EUVD-2026-76905
GHSA-392q-wrgq-6wmj
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable with no authentication required (PR:N/AV:N); confidentiality Low for partial memory exposure; availability High for JVM termination; no integrity impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
4DescriptionCVE.org
zstd-jni versions 1.2.0 through 1.5.7-13 contain an out-of-bounds read vulnerability in the ZstdDictDecompress constructor because offset and length arguments are never validated against the dictionary array bounds. Attackers can supply arbitrary offset or length values to read memory past the end of the supplied array, potentially causing JVM termination.
AnalysisAI
Out-of-bounds read in zstd-jni versions 1.2.0 through 1.5.7-13 exposes JVM-based applications to service termination and partial memory disclosure when attacker-controlled offset or length values are passed to the ZstdDictDecompress constructor without bounds validation. The missing guard allows values that exceed the backing byte array, causing the JNI layer to read past the array boundary into native memory, which can abort the JVM process. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation specifically requires use of the offset/length constructor variant ZstdDictDecompress(byte[] dict, int offset, int length) - applications using only the simpler ZstdDictDecompress(byte[] dict) constructor are not affected by this code path. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.8 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H) reflects a worst-case deployment where a network-facing application exposes the ZstdDictDecompress offset/length constructor to untrusted input - a realistic pattern in streaming data pipelines and message brokers. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade zstd-jni to version 1.5.7-14 or later; this release contains patch commit b74ab242d640c40897e62aab4c744ddfad1f915f, confirmed via the GitHub release tag at https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Java applications and microservices using zstd-jni and confirm their current versions; begin testing zstd-jni v1.5.7-14 in a non-production environment to verify compatibility. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Use-after-free in zstd-jni's Dictionary Sharing component allows remote attackers to corrupt native heap memory through
Out-of-bounds read in zstd-jni versions 1.2.0 through 1.5.7-13 allows attackers who can supply dictionary constructor pa
Out-of-bounds read in zstd-jni versions 1.5.5-6 through 1.5.7-13 exposes JVM-based applications to memory disclosure or
Out-of-bounds memory reads in zstd-jni versions 1.1.1 through 1.5.7-13 allow unauthenticated remote attackers to crash t
Out-of-bounds memory access in zstd-jni versions 1.3.3-1 through 1.5.7-13 enables unauthenticated network-accessible att
Use-after-free in zstd-jni versions 1.3.8-4 through 1.5.7-13 allows attackers to trigger silent data corruption or JVM c
Use-after-free in zstd-jni versions 1.3.8-4 through 1.5.7-13 allows callers to invoke setDict, setLongMax, setLevel, and
Infinite-loop denial of service in zstd-jni versions 1.4.8-4 through 1.5.7-13 allows thread starvation by passing negati
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today