Zstd Jni
Monthly
Out-of-bounds read in zstd-jni versions 1.5.5-6 through 1.5.7-13 exposes JVM-based applications to memory disclosure or process crashes when processing attacker-controlled Zstd-compressed data. The `Zstd.getFrameContentSize` method and `ZstdInputStreamNoFinalizer` both fail to reject negative `srcPosition` and `len` arguments before marshalling them into the native Zstd frame-header parser, allowing a negative value to bypass Java-side bounds checks and trigger out-of-bounds reads in the underlying C layer. No public exploit code or CISA KEV listing has been identified; the vendor-released fix is version 1.5.7-14.
Use-after-free in zstd-jni versions 1.3.8-4 through 1.5.7-13 allows callers to invoke setDict, setLongMax, setLevel, and setRefMultipleDDicts on already-closed stream objects, writing through freed native (JNI) pointers into arbitrary JVM memory. The root cause is missing closed-state validation in stream classes such as BaseZstdBufferDecompressingStreamNoFinalizer and ZstdInputStreamNoFinalizer, meaning the JNI layer operates on native context structures that have already been released. Exploitation can corrupt unrelated heap objects or terminate the JVM process entirely. No public exploit code or CISA KEV listing is identified at time of analysis.
Use-after-free in zstd-jni versions 1.3.8-4 through 1.5.7-13 allows attackers to trigger silent data corruption or JVM crashes by closing a Zstandard dictionary after it has been associated with a stream or context. The library's locking design released the dictionary's shared lock immediately after the load call, leaving the stream holding a native pointer to freed memory; subsequent read or write operations on that stream then access freed native heap, producing undefined behavior at the JVM/native boundary. No public exploit has been identified at time of analysis, and a patched release (v1.5.7-14) is available with two upstream commits.
Out-of-bounds memory access in zstd-jni versions 1.3.3-1 through 1.5.7-13 enables unauthenticated network-accessible attackers to crash the JVM by supplying crafted sample-size arrays to the Zstd.trainFromBufferDirect dictionary-training API. The native C implementation (jni_zdict.c) failed to sum caller-supplied sample lengths against the DirectBuffer's actual capacity before iterating, allowing the native code to walk past the buffer allocation boundary and trigger a hard JVM termination. A patched release (v1.5.7-14) is available; no public exploit has been identified at time of analysis.
Out-of-bounds memory reads in zstd-jni versions 1.1.1 through 1.5.7-13 allow unauthenticated remote attackers to crash the JVM or extract arbitrary frame-size data from unintended memory regions by supplying crafted Zstandard-compressed input with negative or integer-overflowing offset values. Three JNI native methods - findDirectByteBufferFrame, decompressedDirectByteBuffer, and getDirectByteBufferFrame - perform 32-bit signed bounds checks without first validating that src_offset or src_size are non-negative, allowing values near Integer.MIN_VALUE to pass the comparison and drive native code to read unmapped memory. The CVSS 4.0 score of 8.8 reflects a high availability impact (JVM termination) and limited confidentiality impact; no public exploit or KEV listing has been identified at time of analysis.
Out-of-bounds read in zstd-jni versions 1.2.0 through 1.5.7-13 allows attackers who can supply dictionary constructor parameters to crash the JVM and potentially read limited native heap memory. The ZstdDictCompress constructor passed unvalidated offset and length values directly to the C JNI layer, where out-of-range values cause the native code to read beyond the allocated Java heap array. No CISA KEV listing or public exploit has been identified; the CVSS 4.0 score of 8.8 reflects high availability impact via reliable JVM crash and limited confidentiality exposure from native heap reads.
Infinite-loop denial of service in zstd-jni versions 1.4.8-4 through 1.5.7-13 allows thread starvation by passing negative length values to ZstdInputStreamNoFinalizer.read(). Because the method is declared synchronized, the spinning loop holds the stream monitor indefinitely, blocking every other thread that attempts to call any synchronized method on the same stream object. Fixed in v1.5.7-14; no public exploit identified at time of analysis.
