CVE-2026-87795
zstd-jni 1.2.0 through 1.5.7-13 Out-of-Bounds Read via ZstdDictCompress
zstd-jni versions before 1.5.7-14 fail to validate offset and length parameters in the ZstdDictCompress constructor, allowing out-of-bounds memory reads. Attackers can supply untrusted offset or length values to read native heap memory into the compression dictionary, typically causing JVM crashes.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
zstd-jni 1.2.0 through 1.5.7-13 Out-of-Bounds Read via ZstdDictCompress
zstd-jni versions before 1.5.7-14 fail to validate offset and length parameters in the ZstdDictCompress constructor, allowing out-of-bounds memory reads. Attackers can supply untrusted offset or length values to read native heap memory into the compression dictionary, typically causing JVM crashes.
- Record
CVE-2026-87795- CVSS 4.0
- 8.8 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H - Weakness
- CWE-125
- Updated
- 2026-11-02
EUVDEUVD-2026-74791
zstd-jni versions before 1.5.7-14 fail to validate offset and length parameters in the ZstdDictCompress constructor, allowing out-of-bounds memory reads. Attackers can supply untrusted offset or length values to read native heap memory into the compression dictionary, typically causing JVM crashes.
- Record
EUVD-2026-74791- CVSS 4.0
- 8.8 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-vc57-7frc-7vqx
zstd-jni versions before 1.5.7-14 fail to validate offset and length parameters in the...
zstd-jni versions before 1.5.7-14 fail to validate offset and length parameters in the ZstdDictCompress constructor, allowing out-of-bounds memory reads. Attackers can supply untrusted offset or length values to read native heap memory into the compression dictionary, typically causing JVM crashes.
- Record
GHSA-vc57-7frc-7vqx- CVSS 4.0
- 8.8 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H - Weakness
- CWE-125
- Updated
- 2026-11-02
NVD
zstd-jni versions before 1.5.7-14 fail to validate offset and length parameters in the ZstdDictCompress constructor, allowing out-of-bounds memory reads. Attackers can supply untrusted offset or length values to read native heap memory into the compression dictionary, typically causing JVM crashes.
- Record
CVE-2026-87795- CVSS 4.0
- 8.8 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H - Weakness
- CWE-125
- Updated
- 2026-11-02
OSV
zstd-jni 1.2.0 through 1.5.7-13 Out-of-Bounds Read via ZstdDictCompress
zstd-jni versions before 1.5.7-14 fail to validate offset and length parameters in the ZstdDictCompress constructor, allowing out-of-bounds memory reads. Attackers can supply untrusted offset or length values to read native heap memory into the compression dictionary, typically causing JVM crashes.
- Record
CVE-2026-87795- CVSS 4.0
- 8.8 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N - Weakness
- CWE-125
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-87795
zstd-jni versions before 1.5.7-14 fail to validate offset and length parameters in the ZstdDictCompress constructor, allowing out-of-bounds memory reads. Attackers can supply untrusted offset or length values to read native heap memory into the compression dictionary, typically causing JVM crashes.
- Record
DEBIAN-CVE-2026-87795- CVSS 4.0
- 8.8 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-87795
zstd-jni versions before 1.5.7-14 fail to validate offset and length parameters in the ZstdDictCompress constructor, allowing out-of-bounds memory reads. Attackers can supply untrusted offset or length values to read native heap memory into the compression dictionary, typically causing JVM crashes.
- Record
UBUNTU-CVE-2026-87795- CVSS 4.0
- 8.8 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
zstd-jni-javaDebian:12 |
All versions, plus listed versions 1.5.2-5+ds-31.5.2-5+ds-41.5.2-5+ds-51.5.2-5+ds-61.5.2-5+ds-7 Show 9 moreShow less1.5.2-5+ds-81.5.4-2+ds-11.5.4-2+ds-21.5.4-2+ds-3~exp11.5.4-2+ds-3~exp21.5.4-2+ds-3~exp31.5.4-2+ds-3~exp41.5.7-23+ds-11.5.7-23+ds-2 |
None known |
zstd-jni-javaDebian:13 |
All versions, plus listed versions 1.5.2-5+ds-71.5.2-5+ds-81.5.4-2+ds-11.5.4-2+ds-21.5.4-2+ds-3~exp1 Show 5 moreShow less1.5.4-2+ds-3~exp21.5.4-2+ds-3~exp31.5.4-2+ds-3~exp41.5.7-23+ds-11.5.7-23+ds-2 |
None known |
zstd-jni-javaDebian:14 |
before 1.5.7-23+ds-1, plus listed versions 1.5.2-5+ds-71.5.2-5+ds-81.5.4-2+ds-11.5.4-2+ds-21.5.4-2+ds-3~exp11.5.4-2+ds-3~exp21.5.4-2+ds-3~exp31.5.4-2+ds-3~exp4 |
1.5.7-23+ds-1 |
zstd-jni-javaUbuntu:24.04:LTS |
All versions, plus listed versions 1.5.2-5+ds-31.5.2-5+ds-3build1 |
None known |
zstd-jni-javaUbuntu:26.10 |
All versions, plus listed versions 1.5.2-5+ds-8 |
None known |
zstd-jni-javaUbuntu:26.04:LTS |
All versions, plus listed versions 1.5.2-5+ds-71.5.2-5+ds-7build11.5.2-5+ds-7ubuntu11.5.2-5+ds-8 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-87795 is a high vulnerability (CVSS 8.8) in Luben Zstd-jni, published September 9, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.63%, the 50th percentile. Fixed in zstd-jni-java 1.5.7-23+ds-1.
References
github.com/luben/zstd-jni/security/advisories/GHSA-ff36-7w3w-g8rm
Show 9 moreShow less
vulncheck.com/advisories/zstd-jni-1.2.0-through-1.5.7-13-out-of-bounds-read-via-zstddictcompress
nvd.nist.gov/vuln/detail/CVE-2026-87795
repo1.maven.org/maven2/com/github/luben/zstd-jni
security-tracker.debian.org/tracker/CVE-2026-87795
ubuntu.com/security/CVE-2026-87795
cve.org/CVERecord?id=CVE-2026-87795