Product
3 published CVES affecting crates.io zstd, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).
Newest publication first
ZDICT_trainFromBuffer is never told the length of the samples buffer. Before 0.4.10, zstd::dict::from_continuous (initially train_dict) called it directly: up to 0.2.1 without checking the sample sizes against the buffer at all, and from 0.3.0 with a sum that wraps around when ov...
From 0.4.22 to 0.7.x, the writer behind zstd::stream::write::Decoder set its output buffer's length to its full capacity before each decompression call, then to the position the call reported, and only checked for an error afterwards. When decompression fails inside a legacy (zst...
The with_context constructors of the stream encoders and decoders used the borrowed context as it was. When a stream was abandoned on a context, for example an encoder dropped before finish() after an error, whatever it left there was carried into the next stream: the input buffe...
Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.