Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
14 vulnerabilities by luben
CVE-2026-89046 (GCVE-0-2026-89046)
Vulnerability from nvd – Published: 2026-09-10 17:39 – Updated: 2026-09-10 18:10
VLAI
EPSS
VEX
Title
zstd-jni 1.5.5-6 through 1.5.7-13 Out-of-Bounds Read via Negative Offset
Summary
zstd-jni versions 1.5.5-6 through 1.5.7-13 contain an out-of-bounds read vulnerability in Zstd.getFrameContentSize that fails to validate negative srcPosition arguments. Attackers can supply negative offset values that bypass bounds checks and reach the native frame-header parser, causing out-of-bounds memory reads that lead to information disclosure or JVM crashes.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-10 18:07 UTC
CWE
- CWE-125 - Out-of-bounds Read
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/luben/zstd-jni/security/adviso… | vendor-advisory |
| https://github.com/luben/zstd-jni/commit/dd08685e… | patch |
| https://github.com/luben/zstd-jni/blob/v1.5.7-13/… | technical-description |
| https://github.com/luben/zstd-jni/blob/v1.5.7-13/… | technical-description |
| https://github.com/luben/zstd-jni/releases/tag/v1… | release-notes |
| https://github.com/luben/zstd-jni | product |
| https://www.vulncheck.com/advisories/zstd-jni-1.5… | third-party-advisory |
Impacted products
Date Public
2026-08-14 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-89046",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-10T18:07:52.440977Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T18:10:40.912Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/luben/zstd-jni/security/advisories/GHSA-rm53-6wf5-f34m"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo1.maven.org/maven2/com/github/luben/zstd-jni/",
"defaultStatus": "unaffected",
"packageURL": "pkg:maven/com.github.luben/zstd-jni",
"product": "zstd-jni",
"repo": "https://github.com/luben/zstd-jni",
"vendor": "luben",
"versions": [
{
"lessThan": "1.5.7-14",
"status": "affected",
"version": "1.5.5-6",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Yu Bao, PayPal Cyber Security Team"
}
],
"datePublic": "2026-08-14T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "zstd-jni versions 1.5.5-6 through 1.5.7-13 contain an out-of-bounds read vulnerability in Zstd.getFrameContentSize that fails to validate negative srcPosition arguments. Attackers can supply negative offset values that bypass bounds checks and reach the native frame-header parser, causing out-of-bounds memory reads that lead to information disclosure or JVM crashes."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T17:39:35.519Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-rm53-6wf5-f34m)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/luben/zstd-jni/security/advisories/GHSA-rm53-6wf5-f34m"
},
{
"name": "Fix commit: reject a negative source position and size",
"tags": [
"patch"
],
"url": "https://github.com/luben/zstd-jni/commit/dd08685ef913a32e76fb27f43470035c06758646"
},
{
"name": "Upper-bound-only bounds check at v1.5.7-13",
"tags": [
"technical-description"
],
"url": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/Zstd.java#L730"
},
{
"name": "Native routine that offsets the critical array pointer without re-validating",
"tags": [
"technical-description"
],
"url": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/native/jni_zstd.c#L87"
},
{
"name": "zstd-jni v1.5.7-14 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14"
},
{
"name": "luben/zstd-jni",
"tags": [
"product"
],
"url": "https://github.com/luben/zstd-jni"
},
{
"name": "VulnCheck Advisory: zstd-jni 1.5.5-6 through 1.5.7-13 Out-of-Bounds Read via Negative Offset",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/zstd-jni-1.5.5-6-through-1.5.7-13-out-of-bounds-read-via-negative-offset"
}
],
"title": "zstd-jni 1.5.5-6 through 1.5.7-13 Out-of-Bounds Read via Negative Offset",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-89046",
"datePublished": "2026-09-10T17:39:35.519Z",
"dateReserved": "2026-09-10T16:45:23.295Z",
"dateUpdated": "2026-09-10T18:10:40.912Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-89045 (GCVE-0-2026-89045)
Vulnerability from nvd – Published: 2026-09-10 17:39 – Updated: 2026-09-10 17:39
VLAI
EPSS
VEX
Title
zstd-jni 1.4.8-4 through 1.5.7-13 Denial of Service via Negative Length
Summary
zstd-jni versions 1.4.8-4 through 1.5.7-13 fail to validate negative length parameters in ZstdInputStreamNoFinalizer.read(), allowing attackers to trigger infinite loops. Attackers can pass negative length values to cause the read method to spin indefinitely while holding the stream monitor, blocking all other threads from accessing the stream.
Severity
CWE
- CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/luben/zstd-jni/security/adviso… | vendor-advisory |
| https://github.com/luben/zstd-jni/commit/dd08685e… | patch |
| https://github.com/luben/zstd-jni/blob/v1.5.7-13/… | technical-description |
| https://github.com/luben/zstd-jni/releases/tag/v1… | release-notes |
| https://github.com/luben/zstd-jni | product |
| https://www.vulncheck.com/advisories/zstd-jni-1.4… | third-party-advisory |
Impacted products
Date Public
2026-08-14 00:00
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://repo1.maven.org/maven2/com/github/luben/zstd-jni/",
"defaultStatus": "unaffected",
"packageURL": "pkg:maven/com.github.luben/zstd-jni",
"product": "zstd-jni",
"repo": "https://github.com/luben/zstd-jni",
"vendor": "luben",
"versions": [
{
"lessThan": "1.5.7-14",
"status": "affected",
"version": "1.4.8-4",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Yu Bao, PayPal Cyber Security Team"
}
],
"datePublic": "2026-08-14T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "zstd-jni versions 1.4.8-4 through 1.5.7-13 fail to validate negative length parameters in ZstdInputStreamNoFinalizer.read(), allowing attackers to trigger infinite loops. Attackers can pass negative length values to cause the read method to spin indefinitely while holding the stream monitor, blocking all other threads from accessing the stream."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-835",
"description": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T17:39:34.866Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-9jx2-gfp9-phfm)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/luben/zstd-jni/security/advisories/GHSA-9jx2-gfp9-phfm"
},
{
