Stream: git-wasmtime

Topic: wasmtime / issue #15015 RUSTSEC-2026-0404: Double free in...

view this post on Zulip Wasmtime GitHub notifications bot (Oct 27 2026 at 00:13):

github-actions[bot] opened issue #15015:

Double free in DCtx::try_clone

Details
Status unsound
Package zstd-safe
Version 7.0.0
URL https://github.com/gyscos/zstd-rs/commit/cee6529b553ec600a8e152aaca15a91598820ecf
Date 2026-10-16

DCtx::try_clone (experimental feature, deprecated) is a plain copy of the
C context. A context owning a dictionary (from load_dictionary,
ref_prefix or init_using_dict) or a dictionary table (ref_ddict with
RefMultipleDDicts) ended up with both copies freeing it. A context cloned
mid-frame resumed on uninitialized stream state. The clone also silently lost
the WindowLogMax limit.

The flaw was corrected by refusing to clone such contexts, and by carrying
over the parameters the copy leaves out.

See advisory page for additional details.

view this post on Zulip Wasmtime GitHub notifications bot (Oct 27 2026 at 00:39):

pchickey closed issue #15015:

Double free in DCtx::try_clone

Details
Status unsound
Package zstd-safe
Version 7.0.0
URL https://github.com/gyscos/zstd-rs/commit/cee6529b553ec600a8e152aaca15a91598820ecf
Date 2026-10-16

DCtx::try_clone (experimental feature, deprecated) is a plain copy of the
C context. A context owning a dictionary (from load_dictionary,
ref_prefix or init_using_dict) or a dictionary table (ref_ddict with
RefMultipleDDicts) ended up with both copies freeing it. A context cloned
mid-frame resumed on uninitialized stream state. The clone also silently lost
the WindowLogMax limit.

The flaw was corrected by refusing to clone such contexts, and by carrying
over the parameters the copy leaves out.

See advisory page for additional details.

Last updated: Oct 31 2026 at 23:03 UTC