RUSTSEC-2026-0041
NoneCVSS
—
EPSS
—
Published
Mar 17, 2026
CISA due date
—
The record
Decompressing invalid data can leak information from uninitialized memory or reused output buffer
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| crates.io | lz4_flex | 0 | 0.11.6 |
| crates.io | lz4_flex | 0.0.0-0 | 0.11.6 |
| crates.io | lz4_flex | 0.12.0 | 0.12.1 |