Stream: git-wasmtime

Topic: wasmtime / issue #15018 RUSTSEC-2026-0401: Out-of-bounds ...

Wasmtime GitHub notifications bot (Oct 27 2026 at 00:13):

github-actions[bot] opened issue #15018:

Out-of-bounds read in train_from_buffer when sample sizes overflow

Details
Status	unsound
Package	zstd-safe
Version	7.0.0
URL	https://github.com/gyscos/zstd-rs/commit/781ea454191dbf178d09c1daf6fc896d15fbaa2f
Date	2026-10-16

ZDICT_trainFromBuffer is never told the length of the samples buffer, so
train_from_buffer checked that the sample sizes add up to it. With
overflow checks off, as in release builds, that sum wrapped around: sizes
totalling 2^64 plus the buffer length passed the check, and the trainer read
past the end of the buffer. zstd::dict::from_continuous relies on this
check from zstd 0.4.10; older versions of zstd had their own, covered by a
separate advisory.

This requires the sample sizes to come from an untrusted source. The flaw
was corrected by summing the sizes with overflow checks.

See advisory page for additional details.

Wasmtime GitHub notifications bot (Oct 27 2026 at 00:39):

pchickey closed issue #15018:

Out-of-bounds read in train_from_buffer when sample sizes overflow

Details
Status	unsound
Package	zstd-safe
Version	7.0.0
URL	https://github.com/gyscos/zstd-rs/commit/781ea454191dbf178d09c1daf6fc896d15fbaa2f
Date	2026-10-16

ZDICT_trainFromBuffer is never told the length of the samples buffer, so
train_from_buffer checked that the sample sizes add up to it. With
overflow checks off, as in release builds, that sum wrapped around: sizes
totalling 2^64 plus the buffer length passed the check, and the trainer read
past the end of the buffer. zstd::dict::from_continuous relies on this
check from zstd 0.4.10; older versions of zstd had their own, covered by a
separate advisory.

This requires the sample sizes to come from an untrusted source. The flaw
was corrected by summing the sizes with overflow checks.

See advisory page for additional details.

Last updated: Oct 31 2026 at 23:03 UTC