zstd-jni before 1.5.7-14 fails to validate the samples buffer capacity in Zstd.trainFromBufferDirect, allowing attackers to read past buffer boundaries by supplying oversized per-sample lengths. Attackers can trigger out-of-bounds memory access by providing crafted sample length arrays that cause the native implementation to walk past the buffer allocation, resulting in JVM termination.

The remote SUSE Linux SLES16 / SLES_SAP16 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:23868-1 advisory.

    - CVE-2026-87823: denial of Service or Information Disclosure via out-of-bounds read (bsc#1279953).
    - CVE-2026-87824: denial of Service (DoS) via out-of-bounds read in Zstd.trainFromBufferDirect     (bsc#1279956).
    - CVE-2026-87825: use-after-free resulting in silent data corruption or JVM crashes (bsc#1279955).
    - CVE-2026-87877: use-After-Free vulnerability allows memory corruption and denial of service     (bsc#1279954).

    Changes for zstd-jni:

    - update to version v1.5.7.16.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21902-1 advisory.

    - CVE-2026-87823: denial of Service or Information Disclosure via out-of-bounds read (bsc#1279953).
    - CVE-2026-87824: denial of Service (DoS) via out-of-bounds read in Zstd.trainFromBufferDirect     (bsc#1279956).
    - CVE-2026-87825: use-after-free resulting in silent data corruption or JVM crashes (bsc#1279955).
    - CVE-2026-87877: use-After-Free vulnerability allows memory corruption and denial of service     (bsc#1279954).

    Changes for zstd-jni:

    - update to version v1.5.7.16.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - zstd-jni before 1.5.7-14 fails to validate the samples buffer capacity in Zstd.trainFromBufferDirect,     allowing attackers to read past buffer boundaries by supplying oversized per-sample lengths. Attackers can     trigger out-of-bounds memory access by providing crafted sample length arrays that cause the native     implementation to walk past the buffer allocation, resulting in JVM termination. (CVE-2026-87824)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
350833	SUSE SLES16 Security Update : zstd-jni (SUSE-SU-2026:23868-1)	Nessus	SuSE Local Security Checks	Local	high
350142	openSUSE 16 Security Update : zstd-jni (openSUSE-SU-2026:21902-1)	Nessus	SuSE Local Security Checks	Local	high
344425	Linux Distros Unpatched Vulnerability : CVE-2026-87824	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-87824

high

Tenable Plugins

high

high

high