Wasmtime GitHub notifications bot (Oct 27 2026 at 00:13): Wasmtime GitHub notifications bot (Oct 27 2026 at 00:13):github-actions[bot] opened issue #15008:
OutBuffer::around_posexposes uninitialized memory
Details Status unsound Package zstd-safeVersion 5.0.2+zstd.1.5.2URL https://github.com/gyscos/zstd-rs/commit/5827de2459b8ac430e87e860f00c7f3c13023833 Date 2026-10-16
OutBuffer::around_posaccepted a position past the initialized length of a
Vec<u8>. The next streaming call then marked everything before the
position as initialized, so safe code could read stale heap memory between
the vector's previous length and that position.The flaw was corrected by zero-filling that gap.
See advisory page for additional details.
Wasmtime GitHub notifications bot (Oct 27 2026 at 00:39):pchickey closed issue #15008:
OutBuffer::around_posexposes uninitialized memory
Details Status unsound Package zstd-safeVersion 5.0.2+zstd.1.5.2URL https://github.com/gyscos/zstd-rs/commit/5827de2459b8ac430e87e860f00c7f3c13023833 Date 2026-10-16
OutBuffer::around_posaccepted a position past the initialized length of a
Vec<u8>. The next streaming call then marked everything before the
position as initialized, so safe code could read stale heap memory between
the vector's previous length and that position.The flaw was corrected by zero-filling that gap.
See advisory page for additional details.
Last updated: Oct 31 2026 at 23:03 UTC