"name": "Fix commit: reject a negative length in read and readInternal",
"tags": [
"patch"
],
"url": "https://github.com/luben/zstd-jni/commit/dd08685ef913a32e76fb27f43470035c06758646"
},
{
"name": "Guard that never checks a negative length at v1.5.7-13",
"tags": [
"technical-description"
],
"url": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/ZstdInputStreamNoFinalizer.java#L133"
},
{
"name": "zstd-jni v1.5.7-14 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14"
},
{
"name": "luben/zstd-jni",
"tags": [
"product"
],
"url": "https://github.com/luben/zstd-jni"
},
{
"name": "VulnCheck Advisory: zstd-jni 1.4.8-4 through 1.5.7-13 Denial of Service via Negative Length",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/zstd-jni-1.4.8-4-through-1.5.7-13-denial-of-service-via-negative-length"
}
],
"title": "zstd-jni 1.4.8-4 through 1.5.7-13 Denial of Service via Negative Length",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-89045",
"datePublished": "2026-09-10T17:39:34.866Z",
"dateReserved": "2026-09-10T16:45:18.503Z",
"dateUpdated": "2026-09-10T17:39:34.866Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-87877 (GCVE-0-2026-87877)
Vulnerability from nvd – Published: 2026-09-09 14:32 – Updated: 2026-09-09 15:57
VLAI
EPSS
VEX
Title
zstd-jni 1.3.8-4 through 1.5.7-13 Use-After-Free via Setters Called After close()
Summary
zstd-jni versions before 1.5.7-14 fail to validate closed state in setDict, setLongMax, setLevel and setRefMultipleDDicts methods of stream classes. Attackers can call these methods on closed streams to write through freed native pointers, corrupting unrelated objects or crashing the JVM.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-09 15:57 UTC
CWE
- CWE-416 - Use After Free
Assigner
References
9 references
| URL | Tags |
|---|---|
| https://github.com/luben/zstd-jni/security/adviso… | vendor-advisory |
| https://github.com/luben/zstd-jni/commit/f38f9a15… | patch |
| https://github.com/luben/zstd-jni/commit/393d7311… | patch |
| https://github.com/luben/zstd-jni/blob/v1.5.7-13/… | technical-description |
| https://github.com/luben/zstd-jni/blob/v1.5.7-13/… | technical-description |
| https://github.com/luben/zstd-jni/releases/tag/v1… | release-notes |
| https://github.com/luben/zstd-jni/commit/0827ed02… | technical-descriptionpatch |
| https://github.com/luben/zstd-jni | product |
| https://www.vulncheck.com/advisories/zstd-jni-1.3… | third-party-advisory |
Impacted products
Date Public
2026-08-19 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-87877",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-09T15:57:38.917828Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T15:57:53.652Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/luben/zstd-jni/security/advisories/GHSA-2jw3-mg7f-vw4q"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo1.maven.org/maven2/com/github/luben/zstd-jni/",
"defaultStatus": "unaffected",
"packageURL": "pkg:maven/com.github.luben/zstd-jni",
"product": "zstd-jni",
"repo": "https://github.com/luben/zstd-jni",
"vendor": "luben",
"versions": [
{
"lessThan": "1.5.7-14",
"status": "affected",
"version": "1.3.8-4",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Yu Bao, PayPal Cyber Security Team"
}
],
"datePublic": "2026-08-19T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "zstd-jni versions before 1.5.7-14 fail to validate closed state in setDict, setLongMax, setLevel and setRefMultipleDDicts methods of stream classes. Attackers can call these methods on closed streams to write through freed native pointers, corrupting unrelated objects or crashing the JVM."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T14:32:45.512Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-2jw3-mg7f-vw4q)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/luben/zstd-jni/security/advisories/GHSA-2jw3-mg7f-vw4q"
},
{
"name": "Fix commit: closed-state guards on BaseZstdBufferDecompressingStreamNoFinalizer",
"tags": [
"patch"
],
"url": "https://github.com/luben/zstd-jni/commit/f38f9a1563113d96d0fc38baee543f7457dd8a8e"
},
{
"name": "Fix commit: closed-state guards on the input and output stream setters",
"tags": [
"patch"
],
"url": "https://github.com/luben/zstd-jni/commit/393d7311766abbc285b149302c0fe1f94b16d555"
},
{
"name": "Setters without the closed-state guard that readInternal already has, at v1.5.7-13",
"tags": [
"technical-description"
],
"url": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/BaseZstdBufferDecompressingStreamNoFinalizer.java"
},
{
"name": "final stream handle retained after close at v1.5.7-13",
"tags": [
"technical-description"
],
"url": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/ZstdInputStreamNoFinalizer.java"
},
{
"name": "zstd-jni v1.5.7-14 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14"
},
{
"name": "Commit that made setDict write through the retained native stream handle (first released in 1.3.8-4)",
"tags": [
"technical-description",
"patch"
],
"url": "https://github.com/luben/zstd-jni/commit/0827ed02551bbd8d6f8e4bbff99d83bf50f91938"
},
{
"tags": [
"product"
],
"url": "https://github.com/luben/zstd-jni"
},
{
"name": "VulnCheck Advisory: zstd-jni 1.3.8-4 through 1.5.7-13 Use-After-Free via Setters Called After close()",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/zstd-jni-1.3.8-4-through-1.5.7-13-use-after-free-via-setters-called-after-close"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "zstd-jni 1.3.8-4 through 1.5.7-13 Use-After-Free via Setters Called After close()",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-87877",
"datePublished": "2026-09-09T14:32:45.512Z",
"dateReserved": "2026-09-09T14:02:07.708Z",
"dateUpdated": "2026-09-09T15:57:53.652Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-87825 (GCVE-0-2026-87825)
Vulnerability from nvd – Published: 2026-09-09 14:32 – Updated: 2026-09-09 14:32
VLAI
EPSS
VEX
Title
zstd-jni 1.3.8-4 through 1.5.7-13 Use-After-Free of Compression and Decompression Dictionaries
Summary
zstd-jni before 1.5.7-14 contains a use-after-free vulnerability where streams and contexts hold a dictionary's shared lock only during the load call, allowing the dictionary to be closed while still referenced. Attackers can close a dictionary after associating it with a stream or context, causing subsequent read or write operations to access freed native memory, resulting in silent data corruption or JVM crashes.
