20 matches found
CVE-2026-87877
zstd-jni versions before 1.5.7-14 fail to validate closed state in setDict, setLongMax, setLevel and setRefMultipleDDicts methods of stream classes. Attackers can call these methods on closed streams to write through freed native pointers, corrupting unrelated objects or crashing the JVM...
CVE-2026-87823
zstd-jni before 1.5.7-14 performs 32-bit signed bounds checks on three direct-ByteBuffer frame-size native methods, allowing out-of-bounds memory reads via negative or overflowing offsets. Attackers can supply negative offset values near Integer.MINVALUE to read unmapped memory, causing JVM...
CVE-2026-87824
zstd-jni before 1.5.7-14 fails to validate the samples buffer capacity in Zstd.trainFromBufferDirect, allowing attackers to read past buffer boundaries by supplying oversized per-sample lengths. Attackers can trigger out-of-bounds memory access by providing crafted sample length arrays that cause...
CVE-2026-87825
zstd-jni before 1.5.7-14 contains a use-after-free vulnerability where streams and contexts hold a dictionary's shared lock only during the load call, allowing the dictionary to be closed while still referenced. Attackers can close a dictionary after associating it with a stream or context, causi...
EUVD-2026-75024
zstd-jni versions before 1.5.7-14 fail to validate closed state in setDict, setLongMax, setLevel and setRefMultipleDDicts methods of stream classes. Attackers can call these methods on closed streams to write through freed native pointers, corrupting unrelated objects or crashing the JVM...
CVE-2026-87877 zstd-jni 1.3.8-4 through 1.5.7-13 Use-After-Free via Setters Called After close()
zstd-jni versions before 1.5.7-14 fail to validate closed state in setDict, setLongMax, setLevel and setRefMultipleDDicts methods of stream classes. Attackers can call these methods on closed streams to write through freed native pointers, corrupting unrelated objects or crashing the JVM...
CVE-2026-87877
zstd-jni versions 1.3.8-4 through 1.5.7-13 are vulnerable to a use-after-free in stream classes. The root cause is a failure to validate the closed state in the setDict, setLongMax, setLevel, and setRefMultipleDDicts methods, allowing callers to write through freed native pointers on already-clos...
CVE-2026-87824
zstd-jni (Java binding for the zstd compression library) versions 1.3.3-1 through 1.5.7-13 contain an out-of-bounds read vulnerability in the Zstd.trainFromBufferDirect method. The root cause is a failure to validate the samples buffer capacity in the native implementation (jni_zdict.c): an attac...
EUVD-2026-75022
zstd-jni before 1.5.7-14 fails to validate the samples buffer capacity in Zstd.trainFromBufferDirect, allowing attackers to read past buffer boundaries by supplying oversized per-sample lengths. Attackers can trigger out-of-bounds memory access by providing crafted sample length arrays that cause...
EUVD-2026-75023
zstd-jni before 1.5.7-14 contains a use-after-free vulnerability where streams and contexts hold a dictionary's shared lock only during the load call, allowing the dictionary to be closed while still referenced. Attackers can close a dictionary after associating it with a stream or context, causi...
CVE-2026-87825
zstd-jni versions 1.3.8-4 through 1.5.7-13 contain a use-after-free vulnerability in compression and decompression dictionaries. The root cause is that streams and contexts hold a dictionary's shared lock only during the load call, allowing the dictionary to be closed while still referenced. Subs...
CVE-2026-87823 zstd-jni 1.1.1 through 1.5.7-13 Out-of-Bounds Read via Direct ByteBuffer Frame-Size Methods
zstd-jni before 1.5.7-14 performs 32-bit signed bounds checks on three direct-ByteBuffer frame-size native methods, allowing out-of-bounds memory reads via negative or overflowing offsets. Attackers can supply negative offset values near Integer.MINVALUE to read unmapped memory, causing JVM...
CVE-2026-87823
zstd-jni (Java JNI binding for Zstandard compression) versions 1.1.1 through 1.5.7-13 are vulnerable to an out-of-bounds read caused by 32-bit signed bounds checks in three direct-ByteBuffer frame-size native methods. An attacker can supply negative offset values near Integer.MIN_VALUE , causing ...
EUVD-2026-75021
zstd-jni before 1.5.7-14 performs 32-bit signed bounds checks on three direct-ByteBuffer frame-size native methods, allowing out-of-bounds memory reads via negative or overflowing offsets. Attackers can supply negative offset values near Integer.MINVALUE to read unmapped memory, causing JVM...
CVE-2026-87795
A flaw was found in zstd-jni. This vulnerability occurs due to insufficient validation of offset and length parameters within the ZstdDictCompress constructor. An attacker can exploit this by providing untrusted values, leading to an out-of-bounds memory read. This can result in the disclosure of...
EUVD-2026-74791
zstd-jni versions before 1.5.7-14 fail to validate offset and length parameters in the ZstdDictCompress constructor, allowing out-of-bounds memory reads. Attackers can supply untrusted offset or length values to read native heap memory into the compression dictionary, typically causing JVM crashe...
CVE-2026-87795
zstd-jni versions before 1.5.7-14 contain an out-of-bounds read vulnerability in the ZstdDictCompress constructor. The library fails to validate offset and length parameters, allowing an attacker to supply untrusted values that cause reads of native heap memory into the compression dictionary. Th...
SUSE-SU-2026:3225-1 Security update for apache-commons-compress, apache-ivy, brotli-java, zstd-jni
This update for apache-commons-compress, apache-ivy, brotli-java, zstd-jni fixes the following issue Security issues fixed: - CVE-2026-26032: improper pathname limitation in PackagerResolver allows for arbitrary files writes outside of the configured buildRoot directory bsc1271727. Other updates...
