Reported

October 16, 2026

Issued

October 26, 2026

Package

zstd-safe (crates.io)

Type

INFO Unsound

Categories

• memory-corruption

Keywords

#double-free #experimental

References

• https://github.com/gyscos/zstd-rs/commit/cee6529b553ec600a8e152aaca15a91598820ecf
• https://github.com/gyscos/zstd-rs/pull/384

Patched

• >=8.2.0

Unaffected

• <4.1.4

Affected Functions

Version

zstd_safe::DCtx::try_clone

• >=4.1.4, <8.2.0

Description

DCtx::try_clone (experimental feature, deprecated) is a plain copy of the C context. A context owning a dictionary (from load_dictionary, ref_prefix or init_using_dict) or a dictionary table (ref_ddict with RefMultipleDDicts) ended up with both copies freeing it. A context cloned mid-frame resumed on uninitialized stream state. The clone also silently lost the WindowLogMax limit.

The flaw was corrected by refusing to clone such contexts, and by carrying over the parameters the copy leaves out.

Advisory available under CC0-1.0 license.