CCtx::set_parameter" = [">= 4.1.0, < 8.2.0"]
"zstd_safe::CCtx::set_parameter" = [">= 4.1.0, < 7.4.0", ">= 8.0.0, < 8.2.0"]

[versions]
patched = [">= 8.2.0"]
patched = ["^7.4.0", ">= 8.2.0"]
unaffected = ["< 4.1.0"]
```

Expand Down
12 changes: 6 additions & 6 deletions crates/zstd-safe/RUSTSEC-2026-0396.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,14 +12,14 @@ keywords = ["seekable", "null-pointer"]
[affected]

[affected.functions]
"zstd_safe::seekable::Seekable::decompress" = [">= 7.2.2, < 8.2.0"]
"zstd_safe::seekable::Seekable::decompress_frame" = [">= 7.2.2, < 8.2.0"]
"zstd_safe::seekable::Seekable::offset_to_frame_index" = [">= 7.2.2, < 8.2.0"]
"zstd_safe::seekable::Seekable::frame_decompressed_size" = [">= 7.2.2, < 8.2.0"]
"zstd_safe::seekable::SeekTable::frame_decompressed_size" = [">= 7.2.2, < 8.2.0"]
"zstd_safe::seekable::Seekable::decompress" = [">= 7.2.2, < 7.4.0", ">= 8.0.0, < 8.2.0"]
"zstd_safe::seekable::Seekable::decompress_frame" = [">= 7.2.2, < 7.4.0", ">= 8.0.0, < 8.2.0"]
"zstd_safe::seekable::Seekable::offset_to_frame_index" = [">= 7.2.2, < 7.4.0", ">= 8.0.0, < 8.2.0"]
"zstd_safe::seekable::Seekable::frame_decompressed_size" = [">= 7.2.2, < 7.4.0", ">= 8.0.0, < 8.2.0"]
"zstd_safe::seekable::SeekTable::frame_decompressed_size" = [">= 7.2.2, < 7.4.0", ">= 8.0.0, < 8.2.0"]

[versions]
patched = [">= 8.2.0"]
patched = ["^7.4.0", ">= 8.2.0"]
unaffected = ["< 7.2.2"]
```

Expand Down
4 changes: 2 additions & 2 deletions crates/zstd-safe/RUSTSEC-2026-0397.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,10 +12,10 @@ keywords = ["uninitialized-memory"]
[affected]

[affected.functions]
"zstd_safe::OutBuffer::around_pos" = [">= 4.0.0, < 8.2.0"]
"zstd_safe::OutBuffer::around_pos" = [">= 4.0.0, < 7.4.0", ">= 8.0.0, < 8.2.0"]

[versions]
patched = [">= 8.2.0"]
patched = ["^7.4.0", ">= 8.2.0"]
unaffected = ["< 4.0.0"]
```

Expand Down
6 changes: 3 additions & 3 deletions crates/zstd-safe/RUSTSEC-2026-0398.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,11 +11,11 @@ keywords = ["seekable", "out-of-bounds"]
[affected]

[affected.functions]
"zstd_safe::seekable::Seekable::decompress" = [">= 7.2.2, < 8.2.0"]
"zstd_safe::seekable::AdvancedSeekable::decompress" = [">= 7.2.2, < 8.2.0"]
"zstd_safe::seekable::Seekable::decompress" = [">= 7.2.2, < 7.4.0", ">= 8.0.0, < 8.2.0"]
"zstd_safe::seekable::AdvancedSeekable::decompress" = [">= 7.2.2, < 7.4.0", ">= 8.0.0, < 8.2.0"]

[versions]
patched = [">= 8.2.0"]
patched = ["^7.4.0", ">= 8.2.0"]
unaffected = ["< 7.2.2"]
```

Expand Down
6 changes: 3 additions & 3 deletions crates/zstd-safe/RUSTSEC-2026-0399.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,11 +12,11 @@ keywords = ["use-after-free", "lifetime", "dictionary"]
[affected]

