Stream: git-wasmtime

Topic: wasmtime / issue #15007 RUSTSEC-2026-0395: Use-after-free...

Wasmtime GitHub notifications bot (Oct 27 2026 at 00:13):

github-actions[bot] opened issue #15007:

Use-after-free with CParameter::StableInBuffer

Details
Status	unsound
Package	zstd-safe
Version	5.0.2+zstd.1.5.2
URL	https://github.com/gyscos/zstd-rs/commit/53a8a290d8cfb52ff5b29fb6e04a40b5a174cc65
Date	2026-10-16

With CParameter::StableInBuffer(true) (experimental feature), the C
library keeps a pointer to the input of one streaming call and reads from it
in later calls, including flush_stream and end_stream, which take no
input. An InBuffer only borrows its slice for one call, so safe code could
free it in between, and freed memory was compressed into the frame. The C
library behaves this way since zstd 1.5.4, whether bundled or linked from the
system.

The flaw was corrected by refusing to enable the parameter.

See advisory page for additional details.

Wasmtime GitHub notifications bot (Oct 27 2026 at 02:40):

alexcrichton closed issue #15007:

Use-after-free with CParameter::StableInBuffer

Details
Status	unsound
Package	zstd-safe
Version	5.0.2+zstd.1.5.2
URL	https://github.com/gyscos/zstd-rs/commit/53a8a290d8cfb52ff5b29fb6e04a40b5a174cc65
Date	2026-10-16

With CParameter::StableInBuffer(true) (experimental feature), the C
library keeps a pointer to the input of one streaming call and reads from it
in later calls, including flush_stream and end_stream, which take no
input. An InBuffer only borrows its slice for one call, so safe code could
free it in between, and freed memory was compressed into the frame. The C
library behaves this way since zstd 1.5.4, whether bundled or linked from the
system.

The flaw was corrected by refusing to enable the parameter.

See advisory page for additional details.

Wasmtime GitHub notifications bot (Oct 27 2026 at 02:40):

alexcrichton commented on issue #15007:

https://github.com/bytecodealliance/wasmtime/pull/15003

Last updated: Oct 31 2026 at 23:03 UTC