github-actions[bot] opened a new issue, #3544: URL: https://github.com/apache/iceberg-rust/issues/3544
> `OutBuffer::around_pos` exposes uninitialized memory | Details | | | ------------------- | ---------------------------------------------- | | Status | unsound | | Package | `zstd-safe` | | Version | `7.2.4` | | URL | [https://github.com/gyscos/zstd-rs/commit/5827de2459b8ac430e87e860f00c7f3c13023833](https://github.com/gyscos/zstd-rs/commit/5827de2459b8ac430e87e860f00c7f3c13023833) | | Date | 2026-10-16 | `OutBuffer::around_pos` accepted a position past the initialized length of a `Vec<u8>`. The next streaming call then marked everything before the position as initialized, so safe code could read stale heap memory between the vector's previous length and that position. The flaw was corrected by zero-filling that gap. See [advisory page](https://rustsec.org/advisories/RUSTSEC-2026-0397.html) for additional details. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
