Threat database

CVE-2026-90852 is a use-after-free vulnerability in the luben zstd-jni library, specifically affecting the ZstdCompressCtx.loadDict function in the Dictionary Sharing component. This flaw allows remote attackers to manipulate memory leading to use-after-free conditions. The vulnerability affects version 1.5.7-13 and was publicly disclosed with exploit code available. The issue is resolved by upgrading to version 1.5.7-14.

An out-of-bounds read vulnerability exists in the ZstdDictDecompress constructor of zstd-jni versions 1.2.0 through 1.5.7-13. This occurs because the offset and length parameters are not validated against the dictionary array bounds, allowing attackers to read memory beyond the intended array. This can potentially cause the Java Virtual Machine (JVM) to terminate unexpectedly.

An out-of-bounds read vulnerability exists in zstd-jni versions 1.5.5-6 through 1.5.7-13 in the Zstd.getFrameContentSize method. The flaw occurs because negative srcPosition arguments are not properly validated, allowing attackers to bypass bounds checks and cause out-of-bounds memory reads. This can lead to information disclosure or JVM crashes.

CVE-2026-89045 is a medium severity vulnerability in the zstd-jni library versions 1.4.8-4 through 1.5.7-13. It involves an infinite loop caused by failure to validate negative length parameters in the ZstdInputStreamNoFinalizer.read() method. This flaw allows attackers to cause the read method to spin indefinitely while holding a stream monitor, blocking other threads from accessing the stream.

CVE-2026-87877 is a use-after-free vulnerability in the luben zstd-jni library affecting versions from 1.3.8-4 up to but not including 1.5.7-14. The flaw arises because certain stream class methods do not validate the closed state before operating, allowing attackers to invoke these methods on closed streams. This can lead to writing through freed native pointers, potentially corrupting unrelated objects or causing the Java Virtual Machine (JVM) to crash. The vulnerability has a high severity score of 7.0 and does not currently have known exploits in the wild.

CVE-2026-87825 is a use-after-free vulnerability in zstd-jni before version 1.5.7-14. The issue arises because streams and contexts only hold a dictionary's shared lock during the load call, allowing the dictionary to be closed while still referenced. This can lead to subsequent operations accessing freed native memory, causing silent data corruption or JVM crashes.

CVE-2026-87824 is a high-severity vulnerability in the luben zstd-jni library before version 1.5.7-14. It involves an out-of-bounds read due to improper validation of the samples buffer capacity in the Zstd.trainFromBufferDirect function. Attackers can supply crafted sample length arrays that cause the native code to read beyond allocated buffer boundaries, potentially causing JVM termination.

CVE-2026-87823 is an integer overflow or wraparound vulnerability in the zstd-jni library before version 1.5.7-14. It arises from 32-bit signed bounds checks on certain native methods, allowing attackers to supply negative or overflowing offsets. This can cause out-of-bounds memory reads, potentially leading to JVM crashes or unauthorized reading of arbitrary memory data. The vulnerability has a high severity score of 8.8 and affects versions from 1.1.1 up to but not including 1.5.7-14.

CVE-2026-87795 is a high-severity vulnerability in the zstd-jni library before version 1.5.7-14. It involves an out-of-bounds read caused by improper validation of offset and length parameters in the ZstdDictCompress constructor. This flaw allows attackers to read native heap memory, potentially leading to JVM crashes.