Skip to content

chore(deps): bump ruzstd to 0.9.1 - #2048

Merged
jsturtevant merged 1 commit into
hyperlight-dev:mainfrom
jsturtevant:bump/ruzstd-0.9.1
Nov 12, 2026
Merged

jsturtevant merged 1 commit into
hyperlight-dev:mainfrom
jsturtevant:bump/ruzstd-0.9.1

Conversation

@jsturtevant

@jsturtevant jsturtevant commented Nov 11, 2026 •

Copy link
Copy Markdown
Contributor

Bump ruzstd to 0.9.1 to fix the decompression memory-exhaustion vulnerability.

Fixes #1982.

@jsturtevant jsturtevant added the A-security Involves security-related changes or fixes label Nov 11, 2026
@jsturtevant
jsturtevant requested a review from dblnz as a code owner November 11, 2026 18:40
@jsturtevant jsturtevant added the C-deps For PRs that update dependencies or related components label Nov 11, 2026
@jsturtevant jsturtevant added the S-needs-review PR is ready for (re-)review label Nov 11, 2026
Copilot AI balanced review requested due to automatic review settings November 11, 2026 18:40

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot wasn't able to review any files in this pull request. Check if the Files changed in this pull request are included in default exclusions.

@hyperlight-gh-bot

This comment has been minimized.

Signed-off-by: James Sturtevant <jsturtevant@gmail.com>
@hyperlight-gh-bot

Copy link
Copy Markdown

Benchmark Results

Measured commit: da1c4d979f23
Baseline commit: 90ca0f235813

kvm / amd (Linux) (➖ stable)

No benchmark improved or regressed.

Benchmark Results

function_call_codec

encode_control decode_vec_bytes_copy
byte_chunks 774.38 ns (➖ 1.02x slower)
vec_bytes 574.80 ns (➖ 1.01x faster)
373.48 µs (➖ 1.01x faster)

payload_allocation

slot_pool_segmented
262144 520.72 ns (➖ 1.17x faster)
65536 142.07 ns (➖ 1.00x slower)

sandboxes

create_initialized_and_drop
medium 13.52 ms (➖ 1.02x slower)

slot_pool

alloc_dealloc_128 alloc_dealloc_4096 alloc_dealloc_1500
7.68 ns (➖ 1.01x faster) 7.68 ns (➖ 1.00x faster) 7.68 ns (➖ 1.00x faster)

snapshot_files

load_snapshot_unverified
small 99.84 µs (➖ 1.02x slower)

virtq_readonly

slot_pool_segmented slot_pool_segmented_fragmented
262144 7.30 µs (➖ 1.02x slower) 7.02 µs (➖ 1.01x faster)
65536 1.90 µs (➖ 1.09x faster) 2.04 µs (➖ 1.07x slower)

virtq_readwrite

slot_pool_segmented slot_pool_segmented_fragmented
262144 27.13 µs (➖ 1.00x faster)
65536 6.19 µs (➖ 1.05x faster) 6.48 µs (➖ 1.21x faster)
8192 1.10 µs (➖ 1.03x slower) 1.05 µs (➖ 1.02x slower)
kvm / intel (Linux) (➖ stable)

No benchmark improved or regressed.

Benchmark Results

function_call_codec

encode_control decode_vec_bytes_copy
byte_chunks 823.89 ns (➖ 1.01x slower)
vec_bytes 608.04 ns (➖ 1.01x faster)
776.54 µs (➖ 1.01x slower)

payload_allocation

slot_pool_segmented
262144 603.42 ns (➖ 1.01x slower)
65536 205.78 ns (➖ 1.00x faster)

sandboxes

create_initialized_and_drop
medium 14.63 ms (➖ 1.02x slower)

slot_pool

alloc_dealloc_128 alloc_dealloc_4096 alloc_dealloc_1500
8.14 ns (➖ 1.00x faster) 8.13 ns (➖ 1.00x faster) 8.16 ns (➖ 1.00x faster)

