Reported

October 16, 2026

Issued

October 26, 2026

Package

zstd-safe (crates.io)

Type

INFO Unsound

Categories

• memory-corruption

Keywords

#use-after-free #lifetime #dictionary

References

• https://github.com/gyscos/zstd-rs/commit/e00e7928e3e98953fc43418af6d73f6aae2378fb
• https://github.com/gyscos/zstd-rs/pull/384

Patched

• >=8.2.0

Unaffected

• <3.0.0

Affected Functions

Version

zstd_safe::CCtx::init_using_cdict

• >=3.0.0, <8.2.0

zstd_safe::DCtx::init_using_ddict

• >=3.0.0, <8.2.0

Description

CCtx::init_using_cdict and DCtx::init_using_ddict (experimental feature, deprecated) took the dictionary as &CDict<'b> and &DDict<'b> with only 'b: 'a, so the dictionary itself could be dropped while the context still pointed at it. The same mistake in other constructors was fixed earlier (https://github.com/gyscos/zstd-rs/issues/365).

The flaw was corrected by taking &'a CDict<'b> and &'a DDict<'b>.

Advisory available under CC0-1.0 license.