Reported

October 16, 2026

Issued

October 26, 2026

Package

zstd-safe (crates.io)

Type

INFO Unsound

Categories

• memory-exposure

Keywords

#use-after-free #experimental

References

• https://github.com/gyscos/zstd-rs/commit/53a8a290d8cfb52ff5b29fb6e04a40b5a174cc65
• https://github.com/gyscos/zstd-rs/pull/384

Patched

• >=8.2.0

Unaffected

• <4.1.0

Affected Functions

Version

zstd_safe::CCtx::set_parameter

• >=4.1.0, <8.2.0

Description

With CParameter::StableInBuffer(true) (experimental feature), the C library keeps a pointer to the input of one streaming call and reads from it in later calls, including flush_stream and end_stream, which take no input. An InBuffer only borrows its slice for one call, so safe code could free it in between, and freed memory was compressed into the frame. The C library behaves this way since zstd 1.5.4, whether bundled or linked from the system.

The flaw was corrected by refusing to enable the parameter.

Advisory available under CC0-1.0 license.