RUSTSEC-2026-0344: Decompression bomb in `ruzstd`: a tiny input can exhaust memory (OOM)

What to do

1. See which version you have: cargo tree -i ruzstd (it also shows which of your dependencies pulls it in).
2. Update within your version requirement: cargo update -p ruzstd. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for example ruzstd = "0.9.1") or update the dependency that pulls it in.
3. Check again with cargo audit, or paste your Cargo.lock into our Cargo.toml checker.

Details from the advisory

A crafted .zst input under 128 KB can force ruzstd to allocate several gigabytes at once, crashing the process with an out-of-memory condition. Since ruzstd is a decoder for untrusted input, a single small file is enough to take down anything decoding it.

The compressed size of a block was capped at 128 KB, but a compressed block's **decompressed** size was never checked against Block_Maximum_Size = min(Window_Size, 128 KiB) (RFC 8878). In execute_sequences the output was built with no running bound and no flush between blocks, so one block could expand to gigabytes , bypassing both the configured window-size limit and the block-by-block streaming that would otherwise release memory. (A related u32 counter overflow on such a block caused an additional panic.)

This is a denial of service only; memory access stays in bounds (no corruption, no RCE).

ruzstd is also built as a dependency of the Rust standard library via rustc-dep-of-std; in the toolchain it is used only to load zstd-compressed debug symbols, so the toolchain-side impact is limited.

**Fixed in 0.9.1** (commit d3907c9), which enforces the per-block output bound. Upgrade to ruzstd >= 0.9.1.

References

• Package: crates.io/crates/ruzstd
• Advisory: rustsec.org/advisories/RUSTSEC-2026-0344.html
• Web: github.com/KillingSpark/zstd-rs/commit/d3907c960ca4a1aa44cc38340137c5679dd98f5a

From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.

Other advisories for ruzstd

• VulnerabilityRUSTSEC-2024-0400 · 2024-11-28`ruzstd` uninit and out-of-bounds memory reads

Full security history of ruzstd