CVE-2026-90560

zstd-jni versions 1.2.0 through 1.5.7-13 contain an out-of-bounds read in the ZstdDictDecompress constructor. The root cause is that offset and length arguments are never validated against the dictionary array bounds, allowing an attacker to supply arbitrary values to read memory past the end of ...

CVE-2026-90560

zstd-jni versions 1.2.0 through 1.5.7-13 contain an out-of-bounds read vulnerability in the ZstdDictDecompress constructor because offset and length arguments are never validated against the dictionary array bounds. Attackers can supply arbitrary offset or length values to read memory past the en...

PT-2026-90938

These are all security issues fixed in the zstd-jni-1.5.7.16-1.1 package on the GA media of openSUSE Tumbleweed...

CVE-2026-90560: Out-of-bounds Read

zstd-jni versions 1.2.0 through 1.5.7-13 contain an out-of-bounds read vulnerability in the ZstdDictDecompress constructor because offset and length arguments are never validated against the dictionary array bounds. Attackers can supply arbitrary offset or length values to read memory past the en...

OPENSUSE-SU-2026:11769-1 zstd-jni-1.5.7.16-1.1 on GA media

These are all security issues fixed in the zstd-jni-1.5.7.16-1.1 package on the GA media of openSUSE Tumbleweed...

PT-2026-90720

Name of the Vulnerable Software and Affected Versions zstd-jni versions 1.2.0 through 1.5.7-13 Description An out-of-bounds read exists in the ZstdDictDecompress constructor. This occurs because the offset and length arguments are not validated against the dictionary array bounds, allowing an...

Linux Distros Unpatched Vulnerability : CVE-2026-90560

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - zstd-jni versions 1.2.0 through 1.5.7-13 contain an out-of-bounds read vulnerability in the ZstdDictDecompress constructor because offset and length arguments a...

SUSE CVE-2026-87795

zstd-jni versions before 1.5.7-14 fail to validate offset and length parameters in the ZstdDictCompress constructor, allowing out-of-bounds memory reads. Attackers can supply untrusted offset or length values to read native heap memory into the compression dictionary, typically causing JVM crashe...

SUSE CVE-2026-89045

zstd-jni versions 1.4.8-4 through 1.5.7-13 fail to validate negative length parameters in ZstdInputStreamNoFinalizer.read, allowing attackers to trigger infinite loops. Attackers can pass negative length values to cause the read method to spin indefinitely while holding the stream monitor, blocki...

SUSE CVE-2026-89046

zstd-jni versions 1.5.5-6 through 1.5.7-13 contain an out-of-bounds read vulnerability in Zstd.getFrameContentSize that fails to validate negative srcPosition arguments. Attackers can supply negative offset values that bypass bounds checks and reach the native frame-header parser, causing...

CVE-2026-89046

A flaw was found in zstd-jni. This out-of-bounds read vulnerability in the Zstd.getFrameContentSize function occurs because it fails to validate negative srcPosition arguments. A remote attacker can supply negative offset values, bypassing bounds checks and accessing the native frame-header parse...

CVE-2026-89045

A flaw was found in zstd-jni. This vulnerability allows an attacker to trigger an infinite loop by providing negative length parameters to the ZstdInputStreamNoFinalizer.read method. This can cause the read method to spin indefinitely, holding the stream monitor and blocking other threads from...

Infinite loop

Overview Affected versions of this package are vulnerable to Infinite loop due to negative length validation in readbyte, int, int in src/main/java/com/github/luben/zstd/ZstdInputStreamNoFinalizer.java. An attacker can spin a caller thread indefinitely by supplying a negative len to read, which...

Out-of-bounds Read

Overview Affected versions of this package are vulnerable to Out-of-bounds Read via the getFrameContentSizebyte, int, int, boolean bounds check in src/main/java/com/github/luben/zstd/Zstd.java. An attacker can trigger a JVM crash or read past the start of the input buffer by supplying a negative...

DEBIAN-CVE-2026-89045

zstd-jni versions 1.4.8-4 through 1.5.7-13 fail to validate negative length parameters in ZstdInputStreamNoFinalizer.read, allowing attackers to trigger infinite loops. Attackers can pass negative length values to cause the read method to spin indefinitely while holding the stream monitor, blocki...

DEBIAN-CVE-2026-89046

zstd-jni versions 1.5.5-6 through 1.5.7-13 contain an out-of-bounds read vulnerability in Zstd.getFrameContentSize that fails to validate negative srcPosition arguments. Attackers can supply negative offset values that bypass bounds checks and reach the native frame-header parser, causing...

CVE-2026-89045

zstd-jni versions 1.4.8-4 through 1.5.7-13 fail to validate negative length parameters in ZstdInputStreamNoFinalizer.read, allowing attackers to trigger infinite loops. Attackers can pass negative length values to cause the read method to spin indefinitely while holding the stream monitor, blocki...

CVE-2026-89046

zstd-jni versions 1.5.5-6 through 1.5.7-13 contain an out-of-bounds read vulnerability in Zstd.getFrameContentSize that fails to validate negative srcPosition arguments. Attackers can supply negative offset values that bypass bounds checks and reach the native frame-header parser, causing...

UBUNTU-CVE-2026-89045

zstd-jni versions 1.4.8-4 through 1.5.7-13 fail to validate negative length parameters in ZstdInputStreamNoFinalizer.read, allowing attackers to trigger infinite loops. Attackers can pass negative length values to cause the read method to spin indefinitely while holding the stream monitor, blocki...

UBUNTU-CVE-2026-89046

zstd-jni versions 1.5.5-6 through 1.5.7-13 contain an out-of-bounds read vulnerability in Zstd.getFrameContentSize that fails to validate negative srcPosition arguments. Attackers can supply negative offset values that bypass bounds checks and reach the native frame-header parser, causing...