[affected.functions]
"zstd_safe::CCtx::init_using_cdict" = [">= 3.0.0, < 8.2.0"]
"zstd_safe::DCtx::init_using_ddict" = [">= 3.0.0, < 8.2.0"]
"zstd_safe::CCtx::init_using_cdict" = [">= 3.0.0, < 7.4.0", ">= 8.0.0, < 8.2.0"]
"zstd_safe::DCtx::init_using_ddict" = [">= 3.0.0, < 7.4.0", ">= 8.0.0, < 8.2.0"]

[versions]
patched = [">= 8.2.0"]
patched = ["^7.4.0", ">= 8.2.0"]
unaffected = ["< 3.0.0"]
```

Expand Down
8 changes: 4 additions & 4 deletions crates/zstd-safe/RUSTSEC-2026-0400.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,12 +12,12 @@ keywords = ["use-after-free", "dictionary"]
[affected]

[affected.functions]
"zstd_safe::DCtx::decompress" = [">= 3.0.1, < 8.2.0"]
"zstd_safe::DCtx::decompress_using_dict" = [">= 3.0.1, < 8.2.0"]
"zstd_safe::DCtx::decompress_using_ddict" = [">= 3.0.1, < 8.2.0"]
"zstd_safe::DCtx::decompress" = [">= 3.0.1, < 7.4.0", ">= 8.0.0, < 8.2.0"]
"zstd_safe::DCtx::decompress_using_dict" = [">= 3.0.1, < 7.4.0", ">= 8.0.0, < 8.2.0"]
"zstd_safe::DCtx::decompress_using_ddict" = [">= 3.0.1, < 7.4.0", ">= 8.0.0, < 8.2.0"]

[versions]
patched = [">= 8.2.0"]
patched = ["^7.4.0", ">= 8.2.0"]
unaffected = ["< 3.0.1"]
```

Expand Down
4 changes: 2 additions & 2 deletions crates/zstd-safe/RUSTSEC-2026-0401.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,10 +12,10 @@ keywords = ["integer-overflow", "out-of-bounds", "dictionary"]
[affected]

[affected.functions]
"zstd_safe::train_from_buffer" = ["< 8.2.0"]
"zstd_safe::train_from_buffer" = ["< 7.4.0", ">= 8.0.0, < 8.2.0"]

[versions]
patched = [">= 8.2.0"]
patched = ["^7.4.0", ">= 8.2.0"]
```

# Out-of-bounds read in `train_from_buffer` when sample sizes overflow
Expand Down
4 changes: 2 additions & 2 deletions crates/zstd-safe/RUSTSEC-2026-0402.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,10 +12,10 @@ keywords = ["buffer-overflow", "experimental", "zstdmt"]
[affected]

[affected.functions]
"zstd_safe::CCtx::try_clone" = [">= 4.1.4, < 8.2.0"]
"zstd_safe::CCtx::try_clone" = [">= 4.1.4, < 7.4.0", ">= 8.0.0, < 8.2.0"]

[versions]
patched = [">= 8.2.0"]
patched = ["^7.4.0", ">= 8.2.0"]
unaffected = ["< 4.1.4"]
```

Expand Down
4 changes: 2 additions & 2 deletions crates/zstd-safe/RUSTSEC-2026-0403.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,10 +11,10 @@ keywords = ["uninitialized-memory", "decompression", "legacy"]
[affected]

[affected.functions]
"zstd_safe::DCtx::decompress_stream" = [">= 4.0.0, < 8.2.0"]
"zstd_safe::DCtx::decompress_stream" = [">= 4.0.0, < 7.4.0", ">= 8.0.0, < 8.2.0"]

