CVE-2026-90852: Use After Free

A vulnerability has been found in luben zstd-jni up to 1.5.7-13. This vulnerability affects the function ZstdCompressCtx.loadDict of the file ZstdCompressCtx.java of the component Dictionary Sharing. Such manipulation leads to use after free. The attack can be executed remotely. The exploit has...

Linux Distros Unpatched Vulnerability : CVE-2026-90852

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability has been found in luben zstd-jni up to 1.5.7-13. This vulnerability affects the function ZstdCompressCtx.loadDict of the file ZstdCompressCtx.ja...

CVE-2026-90560

A flaw was found in zstd-jni. This vulnerability, an out-of-bounds read, occurs in the ZstdDictDecompress constructor due to insufficient validation of offset and length arguments against dictionary array bounds. A remote attacker could exploit this by providing specially crafted input, leading t...

Astra Linux – Vulnerability in libzstd

A vulnerability was discovered in zstd v1.4.10, where an attacker can provide an empty string as an argument to the command-line tool, causing a buffer overflow...

Out-of-bounds Read

Overview Affected versions of this package are vulnerable to Out-of-bounds Read through the ZstdDictDecompressbyte dict, int offset, int length constructor in src/main/java/com/github/luben/zstd/ZstdDictDecompress.java. An attacker can read past the end of the supplied dictionary array by providi...

CVE-2026-90560

zstd-jni versions 1.2.0 through 1.5.7-13 contain an out-of-bounds read vulnerability in the ZstdDictDecompress constructor because offset and length arguments are never validated against the dictionary array bounds. Attackers can supply arbitrary offset or length values to read memory past the en...

DEBIAN-CVE-2026-90560

zstd-jni versions 1.2.0 through 1.5.7-13 contain an out-of-bounds read vulnerability in the ZstdDictDecompress constructor because offset and length arguments are never validated against the dictionary array bounds. Attackers can supply arbitrary offset or length values to read memory past the en...

UBUNTU-CVE-2026-90560

zstd-jni versions 1.2.0 through 1.5.7-13 contain an out-of-bounds read vulnerability in the ZstdDictDecompress constructor because offset and length arguments are never validated against the dictionary array bounds. Attackers can supply arbitrary offset or length values to read memory past the en...

CVE-2026-90560

zstd-jni versions 1.2.0 through 1.5.7-13 contain an out-of-bounds read vulnerability in the ZstdDictDecompress constructor because offset and length arguments are never validated against the dictionary array bounds. Attackers can supply arbitrary offset or length values to read memory past the en...

CVE-2026-90560

zstd-jni versions 1.2.0 through 1.5.7-13 contain an out-of-bounds read in the ZstdDictDecompress constructor. The root cause is that offset and length arguments are never validated against the dictionary array bounds, allowing an attacker to supply arbitrary values to read memory past the end of ...

CVE-2026-90560 zstd-jni 1.2.0 through 1.5.7-13 Out-of-Bounds Read via ZstdDictDecompress

zstd-jni versions 1.2.0 through 1.5.7-13 contain an out-of-bounds read vulnerability in the ZstdDictDecompress constructor because offset and length arguments are never validated against the dictionary array bounds. Attackers can supply arbitrary offset or length values to read memory past the en...

CVE-2026-90560

zstd-jni versions 1.2.0 through 1.5.7-13 contain an out-of-bounds read vulnerability in the ZstdDictDecompress constructor because offset and length arguments are never validated against the dictionary array bounds. Attackers can supply arbitrary offset or length values to read memory past the en...

EUVD-2026-76905

zstd-jni versions 1.2.0 through 1.5.7-13 contain an out-of-bounds read vulnerability in the ZstdDictDecompress constructor because offset and length arguments are never validated against the dictionary array bounds. Attackers can supply arbitrary offset or length values to read memory past the en...

CVE-2026-90560 zstd-jni 1.2.0 through 1.5.7-13 Out-of-Bounds Read via ZstdDictDecompress

zstd-jni versions 1.2.0 through 1.5.7-13 contain an out-of-bounds read vulnerability in the ZstdDictDecompress constructor because offset and length arguments are never validated against the dictionary array bounds. Attackers can supply arbitrary offset or length values to read memory past the en...

CVE-2026-90560 zstd-jni 1.2.0 through 1.5.7-13 Out-of-Bounds Read via ZstdDictDecompress

zstd-jni versions 1.2.0 through 1.5.7-13 contain an out-of-bounds read vulnerability in the ZstdDictDecompress constructor because offset and length arguments are never validated against the dictionary array bounds. Attackers can supply arbitrary offset or length values to read memory past the en...

PT-2026-90720

Name of the Vulnerable Software and Affected Versions zstd-jni versions 1.2.0 through 1.5.7-13 Description An out-of-bounds read exists in the ZstdDictDecompress constructor. This occurs because the offset and length arguments are not validated against the dictionary array bounds, allowing an...

Linux Distros Unpatched Vulnerability : CVE-2026-90560

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - zstd-jni versions 1.2.0 through 1.5.7-13 contain an out-of-bounds read vulnerability in the ZstdDictDecompress constructor because offset and length arguments a...

OPENSUSE-SU-2026:11769-1 zstd-jni-1.5.7.16-1.1 on GA media

These are all security issues fixed in the zstd-jni-1.5.7.16-1.1 package on the GA media of openSUSE Tumbleweed...

CVE-2026-90560: Out-of-bounds Read

zstd-jni versions 1.2.0 through 1.5.7-13 contain an out-of-bounds read vulnerability in the ZstdDictDecompress constructor because offset and length arguments are never validated against the dictionary array bounds. Attackers can supply arbitrary offset or length values to read memory past the en...

SUSE CVE-2026-87795

zstd-jni versions before 1.5.7-14 fail to validate offset and length parameters in the ZstdDictCompress constructor, allowing out-of-bounds memory reads. Attackers can supply untrusted offset or length values to read native heap memory into the compression dictionary, typically causing JVM crashe...