object: unbounded allocation in Zstd-compressed section decompression

crates/object/RUSTSEC-0000-0000.md

@@ -0,0 +1,37 @@
+```toml
+[advisory]
+id = "RUSTSEC-0000-0000"
+package = "object"
+date = "2026-07-18"
+url = "https://github.com/gimli-rs/object/issues/950"
+references = ["https://github.com/gimli-rs/object/pull/961"]
+categories = ["denial-of-service"]
+keywords = ["zstd", "decompression", "allocation", "elf"]
+
+[affected]
+
+[affected.functions]
+"object::read::CompressedData::decompress" = [">= 0.31.0, < 0.40.0"]
+
+[versions]
+patched = [">= 0.40.0"]
+unaffected = ["< 0.31.0"]
+```
+
+# Unbounded allocation when decompressing a crafted Zstandard-compressed ELF section
+
+Affected versions of `object` decompress Zstandard-compressed ELF sections without
+limiting output to the section's declared uncompressed size.
+
+`object::read::CompressedData::decompress` first reserves the declared `ch_size`, but
+the Zstandard branch then grows the output buffer to the actual decoded length. The
+size check runs only after decompression has completed.
+
+This can cause excessive memory allocation when a crafted ELF file contains an
+`SHF_COMPRESSED` section with a small declared `ch_size` and a Zstandard stream
+that expands to a much larger output. The issue is reachable through
+`Section::uncompressed_data()` when the `compression` feature is enabled.
+
+The flaw was corrected in `0.40.0` by using
+`ruzstd::FrameDecoder::decode_all_to_vec`, which bounds Zstandard decompression
+to the declared uncompressed size.