[versions]
patched = [">= 8.2.0"]
patched = ["^7.4.0", ">= 8.2.0"]
unaffected = ["< 4.0.0"]
```

Expand Down
4 changes: 2 additions & 2 deletions crates/zstd-safe/RUSTSEC-2026-0404.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,10 +12,10 @@ keywords = ["double-free", "experimental"]
[affected]

[affected.functions]
"zstd_safe::DCtx::try_clone" = [">= 4.1.4, < 8.2.0"]
"zstd_safe::DCtx::try_clone" = [">= 4.1.4, < 7.4.0", ">= 8.0.0, < 8.2.0"]

[versions]
patched = [">= 8.2.0"]
patched = ["^7.4.0", ">= 8.2.0"]
unaffected = ["< 4.1.4"]
```

Expand Down
4 changes: 2 additions & 2 deletions crates/zstd-safe/RUSTSEC-2026-0405.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,10 +12,10 @@ keywords = ["seekable", "out-of-bounds"]
[affected]

[affected.functions]
"zstd_safe::seekable::SeekableCStream::compress_stream" = [">= 7.2.2, < 8.2.0"]
"zstd_safe::seekable::SeekableCStream::compress_stream" = [">= 7.2.2, < 7.4.0", ">= 8.0.0, < 8.2.0"]

[versions]
patched = [">= 8.2.0"]
patched = ["^7.4.0", ">= 8.2.0"]
unaffected = ["< 7.2.2"]
```

Expand Down
16 changes: 8 additions & 8 deletions crates/zstd-safe/RUSTSEC-2026-0406.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,16 +12,16 @@ keywords = ["use-after-free", "zstdmt", "dictionary"]
[affected]

[affected.functions]
"zstd_safe::CCtx::load_dictionary" = ["< 8.2.0"]
"zstd_safe::CCtx::ref_cdict" = ["< 8.2.0"]
"zstd_safe::CCtx::ref_prefix" = ["< 8.2.0"]
"zstd_safe::CCtx::disable_dictionary" = ["< 8.2.0"]
"zstd_safe::CCtx::init" = ["< 8.2.0"]
"zstd_safe::CCtx::reset" = ["< 8.2.0"]
"zstd_safe::CCtx::set_parameter" = ["< 8.2.0"]
"zstd_safe::CCtx::load_dictionary" = ["< 7.4.0", ">= 8.0.0, < 8.2.0"]
"zstd_safe::CCtx::ref_cdict" = ["< 7.4.0", ">= 8.0.0, < 8.2.0"]
"zstd_safe::CCtx::ref_prefix" = ["< 7.4.0", ">= 8.0.0, < 8.2.0"]
"zstd_safe::CCtx::disable_dictionary" = ["< 7.4.0", ">= 8.0.0, < 8.2.0"]
"zstd_safe::CCtx::init" = ["< 7.4.0", ">= 8.0.0, < 8.2.0"]
"zstd_safe::CCtx::reset" = ["< 7.4.0", ">= 8.0.0, < 8.2.0"]
"zstd_safe::CCtx::set_parameter" = ["< 7.4.0", ">= 8.0.0, < 8.2.0"]

[versions]
patched = [">= 8.2.0"]
patched = ["^7.4.0", ">= 8.2.0"]
```

# Use-after-free when changing a multithreaded context with an unfinished frame
Expand Down
6 changes: 3 additions & 3 deletions crates/zstd/RUSTSEC-2026-0391.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,11 +11,11 @@ keywords = ["information-leak", "context-reuse"]
[affected]

[affected.functions]
"zstd::stream::raw::Encoder::with_context" = [">= 0.13.2, < 0.14.3"]
"zstd::stream::raw::Decoder::with_context" = [">= 0.13.2, < 0.14.3"]
"zstd::stream::raw::Encoder::with_context" = [">= 0.13.2, < 0.13.4", ">= 0.14.0, < 0.14.3"]
"zstd::stream::raw::Decoder::with_context" = [">= 0.13.2, < 0.13.4", ">= 0.14.0, < 0.14.3"]

[versions]
patched = [">= 0.14.3"]
patched = ["^0.13.4", ">= 0.14.3"]
unaffected = ["< 0.13.2"]
```

Expand Down
Loading