snapshot_files

load_snapshot_unverified
small 57.83 µs (➖ 1.05x faster)

virtq_readonly

slot_pool_segmented slot_pool_segmented_fragmented
262144 9.04 µs (➖ 1.00x faster) 9.05 µs (➖ 1.01x slower)
65536 2.54 µs (➖ 1.00x slower) 2.55 µs (➖ 1.00x faster)

virtq_readwrite

slot_pool_segmented slot_pool_segmented_fragmented
262144 35.50 µs (➖ 1.02x faster)
65536 8.40 µs (➖ 1.02x faster) 8.47 µs (➖ 1.01x faster)
8192 865.86 ns (➖ 1.03x slower) 871.25 ns (➖ 1.00x faster)
mshv3 / amd (Linux) (➖ stable)

No benchmark improved or regressed.

Benchmark Results

function_call_codec

encode_control decode_vec_bytes_copy
byte_chunks 943.64 ns (➖ 1.00x faster)
vec_bytes 716.64 ns (➖ 1.02x faster)
350.45 µs (➖ 1.03x slower)

payload_allocation

slot_pool_segmented
262144 729.98 ns (➖ 1.00x slower)
65536 197.84 ns (➖ 1.01x faster)

sandboxes

create_initialized_and_drop
medium 61.20 ms (➖ 1.04x faster)

slot_pool

alloc_dealloc_128 alloc_dealloc_4096 alloc_dealloc_1500
9.51 ns (➖ 1.00x faster) 9.52 ns (➖ 1.00x faster) 9.97 ns (➖ 1.02x slower)

snapshot_files

load_snapshot_unverified
small 106.52 µs (➖ 1.05x faster)

virtq_readonly

slot_pool_segmented slot_pool_segmented_fragmented
262144 10.06 µs (➖ 1.04x slower) 10.22 µs (➖ 1.02x faster)
65536 2.27 µs (➖ 1.03x slower) 2.41 µs (➖ 1.01x faster)

virtq_readwrite

slot_pool_segmented slot_pool_segmented_fragmented
262144 36.03 µs (➖ 1.08x faster)
65536 8.43 µs (➖ 1.18x faster) 8.23 µs (➖ 1.19x faster)
8192 1.24 µs (➖ 1.01x faster) 1.24 µs (➖ 1.05x faster)
mshv3 / intel (Linux) (➖ stable)

No benchmark improved or regressed.

Benchmark Results

function_call_codec

encode_control decode_vec_bytes_copy
byte_chunks 930.21 ns (➖ 1.01x faster)
vec_bytes 662.71 ns (➖ 1.02x faster)
669.86 µs (➖ 1.03x faster)

payload_allocation

slot_pool_segmented
262144 855.70 ns (➖ 1.30x slower)
65536 252.07 ns (➖ 1.04x faster)

sandboxes

create_initialized_and_drop
medium 53.08 ms (➖ 1.57x faster)

slot_pool

alloc_dealloc_128 alloc_dealloc_4096 alloc_dealloc_1500
11.18 ns (➖ 1.28x slower) 8.76 ns (➖ 1.00x slower) 8.77 ns (➖ 1.01x slower)

snapshot_files

load_snapshot_unverified
small 55.94 µs (➖ 1.04x faster)

virtq_readonly

slot_pool_segmented slot_pool_segmented_fragmented
262144 8.08 µs (➖ 1.02x slower) 8.02 µs (➖ 1.00x faster)
65536 2.30 µs (➖ 1.01x slower) 2.30 µs (➖ 1.00x slower)

virtq_readwrite

slot_pool_segmented slot_pool_segmented_fragmented
262144 38.75 µs (➖ 1.11x faster)
65536 7.52 µs (➖ 1.00x faster) 7.48 µs (➖ 1.01x faster)
8192 910.58 ns (➖ 1.01x faster) 912.33 ns (➖ 1.00x slower)
hyperv-ws2025 / amd (Windows) (➖ stable)

No benchmark improved or regressed.

