Use-after-free

The zstd-jni library is vulnerable to a use-after-free. The vulnerability is due to improper memory management during dictionary loading, which allows a remote attacker to potentially exploit the freed memory and compromise application stability or security...

Use After Free

zstd-jni is vulnerable to Use-After-Free. The vulnerability is due to streams and contexts releasing a dictionary's shared lock after the load operation while retaining references to the dictionary, which allows an attacker to close the dictionary and cause subsequent operations to access freed...

Out-of-Bounds Read

zstd-jni is vulnerable to Out-of-Bounds Read. The vulnerability is due to failure to validate the samples buffer capacity in Zstd.trainFromBufferDirect, which allows an attacker to supply oversized sample lengths that cause the native implementation to read beyond buffer boundaries, potentially...

Out-of-Bounds Read

zstd-jni is vulnerable to Out-of-Bounds Read. The vulnerability is due to improper 32-bit signed bounds checking of direct-ByteBuffer frame-size native methods, which allows an attacker to provide negative or overflowing offsets to read unintended memory locations, potentially causing JVM...

Out-of-bounds Memory Read

zstd-jni is vulnerable to an out-of-bounds memory read. The vulnerability is due to insufficient validation of untrusted offset and length values, which allows an attacker to read data from the native heap into the compression dictionary, potentially causing JVM crashes...

CLEANSTART-2026-WP99791 zstd-jni versions 1

CVE-2026-89045 affects multiple packages. zstd-jni versions 1. See references for individual vulnerability details...

CLEANSTART-2026-LX98004 zstd-jni versions 1

CVE-2026-89046 affects multiple packages. zstd-jni versions 1. See references for individual vulnerability details...

CLEANSTART-2026-GA54937 zstd-jni versions before 1

CVE-2026-87877 affects multiple packages. zstd-jni versions before 1. See references for individual vulnerability details...

CLEANSTART-2026-YX63078 zstd-jni before 1

CVE-2026-87825 affects multiple packages. zstd-jni before 1. See references for individual vulnerability details...

CLEANSTART-2026-YT94531 zstd-jni versions 1

CVE-2026-90560 affects multiple packages. zstd-jni versions 1. See references for individual vulnerability details...

CLEANSTART-2026-YH80371 zstd-jni versions before 1

CVE-2026-87795 affects multiple packages. zstd-jni versions before 1. See references for individual vulnerability details...

CLEANSTART-2026-TA23513 zstd-jni before 1

CVE-2026-87824 affects multiple packages. zstd-jni before 1. See references for individual vulnerability details...

CLEANSTART-2026-BK85546 zstd-jni before 1

CVE-2026-87823 affects multiple packages. zstd-jni before 1. See references for individual vulnerability details...

Security Bulletin: IBM SPSS Modeler is affected by multiple vulnerabilities in zstd-jni, snappy-java, and Apache Parquet

Summary IBM SPSS Modeler is affected by multiple vulnerabilities in zstd-jni, snappy-java, and Apache Parquet. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-90559 DESCRIPTION: snappy-java through 1.1.10.8 contains an out-of-bounds write vulnerability in...

SUSE CVE-2026-98079

In the Linux kernel, the following vulnerability has been resolved: btrfs: zstd: fix lost wakeup when waiting for a workspace A writer can sleep forever in zstdgetworkspace even though a workspace is free. When zstdallocworkspace fails, the task is queued on zwsm-wait and schedules unconditionall...

PT-2026-105924

Impact Denial of service via memory exhaustion. Affects all callers who streamed compressed responses relying on the chunk size — explicit iter byteschunk size=... or the default — to bound memory. The decoder ignored that bound, so a chunk could be far larger than requested and a single compress...

CLEANSTART-2025-AN69250 Beginning in v1

Security vulnerability affects the zstd package. Beginning in v1...

Uncontrolled Resource Consumption

zstd-jni is vulnerable to Uncontrolled Resource Consumption. The vulnerability is due to improper validation of negative length parameters in ZstdInputStreamNoFinalizer.read, which allows an attacker to trigger an infinite loop that holds the stream monitor and blocks other threads from accessing...

Out-of-Bounds Read

zstd-jni is vulnerable to Out-of-Bounds Read. The vulnerability is due to improper validation of negative srcPosition arguments in Zstd.getFrameContentSize, which allows an attacker to bypass bounds checks and trigger out-of-bounds memory reads, potentially causing information disclosure or JVM...

Out-Of-Bounds Read

zstd-jni is vulnerable to an out-of-bounds read. The vulnerability is due to the ZstdDictDecompress constructor not validating the offset and length arguments against the dictionary array bounds, which allows an attacker to provide arbitrary values to read memory beyond the supplied array and...