Severity
CWE
- CWE-416 - Use After Free
Assigner
References
9 references
| URL | Tags |
|---|---|
| https://github.com/luben/zstd-jni/security/adviso… | vendor-advisory |
| https://github.com/luben/zstd-jni/commit/393d7311… | patch |
| https://github.com/luben/zstd-jni/commit/a560131d… | patch |
| https://github.com/luben/zstd-jni/blob/v1.5.7-13/… | technical-description |
| https://github.com/luben/zstd-jni/blob/v1.5.7-13/… | technical-description |
| https://github.com/luben/zstd-jni/releases/tag/v1… | release-notes |
| https://github.com/luben/zstd-jni/commit/0827ed02… | technical-descriptionpatch |
| https://github.com/luben/zstd-jni | product |
| https://www.vulncheck.com/advisories/zstd-jni-1.3… | third-party-advisory |
Impacted products
Date Public
2026-08-19 00:00
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://repo1.maven.org/maven2/com/github/luben/zstd-jni/",
"defaultStatus": "unaffected",
"packageURL": "pkg:maven/com.github.luben/zstd-jni",
"product": "zstd-jni",
"repo": "https://github.com/luben/zstd-jni",
"vendor": "luben",
"versions": [
{
"lessThan": "1.5.7-14",
"status": "affected",
"version": "1.3.8-4",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Yu Bao, PayPal Cyber Security Team"
}
],
"datePublic": "2026-08-19T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "zstd-jni before 1.5.7-14 contains a use-after-free vulnerability where streams and contexts hold a dictionary\u0027s shared lock only during the load call, allowing the dictionary to be closed while still referenced. Attackers can close a dictionary after associating it with a stream or context, causing subsequent read or write operations to access freed native memory, resulting in silent data corruption or JVM crashes."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T14:32:44.795Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-947w-pxjj-c7m9)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/luben/zstd-jni/security/advisories/GHSA-947w-pxjj-c7m9"
},
{
"name": "Fix commit: hold the dictionary shared lock for the stream\u0027s usage window",
"tags": [
"patch"
],
"url": "https://github.com/luben/zstd-jni/commit/393d7311766abbc285b149302c0fe1f94b16d555"
},
{
"name": "Fix commit: cross-object lifetime tracking for dictionaries and contexts",
"tags": [
"patch"
],
"url": "https://github.com/luben/zstd-jni/commit/a560131d7834598afd9cea6b7c107bc88e915936"
},
{
"name": "Shared lock released as soon as the dictionary is loaded at v1.5.7-13",
"tags": [
"technical-description"
],
"url": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/ZstdInputStreamNoFinalizer.java"
},
{
"name": "Same lock lifecycle in the buffer stream base class at v1.5.7-13",
"tags": [
"technical-description"
],
"url": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/BaseZstdBufferDecompressingStreamNoFinalizer.java"
},
{
"name": "zstd-jni v1.5.7-14 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14"
},
{
"name": "Commit that made setDict load the dictionary eagerly into the native context (first released in 1.3.8-4)",
"tags": [
"technical-description",
"patch"
],
"url": "https://github.com/luben/zstd-jni/commit/0827ed02551bbd8d6f8e4bbff99d83bf50f91938"
},
{
"tags": [
"product"
],
"url": "https://github.com/luben/zstd-jni"
},
{
"name": "VulnCheck Advisory: zstd-jni 1.3.8-4 through 1.5.7-13 Use-After-Free of Compression and Decompression Dictionaries",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/zstd-jni-1.3.8-4-through-1.5.7-13-use-after-free-of-compression-and-decompression-dictionaries"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "zstd-jni 1.3.8-4 through 1.5.7-13 Use-After-Free of Compression and Decompression Dictionaries",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-87825",
"datePublished": "2026-09-09T14:32:44.795Z",
"dateReserved": "2026-09-09T10:32:34.110Z",
"dateUpdated": "2026-09-09T14:32:44.795Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-87824 (GCVE-0-2026-87824)
Vulnerability from nvd – Published: 2026-09-09 14:32 – Updated: 2026-09-09 14:32
VLAI
EPSS
VEX
Title
zstd-jni 1.3.3-1 through 1.5.7-13 Out-of-Bounds Read via Zstd.trainFromBufferDirect
Summary
zstd-jni before 1.5.7-14 fails to validate the samples buffer capacity in Zstd.trainFromBufferDirect, allowing attackers to read past buffer boundaries by supplying oversized per-sample lengths. Attackers can trigger out-of-bounds memory access by providing crafted sample length arrays that cause the native implementation to walk past the buffer allocation, resulting in JVM termination.
Severity
CWE
- CWE-125 - Out-of-bounds Read
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://github.com/luben/zstd-jni/security/adviso… | vendor-advisory |
| https://github.com/luben/zstd-jni/commit/bba6cfca… | patch |
| https://github.com/luben/zstd-jni/blob/v1.5.7-13/… | technical-description |
| https://github.com/luben/zstd-jni/blob/v1.5.7-13/… | technical-description |
| https://github.com/luben/zstd-jni/releases/tag/v1… | release-notes |
| https://github.com/luben/zstd-jni/commit/53d3c634… | technical-descriptionpatch |
| https://github.com/luben/zstd-jni | product |
| https://www.vulncheck.com/advisories/zstd-jni-1.3… | third-party-advisory |
Impacted products
Date Public
2026-08-19 00:00
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://repo1.maven.org/maven2/com/github/luben/zstd-jni/",
"defaultStatus": "unaffected",
"packageURL": "pkg:maven/com.github.luben/zstd-jni",
"product": "zstd-jni",
"repo": "https://github.com/luben/zstd-jni",
"vendor": "luben",
"versions": [
{
"lessThan": "1.5.7-14",
"status": "affected",
"version": "1.3.3-1",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Yu Bao, PayPal Cyber Security Team"
}
],
"datePublic": "2026-08-19T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "zstd-jni before 1.5.7-14 fails to validate the samples buffer capacity in Zstd.trainFromBufferDirect, allowing attackers to read past buffer boundaries by supplying oversized per-sample lengths. Attackers can trigger out-of-bounds memory access by providing crafted sample length arrays that cause the native implementation to walk past the buffer allocation, resulting in JVM termination."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T14:32:44.099Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-257p-3h6w-pg7h)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/luben/zstd-jni/security/advisories/GHSA-257p-3h6w-pg7h"
},
{
"name": "Fix commit: validate the samples buffer capacity against the declared sample sizes",
"tags": [
"patch"
],
"url": "https://github.com/luben/zstd-jni/commit/bba6cfca2c0897f1fa004f4193247479f10da853"
},
{
"name": "Samples buffer capacity never read at v1.5.7-13",
"tags": [
"technical-description"
],
"url": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/native/jni_zdict.c"
},
{
"name": "Java wrapper that only checks the sample count at v1.5.7-13",
"tags": [
"technical-description"
],
"url": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/Zstd.java"
},
{
"name": "zstd-jni v1.5.7-14 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14"
},
{
"name": "Commit that introduced the direct-buffer dictionary trainer without a samples capacity check (first released in 1.3.3-1)",
"tags": [
"technical-description",
"patch"
],
