Threats affecting pkg:maven/com.github.luben/zstd-jni

Multiple vulnerabilities in zstd-jni have been addressed in version v1.5.7.16. These include denial of service and information disclosure via out-of-bounds reads, as well as use-after-free issues that can cause memory corruption, silent data corruption, or JVM crashes.

CVE-2026-90852 is a use-after-free vulnerability in the luben zstd-jni library, specifically affecting the ZstdCompressCtx.loadDict function in the Dictionary Sharing component. This flaw allows remote attackers to manipulate memory leading to use-after-free conditions. The vulnerability affects version 1.5.7-13 and was publicly disclosed with exploit code available. The issue is resolved by upgrading to version 1.5.7-14.