CVE-2026-119434 Decompression bomb in ezstd:decompress_using_ddict/2 allows BEAM memory exhaustion via unbounded output buffer

Improper Handling of Highly Compressed Data Data Amplification vulnerability in silviucpp ezstd allows an attacker who supplies a zstd frame to ezstd:decompressusingddict/2 to exhaust memory and terminate the Erlang VM via a small frame that declares a very large content size...

CVE-2026-119434

The silviucpp ezstd library (versions 1.0.5 before 1.2.5 ) is vulnerable to a decompression bomb (CWE-409) in the ezstd:decompress_using_ddict/2 function. The root cause is that zstd_nif_decompress_using_ddict in c_src/ezstd_nif.cc retrieves the declared content size via ZSTD_getFrameContentSize ...

CVE-2026-119434 Decompression bomb in ezstd:decompress_using_ddict/2 allows BEAM memory exhaustion via unbounded output buffer

Improper Handling of Highly Compressed Data Data Amplification vulnerability in silviucpp ezstd allows an attacker who supplies a zstd frame to ezstd:decompressusingddict/2 to exhaust memory and terminate the Erlang VM via a small frame that declares a very large content size...