"url": "https://github.com/luben/zstd-jni/commit/53d3c6342883f7d6717b2477a7f9c1b4a4a56980"
},
{
"tags": [
"product"
],
"url": "https://github.com/luben/zstd-jni"
},
{
"name": "VulnCheck Advisory: zstd-jni 1.3.3-1 through 1.5.7-13 Out-of-Bounds Read via Zstd.trainFromBufferDirect",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/zstd-jni-1.3.3-1-through-1.5.7-13-out-of-bounds-read-via-zstd-trainfrombufferdirect"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "zstd-jni 1.3.3-1 through 1.5.7-13 Out-of-Bounds Read via Zstd.trainFromBufferDirect",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-87824",
"datePublished": "2026-09-09T14:32:44.099Z",
"dateReserved": "2026-09-09T10:32:34.110Z",
"dateUpdated": "2026-09-09T14:32:44.099Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-87823 (GCVE-0-2026-87823)
Vulnerability from nvd – Published: 2026-09-09 14:32 – Updated: 2026-09-09 16:13
VLAI
EPSS
VEX
Title
zstd-jni 1.1.1 through 1.5.7-13 Out-of-Bounds Read via Direct ByteBuffer Frame-Size Methods
Summary
zstd-jni before 1.5.7-14 performs 32-bit signed bounds checks on three direct-ByteBuffer frame-size native methods, allowing out-of-bounds memory reads via negative or overflowing offsets. Attackers can supply negative offset values near Integer.MIN_VALUE to read unmapped memory, causing JVM termination or extracting arbitrary frame size data from unintended memory locations.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-09 16:12 UTC
CWE
- CWE-190 - Integer Overflow or Wraparound
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://github.com/luben/zstd-jni/security/adviso… | vendor-advisory |
| https://github.com/luben/zstd-jni/commit/d7a1c993… | patch |
| https://github.com/luben/zstd-jni/blob/v1.5.7-13/… | technical-description |
| https://github.com/luben/zstd-jni/blob/v1.5.7-13/… | technical-description |
| https://github.com/luben/zstd-jni/releases/tag/v1… | release-notes |
| https://github.com/luben/zstd-jni/commit/46dcb2a5… | technical-descriptionpatch |
| https://github.com/luben/zstd-jni | product |
| https://www.vulncheck.com/advisories/zstd-jni-1.1… | third-party-advisory |
Impacted products
Date Public
2026-08-19 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-87823",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-09T16:12:29.082517Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T16:13:14.420Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/luben/zstd-jni/security/advisories/GHSA-jfr6-9xqw-2g2q"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo1.maven.org/maven2/com/github/luben/zstd-jni/",
"defaultStatus": "unaffected",
"packageURL": "pkg:maven/com.github.luben/zstd-jni",
"product": "zstd-jni",
"repo": "https://github.com/luben/zstd-jni",
"vendor": "luben",
"versions": [
{
"lessThan": "1.5.7-14",
"status": "affected",
"version": "1.1.1",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Yu Bao, PayPal Cyber Security Team"
}
],
"datePublic": "2026-08-19T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "zstd-jni before 1.5.7-14 performs 32-bit signed bounds checks on three direct-ByteBuffer frame-size native methods, allowing out-of-bounds memory reads via negative or overflowing offsets. Attackers can supply negative offset values near Integer.MIN_VALUE to read unmapped memory, causing JVM termination or extracting arbitrary frame size data from unintended memory locations."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-190",
"description": "Integer Overflow or Wraparound",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T14:32:43.442Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-jfr6-9xqw-2g2q)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/luben/zstd-jni/security/advisories/GHSA-jfr6-9xqw-2g2q"
},
{
"name": "Fix commit: reject negative offset and size in the three direct-ByteBuffer natives",
"tags": [
"patch"
],
"url": "https://github.com/luben/zstd-jni/commit/d7a1c99322d5e1fc71932e722c0b5bb2fc525d3f"
},
{
"name": "Unchecked 32-bit bounds tests at v1.5.7-13",
"tags": [
"technical-description"
],
"url": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/native/jni_zstd.c"
},
{
"name": "Native declarations with no Java-side validation at v1.5.7-13",
"tags": [
"technical-description"
],
"url": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/Zstd.java"
},
{
"name": "zstd-jni v1.5.7-14 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14"
},
{
"name": "Commit that introduced the unchecked direct-ByteBuffer size natives (first released in 1.1.1)",
"tags": [
"technical-description",
"patch"
],
"url": "https://github.com/luben/zstd-jni/commit/46dcb2a54c8b8f2ce2cad7187a7513f509c533ac"
},
{
"tags": [
"product"
],
"url": "https://github.com/luben/zstd-jni"
},
{
"name": "VulnCheck Advisory: zstd-jni 1.1.1 through 1.5.7-13 Out-of-Bounds Read via Direct ByteBuffer Frame-Size Methods",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/zstd-jni-1.1.1-through-1.5.7-13-out-of-bounds-read-via-direct-bytebuffer-frame-size-methods"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "zstd-jni 1.1.1 through 1.5.7-13 Out-of-Bounds Read via Direct ByteBuffer Frame-Size Methods",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-87823",
"datePublished": "2026-09-09T14:32:43.442Z",
"dateReserved": "2026-09-09T10:32:34.110Z",
"dateUpdated": "2026-09-09T16:13:14.420Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-87795 (GCVE-0-2026-87795)
Vulnerability from nvd – Published: 2026-09-09 10:07 – Updated: 2026-09-09 10:07
VLAI
EPSS
VEX
Title
zstd-jni 1.2.0 through 1.5.7-13 Out-of-Bounds Read via ZstdDictCompress
Summary
zstd-jni versions before 1.5.7-14 fail to validate offset and length parameters in the ZstdDictCompress constructor, allowing out-of-bounds memory reads. Attackers can supply untrusted offset or length values to read native heap memory into the compression dictionary, typically causing JVM crashes.
Severity
CWE
- CWE-125 - Out-of-bounds Read
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://github.com/luben/zstd-jni/security/adviso… | vendor-advisory |
| https://github.com/luben/zstd-jni/commit/0d64de4d… | patch |
| https://github.com/luben/zstd-jni/blob/v1.5.7-13/… | technical-description |
| https://github.com/luben/zstd-jni/blob/v1.5.7-13/… | technical-description |
| https://github.com/luben/zstd-jni/commit/1c4e5a6c… | technical-descriptionpatch |
| https://github.com/luben/zstd-jni/releases/tag/v1… | release-notes |
| https://github.com/luben/zstd-jni | product |
| https://www.vulncheck.com/advisories/zstd-jni-1.2… | third-party-advisory |
Impacted products
Date Public
2026-08-15 00:00
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://repo1.maven.org/maven2/com/github/luben/zstd-jni/",
"defaultStatus": "unaffected",
"packageURL": "pkg:maven/com.github.luben/zstd-jni",
"product": "zstd-jni",
"repo": "https://github.com/luben/zstd-jni",
"vendor": "luben",
"versions": [
{
"lessThan": "1.5.7-14",
"status": "affected",
"version": "1.2.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Yu Bao, PayPal Cyber Security Team"
}
],