Benchmark Results

function_call_codec

encode_control decode_vec_bytes_copy
byte_chunks 1.19 µs (➖ 1.01x faster)
vec_bytes 773.88 ns (➖ 1.02x slower)
2.26 ms (➖ 1.02x slower)

payload_allocation

slot_pool_segmented
262144 788.92 ns (➖ 1.00x slower)
65536 229.67 ns (➖ 1.01x faster)

sandboxes

create_initialized_and_drop
medium 13.26 ms (➖ 1.01x slower)

slot_pool

alloc_dealloc_128 alloc_dealloc_4096 alloc_dealloc_1500
9.99 ns (➖ 1.01x faster) 10.62 ns (➖ 1.06x slower) 11.14 ns (➖ 1.13x slower)

snapshot_files

load_snapshot_unverified
small 942.16 µs (➖ 1.02x faster)

virtq_readonly

slot_pool_segmented slot_pool_segmented_fragmented
262144 9.00 µs (➖ 1.03x faster) 9.03 µs (➖ 1.04x faster)
65536 2.40 µs (➖ 1.03x slower) 2.32 µs (➖ 1.06x faster)

virtq_readwrite

slot_pool_segmented slot_pool_segmented_fragmented
262144 40.73 µs (➖ 1.06x slower)
65536 8.77 µs (➖ 1.00x slower) 9.05 µs (➖ 1.02x slower)
8192 1.22 µs (➖ 1.10x faster) 1.26 µs (➖ 1.03x faster)
hyperv-ws2025 / intel (Windows) (➖ stable)

No benchmark improved or regressed.

Benchmark Results

function_call_codec

encode_control decode_vec_bytes_copy
byte_chunks 1.20 µs (➖ 1.00x faster)
vec_bytes 827.06 ns (➖ 1.01x faster)
3.12 ms (➖ 1.04x slower)

payload_allocation

slot_pool_segmented
262144 737.24 ns (➖ 1.00x slower)
65536 211.51 ns (➖ 1.02x slower)

sandboxes

create_initialized_and_drop
medium 13.42 ms (➖ 1.05x faster)

slot_pool

alloc_dealloc_128 alloc_dealloc_4096 alloc_dealloc_1500
9.64 ns (➖ 1.00x faster) 9.90 ns (➖ 1.10x faster) 9.71 ns (➖ 1.01x slower)

snapshot_files

load_snapshot_unverified
small 677.53 µs (➖ 1.02x slower)

virtq_readonly

slot_pool_segmented slot_pool_segmented_fragmented
262144 7.91 µs (➖ 1.01x slower) 7.67 µs (➖ 1.04x faster)
65536 2.38 µs (➖ 1.05x faster) 2.32 µs (➖ 1.01x slower)

virtq_readwrite

slot_pool_segmented slot_pool_segmented_fragmented
262144 41.83 µs (➖ 1.01x slower)
65536 8.33 µs (➖ 1.10x faster) 8.80 µs (➖ 1.04x slower)
8192 1.08 µs (➖ 1.02x faster) 1.16 µs (➖ 1.05x slower)

Reported by cargo ci bench-report --candidate run:43089333873 --config-file bench_report.toml.

@ludfjig ludfjig left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

thanks

@jsturtevant
jsturtevant merged commit 2be5540 into hyperlight-dev:main Nov 12, 2026
119 of 121 checks passed
@github-actions github-actions Bot removed the S-needs-review PR is ready for (re-)review label Nov 12, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

A-security Involves security-related changes or fixes C-deps For PRs that update dependencies or related components

Projects

None yet

Development

Successfully merging this pull request may close these issues.

RUSTSEC-2026-0344: Decompression bomb in ruzstd: a tiny input can exhaust memory (OOM)

3 participants