RUSTSEC-2026-0404 Double free in `DCtx::try_clone`
- Exploited in the wild
- Not known
- Fix
- Available
What is RUSTSEC-2026-0404?
RUSTSEC-2026-0404 is a vulnerability in zstd-safe, published on 16 Oct 2026.
Official description
DCtx::try_clone (experimental feature, deprecated) is a plain copy of the
C context. A context owning a dictionary (from load_dictionary,
ref_prefix or init_using_dict) or a dictionary table (ref_ddict with
RefMultipleDDicts) ended up with both copies freeing it. A context cloned
mid-frame resumed on uninitialized stream state. The clone also silently lost
the WindowLogMax limit.
The flaw was corrected by refusing to clone such contexts, and by carrying over the parameters the copy leaves out.
Which versions are affected by RUSTSEC-2026-0404?
1 open source package ship an affected version, including zstd-safe.
| Package | Affected | Fixed in |
|---|---|---|
zstd-safe crates.io | From 4.1.4 | 8.2.0 |
How do I fix RUSTSEC-2026-0404?
Upgrade zstd-safe to 8.2.0 or later.
Is RUSTSEC-2026-0404 being exploited?
There is no known exploitation of RUSTSEC-2026-0404 in the wild and no public exploit code.