"datePublic": "2026-08-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "zstd-jni versions before 1.5.7-14 fail to validate offset and length parameters in the ZstdDictCompress constructor, allowing out-of-bounds memory reads. Attackers can supply untrusted offset or length values to read native heap memory into the compression dictionary, typically causing JVM crashes."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T10:07:28.656Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-ff36-7w3w-g8rm)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/luben/zstd-jni/security/advisories/GHSA-ff36-7w3w-g8rm"
},
{
"name": "Fix commit",
"tags": [
"patch"
],
"url": "https://github.com/luben/zstd-jni/commit/0d64de4dee6606ff506be36c7f2e714ad0c80fdb"
},
{
"name": "Broken bounds check at v1.5.7-13",
"tags": [
"technical-description"
],
"url": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/ZstdDictCompress.java"
},
{
"name": "Native init that trusts the offset and length",
"tags": [
"technical-description"
],
"url": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/native/jni_fast_zstd.c"
},
{
"name": "Commit that introduced the unchecked native path",
"tags": [
"technical-description",
"patch"
],
"url": "https://github.com/luben/zstd-jni/commit/1c4e5a6c3ce8458095225d987d669e6a0937734a"
},
{
"name": "zstd-jni v1.5.7-14 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14"
},
{
"tags": [
"product"
],
"url": "https://github.com/luben/zstd-jni"
},
{
"name": "VulnCheck Advisory: zstd-jni 1.2.0 through 1.5.7-13 Out-of-Bounds Read via ZstdDictCompress",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/zstd-jni-1.2.0-through-1.5.7-13-out-of-bounds-read-via-zstddictcompress"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "zstd-jni 1.2.0 through 1.5.7-13 Out-of-Bounds Read via ZstdDictCompress",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-87795",
"datePublished": "2026-09-09T10:07:28.656Z",
"dateReserved": "2026-09-09T09:37:58.558Z",
"dateUpdated": "2026-09-09T10:07:28.656Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-89046 (GCVE-0-2026-89046)
Vulnerability from cvelistv5 – Published: 2026-09-10 17:39 – Updated: 2026-09-10 18:10
VLAI
EPSS
VEX
Title
zstd-jni 1.5.5-6 through 1.5.7-13 Out-of-Bounds Read via Negative Offset
Summary
zstd-jni versions 1.5.5-6 through 1.5.7-13 contain an out-of-bounds read vulnerability in Zstd.getFrameContentSize that fails to validate negative srcPosition arguments. Attackers can supply negative offset values that bypass bounds checks and reach the native frame-header parser, causing out-of-bounds memory reads that lead to information disclosure or JVM crashes.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-10 18:07 UTC
CWE
- CWE-125 - Out-of-bounds Read
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/luben/zstd-jni/security/adviso… | vendor-advisory |
| https://github.com/luben/zstd-jni/commit/dd08685e… | patch |
| https://github.com/luben/zstd-jni/blob/v1.5.7-13/… | technical-description |
| https://github.com/luben/zstd-jni/blob/v1.5.7-13/… | technical-description |
| https://github.com/luben/zstd-jni/releases/tag/v1… | release-notes |
| https://github.com/luben/zstd-jni | product |
| https://www.vulncheck.com/advisories/zstd-jni-1.5… | third-party-advisory |
Impacted products
Date Public
2026-08-14 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-89046",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-10T18:07:52.440977Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T18:10:40.912Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/luben/zstd-jni/security/advisories/GHSA-rm53-6wf5-f34m"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo1.maven.org/maven2/com/github/luben/zstd-jni/",
"defaultStatus": "unaffected",
"packageURL": "pkg:maven/com.github.luben/zstd-jni",
"product": "zstd-jni",
"repo": "https://github.com/luben/zstd-jni",
"vendor": "luben",
"versions": [
{
"lessThan": "1.5.7-14",
"status": "affected",
"version": "1.5.5-6",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Yu Bao, PayPal Cyber Security Team"
}
],
"datePublic": "2026-08-14T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "zstd-jni versions 1.5.5-6 through 1.5.7-13 contain an out-of-bounds read vulnerability in Zstd.getFrameContentSize that fails to validate negative srcPosition arguments. Attackers can supply negative offset values that bypass bounds checks and reach the native frame-header parser, causing out-of-bounds memory reads that lead to information disclosure or JVM crashes."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T17:39:35.519Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-rm53-6wf5-f34m)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/luben/zstd-jni/security/advisories/GHSA-rm53-6wf5-f34m"
},
{
"name": "Fix commit: reject a negative source position and size",
"tags": [
"patch"
],
"url": "https://github.com/luben/zstd-jni/commit/dd08685ef913a32e76fb27f43470035c06758646"
},
{
"name": "Upper-bound-only bounds check at v1.5.7-13",
"tags": [
"technical-description"
],
"url": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/Zstd.java#L730"
},
{
"name": "Native routine that offsets the critical array pointer without re-validating",
"tags": [
"technical-description"
],
"url": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/native/jni_zstd.c#L87"
},
{
"name": "zstd-jni v1.5.7-14 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14"
},
{
"name": "luben/zstd-jni",
"tags": [
"product"
],
"url": "https://github.com/luben/zstd-jni"
},
{
"name": "VulnCheck Advisory: zstd-jni 1.5.5-6 through 1.5.7-13 Out-of-Bounds Read via Negative Offset",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/zstd-jni-1.5.5-6-through-1.5.7-13-out-of-bounds-read-via-negative-offset"
}
],
"title": "zstd-jni 1.5.5-6 through 1.5.7-13 Out-of-Bounds Read via Negative Offset",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-89046",
"datePublished": "2026-09-10T17:39:35.519Z",
"dateReserved": "2026-09-10T16:45:23.295Z",
"dateUpdated": "2026-09-10T18:10:40.912Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-89045 (GCVE-0-2026-89045)
Vulnerability from cvelistv5 – Published: 2026-09-10 17:39 – Updated: 2026-09-10 17:39
VLAI
EPSS
VEX
Title
zstd-jni 1.4.8-4 through 1.5.7-13 Denial of Service via Negative Length
Summary
zstd-jni versions 1.4.8-4 through 1.5.7-13 fail to validate negative length parameters in ZstdInputStreamNoFinalizer.read(), allowing attackers to trigger infinite loops. Attackers can pass negative length values to cause the read method to spin indefinitely while holding the stream monitor, blocking all other threads from accessing the stream.
Severity
CWE
- CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/luben/zstd-jni/security/adviso… | vendor-advisory |
| https://github.com/luben/zstd-jni/commit/dd08685e… | patch |
| https://github.com/luben/zstd-jni/blob/v1.5.7-13/… | technical-description |
| https://github.com/luben/zstd-jni/releases/tag/v1… | release-notes |
| https://github.com/luben/zstd-jni | product |
| https://www.vulncheck.com/advisories/zstd-jni-1.4… | third-party-advisory |
Impacted products
Date Public
2026-08-14 00:00
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://repo1.maven.org/maven2/com/github/luben/zstd-jni/",
"defaultStatus": "unaffected",
"packageURL": "pkg:maven/com.github.luben/zstd-jni",
"product": "zstd-jni",
"repo": "https://github.com/luben/zstd-jni",
"vendor": "luben",
"versions": [
{
"lessThan": "1.5.7-14",
"status": "affected",