Out-of-bounds read in zstd-jni versions 1.5.5-6 through 1.5.7-13 exposes JVM-based applications to memory disclosure or process crashes when processing attacker-controlled Zstd-compressed data. The `Zstd.getFrameContentSize` method and `ZstdInputStreamNoFinalizer` both fail to reject negative `srcPosition` and `len` arguments before marshalling them into the native Zstd frame-header parser, allowing a negative value to bypass Java-side bounds checks and trigger out-of-bounds reads in the underlying C layer. No public exploit code or CISA KEV listing has been identified; the vendor-released fix is version 1.5.7-14.
Use-after-free in zstd-jni versions 1.3.8-4 through 1.5.7-13 allows callers to invoke setDict, setLongMax, setLevel, and setRefMultipleDDicts on already-closed stream objects, writing through freed native (JNI) pointers into arbitrary JVM memory. The root cause is missing closed-state validation in stream classes such as BaseZstdBufferDecompressingStreamNoFinalizer and ZstdInputStreamNoFinalizer, meaning the JNI layer operates on native context structures that have already been released. Exploitation can corrupt unrelated heap objects or terminate the JVM process entirely. No public exploit code or CISA KEV listing is identified at time of analysis.
Use-after-free in zstd-jni versions 1.3.8-4 through 1.5.7-13 allows attackers to trigger silent data corruption or JVM crashes by closing a Zstandard dictionary after it has been associated with a stream or context. The library's locking design released the dictionary's shared lock immediately after the load call, leaving the stream holding a native pointer to freed memory; subsequent read or write operations on that stream then access freed native heap, producing undefined behavior at the JVM/native boundary. No public exploit has been identified at time of analysis, and a patched release (v1.5.7-14) is available with two upstream commits.
Out-of-bounds memory access in zstd-jni versions 1.3.3-1 through 1.5.7-13 enables unauthenticated network-accessible attackers to crash the JVM by supplying crafted sample-size arrays to the Zstd.trainFromBufferDirect dictionary-training API. The native C implementation (jni_zdict.c) failed to sum caller-supplied sample lengths against the DirectBuffer's actual capacity before iterating, allowing the native code to walk past the buffer allocation boundary and trigger a hard JVM termination. A patched release (v1.5.7-14) is available; no public exploit has been identified at time of analysis.
Out-of-bounds memory reads in zstd-jni versions 1.1.1 through 1.5.7-13 allow unauthenticated remote attackers to crash the JVM or extract arbitrary frame-size data from unintended memory regions by supplying crafted Zstandard-compressed input with negative or integer-overflowing offset values. Three JNI native methods - findDirectByteBufferFrame, decompressedDirectByteBuffer, and getDirectByteBufferFrame - perform 32-bit signed bounds checks without first validating that src_offset or src_size are non-negative, allowing values near Integer.MIN_VALUE to pass the comparison and drive native code to read unmapped memory. The CVSS 4.0 score of 8.8 reflects a high availability impact (JVM termination) and limited confidentiality impact; no public exploit or KEV listing has been identified at time of analysis.
Out-of-bounds read in zstd-jni versions 1.2.0 through 1.5.7-13 allows attackers who can supply dictionary constructor parameters to crash the JVM and potentially read limited native heap memory. The ZstdDictCompress constructor passed unvalidated offset and length values directly to the C JNI layer, where out-of-range values cause the native code to read beyond the allocated Java heap array. No CISA KEV listing or public exploit has been identified; the CVSS 4.0 score of 8.8 reflects high availability impact via reliable JVM crash and limited confidentiality exposure from native heap reads.
Infinite-loop denial of service in zstd-jni versions 1.4.8-4 through 1.5.7-13 allows thread starvation by passing negative length values to ZstdInputStreamNoFinalizer.read(). Because the method is declared synchronized, the spinning loop holds the stream monitor indefinitely, blocking every other thread that attempts to call any synchronized method on the same stream object. Fixed in v1.5.7-14; no public exploit identified at time of analysis.