RUSTSEC-2026-0399 Use-after-free through `init_using_cdict` and `init_using_ddict`
- Exploited in the wild
- Not known
- Fix
- Available
What is RUSTSEC-2026-0399?
RUSTSEC-2026-0399 is a vulnerability in zstd-safe, published on 16 Oct 2026.
Official description
CCtx::init_using_cdict and DCtx::init_using_ddict (experimental
feature, deprecated) took the dictionary as &CDict<'b> and &DDict<'b>
with only 'b: 'a, so the dictionary itself could be dropped while the
context still pointed at it. The same mistake in other constructors was
fixed earlier (<https://github.com/gyscos/zstd-rs/issues/365>).
The flaw was corrected by taking &'a CDict<'b> and &'a DDict<'b>.
Which versions are affected by RUSTSEC-2026-0399?
1 open source package ship an affected version, including zstd-safe.
| Package | Affected | Fixed in |
|---|---|---|
zstd-safe crates.io | From 3.0.0 | 8.2.0 |
How do I fix RUSTSEC-2026-0399?
Upgrade zstd-safe to 8.2.0 or later.
Is RUSTSEC-2026-0399 being exploited?
There is no known exploitation of RUSTSEC-2026-0399 in the wild and no public exploit code.