"version": "1.4.8-4",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Yu Bao, PayPal Cyber Security Team"
}
],
"datePublic": "2026-08-14T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "zstd-jni versions 1.4.8-4 through 1.5.7-13 fail to validate negative length parameters in ZstdInputStreamNoFinalizer.read(), allowing attackers to trigger infinite loops. Attackers can pass negative length values to cause the read method to spin indefinitely while holding the stream monitor, blocking all other threads from accessing the stream."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-835",
"description": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T17:39:34.866Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-9jx2-gfp9-phfm)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/luben/zstd-jni/security/advisories/GHSA-9jx2-gfp9-phfm"
},
{
"name": "Fix commit: reject a negative length in read and readInternal",
"tags": [
"patch"
],
"url": "https://github.com/luben/zstd-jni/commit/dd08685ef913a32e76fb27f43470035c06758646"
},
{
"name": "Guard that never checks a negative length at v1.5.7-13",
"tags": [
"technical-description"
],
"url": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/ZstdInputStreamNoFinalizer.java#L133"
},
{
"name": "zstd-jni v1.5.7-14 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14"
},
{
"name": "luben/zstd-jni",
"tags": [
"product"
],
"url": "https://github.com/luben/zstd-jni"
},
{
"name": "VulnCheck Advisory: zstd-jni 1.4.8-4 through 1.5.7-13 Denial of Service via Negative Length",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/zstd-jni-1.4.8-4-through-1.5.7-13-denial-of-service-via-negative-length"
}
],
"title": "zstd-jni 1.4.8-4 through 1.5.7-13 Denial of Service via Negative Length",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-89045",
"datePublished": "2026-09-10T17:39:34.866Z",
"dateReserved": "2026-09-10T16:45:18.503Z",
"dateUpdated": "2026-09-10T17:39:34.866Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-87877 (GCVE-0-2026-87877)
Vulnerability from cvelistv5 – Published: 2026-09-09 14:32 – Updated: 2026-09-09 15:57
VLAI
EPSS
VEX
Title
zstd-jni 1.3.8-4 through 1.5.7-13 Use-After-Free via Setters Called After close()
Summary
zstd-jni versions before 1.5.7-14 fail to validate closed state in setDict, setLongMax, setLevel and setRefMultipleDDicts methods of stream classes. Attackers can call these methods on closed streams to write through freed native pointers, corrupting unrelated objects or crashing the JVM.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-09 15:57 UTC
CWE
- CWE-416 - Use After Free
Assigner
References
9 references
| URL | Tags |
|---|---|
| https://github.com/luben/zstd-jni/security/adviso… | vendor-advisory |
| https://github.com/luben/zstd-jni/commit/f38f9a15… | patch |
| https://github.com/luben/zstd-jni/commit/393d7311… | patch |
| https://github.com/luben/zstd-jni/blob/v1.5.7-13/… | technical-description |
| https://github.com/luben/zstd-jni/blob/v1.5.7-13/… | technical-description |
| https://github.com/luben/zstd-jni/releases/tag/v1… | release-notes |
| https://github.com/luben/zstd-jni/commit/0827ed02… | technical-descriptionpatch |
| https://github.com/luben/zstd-jni | product |
| https://www.vulncheck.com/advisories/zstd-jni-1.3… | third-party-advisory |
Impacted products
Date Public
2026-08-19 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-87877",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-09T15:57:38.917828Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T15:57:53.652Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/luben/zstd-jni/security/advisories/GHSA-2jw3-mg7f-vw4q"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo1.maven.org/maven2/com/github/luben/zstd-jni/",
"defaultStatus": "unaffected",
"packageURL": "pkg:maven/com.github.luben/zstd-jni",
"product": "zstd-jni",
"repo": "https://github.com/luben/zstd-jni",
"vendor": "luben",
"versions": [
{
"lessThan": "1.5.7-14",
"status": "affected",
"version": "1.3.8-4",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Yu Bao, PayPal Cyber Security Team"
}
],
"datePublic": "2026-08-19T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "zstd-jni versions before 1.5.7-14 fail to validate closed state in setDict, setLongMax, setLevel and setRefMultipleDDicts methods of stream classes. Attackers can call these methods on closed streams to write through freed native pointers, corrupting unrelated objects or crashing the JVM."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T14:32:45.512Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-2jw3-mg7f-vw4q)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/luben/zstd-jni/security/advisories/GHSA-2jw3-mg7f-vw4q"
},
{
"name": "Fix commit: closed-state guards on BaseZstdBufferDecompressingStreamNoFinalizer",
"tags": [
"patch"
],
"url": "https://github.com/luben/zstd-jni/commit/f38f9a1563113d96d0fc38baee543f7457dd8a8e"
},
{
"name": "Fix commit: closed-state guards on the input and output stream setters",
"tags": [
"patch"
],
"url": "https://github.com/luben/zstd-jni/commit/393d7311766abbc285b149302c0fe1f94b16d555"
},
{
"name": "Setters without the closed-state guard that readInternal already has, at v1.5.7-13",
"tags": [
"technical-description"
],
"url": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/BaseZstdBufferDecompressingStreamNoFinalizer.java"
},
{
"name": "final stream handle retained after close at v1.5.7-13",
"tags": [
"technical-description"
],
"url": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/ZstdInputStreamNoFinalizer.java"
},
{
"name": "zstd-jni v1.5.7-14 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14"
},
{
"name": "Commit that made setDict write through the retained native stream handle (first released in 1.3.8-4)",
"tags": [
"technical-description",
"patch"
],
"url": "https://github.com/luben/zstd-jni/commit/0827ed02551bbd8d6f8e4bbff99d83bf50f91938"
},
{
"tags": [
"product"
],
"url": "https://github.com/luben/zstd-jni"
},
{
"name": "VulnCheck Advisory: zstd-jni 1.3.8-4 through 1.5.7-13 Use-After-Free via Setters Called After close()",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/zstd-jni-1.3.8-4-through-1.5.7-13-use-after-free-via-setters-called-after-close"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "zstd-jni 1.3.8-4 through 1.5.7-13 Use-After-Free via Setters Called After close()",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-87877",
"datePublished": "2026-09-09T14:32:45.512Z",
"dateReserved": "2026-09-09T14:02:07.708Z",
"dateUpdated": "2026-09-09T15:57:53.652Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-87825 (GCVE-0-2026-87825)
Vulnerability from cvelistv5 – Published: 2026-09-09 14:32 – Updated: 2026-09-09 14:32
VLAI
EPSS
VEX
Title
zstd-jni 1.3.8-4 through 1.5.7-13 Use-After-Free of Compression and Decompression Dictionaries
Summary
zstd-jni before 1.5.7-14 contains a use-after-free vulnerability where streams and contexts hold a dictionary's shared lock only during the load call, allowing the dictionary to be closed while still referenced. Attackers can close a dictionary after associating it with a stream or context, causing subsequent read or write operations to access freed native memory, resulting in silent data corruption or JVM crashes.
