object: unbounded allocation in Zstd-compressed section decompression

[scadastrangelove]

Affected crate(s)

• object

Links to upstream issue(s) or PR(s)

• Upstream issue: Zstandard-compressed section decodes past the declared size (unbounded allocation / OOM) gimli-rs/object#950
• Fix PR: Use ruzstd::FrameDecoder::decode_all_to_vec gimli-rs/object#961
• Patched release: object 0.40.0, released 2026-08-01

Severity

Denial of service / resource exhaustion. A crafted ELF file with a small
compressed-section size but a Zstandard stream that expands much larger can
cause excessive allocation through Section::uncompressed_data() when the
compression feature is enabled.

Affected versions: >= 0.31.0, < 0.40.0. Zstandard support was added in
0.31.0; the issue was fixed in 0.40.0.

Checklist

• Advisory filename(s) starts with RUSTSEC-0000-0000 as the ID
• date field is set to the public disclosure date
• Contains a concise and descriptive title after advisory metadata
• Asked maintainer(s) if publishing an advisory is appropriate

[djc]

You didn't use the PR template... did you get approval from the maintainer(s) to submit an advisory?

[scadastrangelove]

Thanks, you are right — I missed the PR template. I have updated the PR body to match it and pushed a follow-up commit that makes the advisory front matter follow the README template more closely.

On maintainer approval: the issue was reported publicly upstream and fixed by the maintainer in gimli-rs/object#961, but I have not separately asked whether they want a RustSec advisory published.

[djc]

On maintainer approval: the issue was reported publicly upstream and fixed by the maintainer in gimli-rs/object#961, but I have not separately asked whether they want a RustSec advisory published.

Please do.