crates.io PACKAGE

zstd-safe 8.1.0

Warn

PkgFire would install this release with a warning.·Checked 13 hours ago·Published 9 October 2026

crates.io

Why

  • warnVulnerability

    Use-after-free with `CParameter::StableInBuffer` (fixed in 8.2.0)

  • warnVulnerability

    `Seekable` reads a NULL or out-of-bounds seek table (fixed in 8.2.0)

  • warnVulnerability

    `OutBuffer::around_pos` exposes uninitialized memory (fixed in 8.2.0)

  • warnVulnerability

    `Seekable::decompress` sets a `Vec` length beyond its capacity for offsets past the end (fixed in 8.2.0)

  • warnVulnerability

    Use-after-free through `init_using_cdict` and `init_using_ddict` (fixed in 8.2.0)

  • warnVulnerability

    Use-after-free of a dictionary after a one-shot call on a context with an open stream (fixed in 8.2.0)

  • warnVulnerability

    Out-of-bounds read in `train_from_buffer` when sample sizes overflow (fixed in 8.2.0)

  • warnVulnerability

    Heap buffer overflow in `CCtx::try_clone` on a multithreaded context (fixed in 8.2.0)

  • warnVulnerability

    Uninitialized memory exposed when streaming decompression of a legacy frame fails (fixed in 8.2.0)

  • warnVulnerability

    Double free in `DCtx::try_clone` (fixed in 8.2.0)

  • warnVulnerability

    Out-of-bounds read with an out-of-range `InBuffer::pos` (fixed in 8.2.0)

  • warnVulnerability

    Use-after-free when changing a multithreaded context with an unfinished frame (fixed in 8.2.0)

Licence and upkeep

Licence
BSD-3-Clause
Source
github.com/gyscos/zstd-rs ↗
OpenSSF Scorecard
4.7 / 10

Other checked releases

Check every dependency before it installs

This page is one release. PkgFire checks every package in your lockfile, on every install and in every pull request, and blocks the bad ones before they run.