zstd-safe 8.1.0
PkgFire would install this release with a warning.·Checked 13 hours ago·Published 9 October 2026
Why
-
warnVulnerability
Use-after-free with `CParameter::StableInBuffer` (fixed in 8.2.0)
-
warnVulnerability
`Seekable` reads a NULL or out-of-bounds seek table (fixed in 8.2.0)
-
warnVulnerability
`OutBuffer::around_pos` exposes uninitialized memory (fixed in 8.2.0)
-
warnVulnerability
`Seekable::decompress` sets a `Vec` length beyond its capacity for offsets past the end (fixed in 8.2.0)
-
warnVulnerability
Use-after-free through `init_using_cdict` and `init_using_ddict` (fixed in 8.2.0)
-
warnVulnerability
Use-after-free of a dictionary after a one-shot call on a context with an open stream (fixed in 8.2.0)
-
warnVulnerability
Out-of-bounds read in `train_from_buffer` when sample sizes overflow (fixed in 8.2.0)
-
warnVulnerability
Heap buffer overflow in `CCtx::try_clone` on a multithreaded context (fixed in 8.2.0)
-
warnVulnerability
Uninitialized memory exposed when streaming decompression of a legacy frame fails (fixed in 8.2.0)
-
warnVulnerability
Double free in `DCtx::try_clone` (fixed in 8.2.0)
-
warnVulnerability
Out-of-bounds read with an out-of-range `InBuffer::pos` (fixed in 8.2.0)
-
warnVulnerability
Use-after-free when changing a multithreaded context with an unfinished frame (fixed in 8.2.0)
Licence and upkeep
- Licence
- BSD-3-Clause
- Source
- github.com/gyscos/zstd-rs ↗
- OpenSSF Scorecard
- 4.7 / 10
Other checked releases
Check every dependency before it installs
This page is one release. PkgFire checks every package in your lockfile, on every install and in every pull request, and blocks the bad ones before they run.