Severity
CWE
- CWE-416 - Use After Free
Assigner
References
9 references
| URL | Tags |
|---|---|
| https://github.com/luben/zstd-jni/security/adviso… | vendor-advisory |
| https://github.com/luben/zstd-jni/commit/393d7311… | patch |
| https://github.com/luben/zstd-jni/commit/a560131d… | patch |
| https://github.com/luben/zstd-jni/blob/v1.5.7-13/… | technical-description |
| https://github.com/luben/zstd-jni/blob/v1.5.7-13/… | technical-description |
| https://github.com/luben/zstd-jni/releases/tag/v1… | release-notes |
| https://github.com/luben/zstd-jni/commit/0827ed02… | technical-descriptionpatch |
| https://github.com/luben/zstd-jni | product |
| https://www.vulncheck.com/advisories/zstd-jni-1.3… | third-party-advisory |
Impacted products
Date Public
2026-08-19 00:00
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://repo1.maven.org/maven2/com/github/luben/zstd-jni/",
"defaultStatus": "unaffected",
"packageURL": "pkg:maven/com.github.luben/zstd-jni",
"product": "zstd-jni",
"repo": "https://github.com/luben/zstd-jni",
"vendor": "luben",
"versions": [
{
"lessThan": "1.5.7-14",
"status": "affected",
"version": "1.3.8-4",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Yu Bao, PayPal Cyber Security Team"
}
],
"datePublic": "2026-08-19T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "zstd-jni before 1.5.7-14 contains a use-after-free vulnerability where streams and contexts hold a dictionary\u0027s shared lock only during the load call, allowing the dictionary to be closed while still referenced. Attackers can close a dictionary after associating it with a stream or context, causing subsequent read or write operations to access freed native memory, resulting in silent data corruption or JVM crashes."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T14:32:44.795Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-947w-pxjj-c7m9)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/luben/zstd-jni/security/advisories/GHSA-947w-pxjj-c7m9"
},
{
"name": "Fix commit: hold the dictionary shared lock for the stream\u0027s usage window",
"tags": [
"patch"
],
"url": "https://github.com/luben/zstd-jni/commit/393d7311766abbc285b149302c0fe1f94b16d555"
},
{
"name": "Fix commit: cross-object lifetime tracking for dictionaries and contexts",
"tags": [
"patch"
],
"url": "https://github.com/luben/zstd-jni/commit/a560131d7834598afd9cea6b7c107bc88e915936"
},
{
"name": "Shared lock released as soon as the dictionary is loaded at v1.5.7-13",
"tags": [
"technical-description"
],
"url": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/ZstdInputStreamNoFinalizer.java"
},
{
"name": "Same lock lifecycle in the buffer stream base class at v1.5.7-13",
"tags": [
"technical-description"
],
"url": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/BaseZstdBufferDecompressingStreamNoFinalizer.java"
},
{
"name": "zstd-jni v1.5.7-14 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14"
},
{
"name": "Commit that made setDict load the dictionary eagerly into the native context (first released in 1.3.8-4)",
"tags": [
"technical-description",
"patch"
],
"url": "https://github.com/luben/zstd-jni/commit/0827ed02551bbd8d6f8e4bbff99d83bf50f91938"
},
{
"tags": [
"product"
],
"url": "https://github.com/luben/zstd-jni"
},
{
"name": "VulnCheck Advisory: zstd-jni 1.3.8-4 through 1.5.7-13 Use-After-Free of Compression and Decompression Dictionaries",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/zstd-jni-1.3.8-4-through-1.5.7-13-use-after-free-of-compression-and-decompression-dictionaries"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "zstd-jni 1.3.8-4 through 1.5.7-13 Use-After-Free of Compression and Decompression Dictionaries",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-87825",
"datePublished": "2026-09-09T14:32:44.795Z",
"dateReserved": "2026-09-09T10:32:34.110Z",
"dateUpdated": "2026-09-09T14:32:44.795Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-87824 (GCVE-0-2026-87824)
Vulnerability from cvelistv5 – Published: 2026-09-09 14:32 – Updated: 2026-09-09 14:32
VLAI
EPSS
VEX
Title
zstd-jni 1.3.3-1 through 1.5.7-13 Out-of-Bounds Read via Zstd.trainFromBufferDirect
Summary
zstd-jni before 1.5.7-14 fails to validate the samples buffer capacity in Zstd.trainFromBufferDirect, allowing attackers to read past buffer boundaries by supplying oversized per-sample lengths. Attackers can trigger out-of-bounds memory access by providing crafted sample length arrays that cause the native implementation to walk past the buffer allocation, resulting in JVM termination.
Severity
CWE
- CWE-125 - Out-of-bounds Read
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://github.com/luben/zstd-jni/security/adviso… | vendor-advisory |
| https://github.com/luben/zstd-jni/commit/bba6cfca… | patch |
| https://github.com/luben/zstd-jni/blob/v1.5.7-13/… | technical-description |
| https://github.com/luben/zstd-jni/blob/v1.5.7-13/… | technical-description |
| https://github.com/luben/zstd-jni/releases/tag/v1… | release-notes |
| https://github.com/luben/zstd-jni/commit/53d3c634… | technical-descriptionpatch |
| https://github.com/luben/zstd-jni | product |
| https://www.vulncheck.com/advisories/zstd-jni-1.3… | third-party-advisory |
Impacted products
Date Public
2026-08-19 00:00
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://repo1.maven.org/maven2/com/github/luben/zstd-jni/",
"defaultStatus": "unaffected",
"packageURL": "pkg:maven/com.github.luben/zstd-jni",
"product": "zstd-jni",
"repo": "https://github.com/luben/zstd-jni",
"vendor": "luben",
"versions": [
{
"lessThan": "1.5.7-14",
"status": "affected",
"version": "1.3.3-1",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Yu Bao, PayPal Cyber Security Team"
}
],
"datePublic": "2026-08-19T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "zstd-jni before 1.5.7-14 fails to validate the samples buffer capacity in Zstd.trainFromBufferDirect, allowing attackers to read past buffer boundaries by supplying oversized per-sample lengths. Attackers can trigger out-of-bounds memory access by providing crafted sample length arrays that cause the native implementation to walk past the buffer allocation, resulting in JVM termination."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T14:32:44.099Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-257p-3h6w-pg7h)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/luben/zstd-jni/security/advisories/GHSA-257p-3h6w-pg7h"
},
{
"name": "Fix commit: validate the samples buffer capacity against the declared sample sizes",
"tags": [
"patch"
],
"url": "https://github.com/luben/zstd-jni/commit/bba6cfca2c0897f1fa004f4193247479f10da853"
},
{
"name": "Samples buffer capacity never read at v1.5.7-13",
"tags": [
"technical-description"
],
"url": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/native/jni_zdict.c"
},
{
"name": "Java wrapper that only checks the sample count at v1.5.7-13",
"tags": [
"technical-description"
],
"url": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/Zstd.java"
},
{
"name": "zstd-jni v1.5.7-14 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14"
},
{
"name": "Commit that introduced the direct-buffer dictionary trainer without a samples capacity check (first released in 1.3.3-1)",
"tags": [
"technical-description",
"patch"
],
"url": "https://github.com/luben/zstd-jni/commit/53d3c6342883f7d6717b2477a7f9c1b4a4a56980"
},
{
"tags": [
"product"
],
"url": "https://github.com/luben/zstd-jni"
},
{
"name": "VulnCheck Advisory: zstd-jni 1.3.3-1 through 1.5.7-13 Out-of-Bounds Read via Zstd.trainFromBufferDirect",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/zstd-jni-1.3.3-1-through-1.5.7-13-out-of-bounds-read-via-zstd-trainfrombufferdirect"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "zstd-jni 1.3.3-1 through 1.5.7-13 Out-of-Bounds Read via Zstd.trainFromBufferDirect",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-87824",
"datePublished": "2026-09-09T14:32:44.099Z",
"dateReserved": "2026-09-09T10:32:34.110Z",
"dateUpdated": "2026-09-09T14:32:44.099Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-87823 (GCVE-0-2026-87823)
Vulnerability from cvelistv5 – Published: 2026-09-09 14:32 – Updated: 2026-09-09 16:13
VLAI
EPSS
VEX
Title
