CVE-2026-90560

Description

zstd-jni versions 1.2.0 through 1.5.7-13 contain an out-of-bounds read vulnerability in the ZstdDictDecompress constructor because offset and length arguments are never validated against the dictionary array bounds. Attackers can supply arbitrary offset or length values to read memory past the end of the supplied array, potentially causing JVM termination.

References

https://www.vulncheck.com/advisories/zstd-jni-1.2.0-through-1.5.7-13-out-of-bounds-read-via-zstddictdecompress

https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14

https://github.com/luben/zstd-jni/issues/405

https://github.com/luben/zstd-jni/commit/b74ab242d640c40897e62aab4c744ddfad1f915f

https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/ZstdDictDecompress.java#L49

https://github.com/luben/zstd-jni/blob/v1.2.0/src/main/java/com/github/luben/zstd/ZstdDictDecompress.java#L37

https://github.com/luben/zstd-jni

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3

CVSS v4