Stream: git-wasmtime

Topic: wasmtime / issue #15013 RUSTSEC-2026-0399: Use-after-free...

view this post on Zulip Wasmtime GitHub notifications bot (Oct 27 2026 at 00:13):

github-actions[bot] opened issue #15013:

Use-after-free through init_using_cdict and init_using_ddict

Details
Status unsound
Package zstd-safe
Version 5.0.2+zstd.1.5.2
URL https://github.com/gyscos/zstd-rs/commit/e00e7928e3e98953fc43418af6d73f6aae2378fb
Date 2026-10-16

CCtx::init_using_cdict and DCtx::init_using_ddict (experimental
feature, deprecated) took the dictionary as &CDict<'b> and &DDict<'b>
with only 'b: 'a, so the dictionary itself could be dropped while the
context still pointed at it. The same mistake in other constructors was
fixed earlier (<https://github.com/gyscos/zstd-rs/issues/365>).

The flaw was corrected by taking &amp;&#39;a CDict&lt;&#39;b&gt; and &amp;&#39;a DDict&lt;&#39;b&gt;.

See advisory page for additional details.

view this post on Zulip Wasmtime GitHub notifications bot (Oct 27 2026 at 00:39):

pchickey closed issue #15013:

Use-after-free through init_using_cdict and init_using_ddict

Details
Status unsound
Package zstd-safe
Version 5.0.2+zstd.1.5.2
URL https://github.com/gyscos/zstd-rs/commit/e00e7928e3e98953fc43418af6d73f6aae2378fb
Date 2026-10-16

CCtx::init_using_cdict and DCtx::init_using_ddict (experimental
feature, deprecated) took the dictionary as &amp;CDict&lt;&#39;b&gt; and &amp;DDict&lt;&#39;b&gt;
with only &#39;b: &#39;a, so the dictionary itself could be dropped while the
context still pointed at it. The same mistake in other constructors was
fixed earlier (<https://github.com/gyscos/zstd-rs/issues/365>).

The flaw was corrected by taking &amp;&#39;a CDict&lt;&#39;b&gt; and &amp;&#39;a DDict&lt;&#39;b&gt;.

See advisory page for additional details.

Last updated: Oct 31 2026 at 23:03 UTC