zstd-jni 1.1.1 through 1.5.7-13 Out-of-Bounds Read via Direct ByteBuffer Frame-Size Methods
Summary
zstd-jni before 1.5.7-14 performs 32-bit signed bounds checks on three direct-ByteBuffer frame-size native methods, allowing out-of-bounds memory reads via negative or overflowing offsets. Attackers can supply negative offset values near Integer.MIN_VALUE to read unmapped memory, causing JVM termination or extracting arbitrary frame size data from unintended memory locations.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-09 16:12 UTC
CWE
- CWE-190 - Integer Overflow or Wraparound
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://github.com/luben/zstd-jni/security/adviso… | vendor-advisory |
| https://github.com/luben/zstd-jni/commit/d7a1c993… | patch |
| https://github.com/luben/zstd-jni/blob/v1.5.7-13/… | technical-description |
| https://github.com/luben/zstd-jni/blob/v1.5.7-13/… | technical-description |
| https://github.com/luben/zstd-jni/releases/tag/v1… | release-notes |
| https://github.com/luben/zstd-jni/commit/46dcb2a5… | technical-descriptionpatch |
| https://github.com/luben/zstd-jni | product |
| https://www.vulncheck.com/advisories/zstd-jni-1.1… | third-party-advisory |
Impacted products
Date Public
2026-08-19 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-87823",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-09T16:12:29.082517Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T16:13:14.420Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/luben/zstd-jni/security/advisories/GHSA-jfr6-9xqw-2g2q"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo1.maven.org/maven2/com/github/luben/zstd-jni/",
"defaultStatus": "unaffected",
"packageURL": "pkg:maven/com.github.luben/zstd-jni",
"product": "zstd-jni",
"repo": "https://github.com/luben/zstd-jni",
"vendor": "luben",
"versions": [
{
"lessThan": "1.5.7-14",
"status": "affected",
"version": "1.1.1",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Yu Bao, PayPal Cyber Security Team"
}
],
"datePublic": "2026-08-19T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "zstd-jni before 1.5.7-14 performs 32-bit signed bounds checks on three direct-ByteBuffer frame-size native methods, allowing out-of-bounds memory reads via negative or overflowing offsets. Attackers can supply negative offset values near Integer.MIN_VALUE to read unmapped memory, causing JVM termination or extracting arbitrary frame size data from unintended memory locations."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-190",
"description": "Integer Overflow or Wraparound",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T14:32:43.442Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-jfr6-9xqw-2g2q)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/luben/zstd-jni/security/advisories/GHSA-jfr6-9xqw-2g2q"
},
{
"name": "Fix commit: reject negative offset and size in the three direct-ByteBuffer natives",
"tags": [
"patch"
],
"url": "https://github.com/luben/zstd-jni/commit/d7a1c99322d5e1fc71932e722c0b5bb2fc525d3f"
},
{
"name": "Unchecked 32-bit bounds tests at v1.5.7-13",
"tags": [
"technical-description"
],
"url": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/native/jni_zstd.c"
},
{
"name": "Native declarations with no Java-side validation at v1.5.7-13",
"tags": [
"technical-description"
],
"url": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/Zstd.java"
},
{
"name": "zstd-jni v1.5.7-14 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14"
},
{
"name": "Commit that introduced the unchecked direct-ByteBuffer size natives (first released in 1.1.1)",
"tags": [
"technical-description",
"patch"
],
"url": "https://github.com/luben/zstd-jni/commit/46dcb2a54c8b8f2ce2cad7187a7513f509c533ac"
},
{
"tags": [
"product"
],
"url": "https://github.com/luben/zstd-jni"
},
{
"name": "VulnCheck Advisory: zstd-jni 1.1.1 through 1.5.7-13 Out-of-Bounds Read via Direct ByteBuffer Frame-Size Methods",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/zstd-jni-1.1.1-through-1.5.7-13-out-of-bounds-read-via-direct-bytebuffer-frame-size-methods"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "zstd-jni 1.1.1 through 1.5.7-13 Out-of-Bounds Read via Direct ByteBuffer Frame-Size Methods",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-87823",
"datePublished": "2026-09-09T14:32:43.442Z",
"dateReserved": "2026-09-09T10:32:34.110Z",
"dateUpdated": "2026-09-09T16:13:14.420Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-87795 (GCVE-0-2026-87795)
Vulnerability from cvelistv5 – Published: 2026-09-09 10:07 – Updated: 2026-09-09 10:07
VLAI
EPSS
VEX
Title
zstd-jni 1.2.0 through 1.5.7-13 Out-of-Bounds Read via ZstdDictCompress
Summary
zstd-jni versions before 1.5.7-14 fail to validate offset and length parameters in the ZstdDictCompress constructor, allowing out-of-bounds memory reads. Attackers can supply untrusted offset or length values to read native heap memory into the compression dictionary, typically causing JVM crashes.
Severity
CWE
- CWE-125 - Out-of-bounds Read
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://github.com/luben/zstd-jni/security/adviso… | vendor-advisory |
| https://github.com/luben/zstd-jni/commit/0d64de4d… | patch |
| https://github.com/luben/zstd-jni/blob/v1.5.7-13/… | technical-description |
| https://github.com/luben/zstd-jni/blob/v1.5.7-13/… | technical-description |
| https://github.com/luben/zstd-jni/commit/1c4e5a6c… | technical-descriptionpatch |
| https://github.com/luben/zstd-jni/releases/tag/v1… | release-notes |
| https://github.com/luben/zstd-jni | product |
| https://www.vulncheck.com/advisories/zstd-jni-1.2… | third-party-advisory |
Impacted products
Date Public
2026-08-15 00:00
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://repo1.maven.org/maven2/com/github/luben/zstd-jni/",
"defaultStatus": "unaffected",
"packageURL": "pkg:maven/com.github.luben/zstd-jni",
"product": "zstd-jni",
"repo": "https://github.com/luben/zstd-jni",
"vendor": "luben",
"versions": [
{
"lessThan": "1.5.7-14",
"status": "affected",
"version": "1.2.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Yu Bao, PayPal Cyber Security Team"
}
],
"datePublic": "2026-08-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "zstd-jni versions before 1.5.7-14 fail to validate offset and length parameters in the ZstdDictCompress constructor, allowing out-of-bounds memory reads. Attackers can supply untrusted offset or length values to read native heap memory into the compression dictionary, typically causing JVM crashes."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T10:07:28.656Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-ff36-7w3w-g8rm)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/luben/zstd-jni/security/advisories/GHSA-ff36-7w3w-g8rm"
},
{
"name": "Fix commit",
"tags": [
"patch"
],
"url": "https://github.com/luben/zstd-jni/commit/0d64de4dee6606ff506be36c7f2e714ad0c80fdb"
},
{
"name": "Broken bounds check at v1.5.7-13",
"tags": [
"technical-description"
],
"url": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/ZstdDictCompress.java"
},
{
"name": "Native init that trusts the offset and length",
"tags": [
"technical-description"
],
"url": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/native/jni_fast_zstd.c"
},
{
"name": "Commit that introduced the unchecked native path",
"tags": [
"technical-description",
"patch"
],
"url": "https://github.com/luben/zstd-jni/commit/1c4e5a6c3ce8458095225d987d669e6a0937734a"
},
{
"name": "zstd-jni v1.5.7-14 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14"
},
{
"tags": [
"product"
],
"url": "https://github.com/luben/zstd-jni"
},
{
"name": "VulnCheck Advisory: zstd-jni 1.2.0 through 1.5.7-13 Out-of-Bounds Read via ZstdDictCompress",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/zstd-jni-1.2.0-through-1.5.7-13-out-of-bounds-read-via-zstddictcompress"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "zstd-jni 1.2.0 through 1.5.7-13 Out-of-Bounds Read via ZstdDictCompress",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-87795",
"datePublished": "2026-09-09T10:07:28.656Z",
"dateReserved": "2026-09-09T09:37:58.558Z",
"dateUpdated": "2026-09-09T10:07:28.656Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}