RUSTSEC-2026-0395: Use-after-free with CParameter::StableInBuffer #67

Use-after-free with CParameter::StableInBuffer

With CParameter::StableInBuffer(true) (experimental feature), the C
library keeps a pointer to the input of one streaming call and reads from it
in later calls, including flush_stream and end_stream, which take no
input. An InBuffer only borrows its slice for one call, so safe code could
free it in between, and freed memory was compressed into the frame. The C
library behaves this way since zstd 1.5.4, whether bundled or linked from the
system.

The flaw was corrected by refusing to enable the parameter.

See advisory page for additional details.