Every CVE Search/ Get API key

CVE-2026-87877

zstd-jni 1.3.8-4 through 1.5.7-13 Use-After-Free via Setters Called After close()

7.0 HighFix available

zstd-jni versions before 1.5.7-14 fail to validate closed state in setDict, setLongMax, setLevel and setRefMultipleDDicts methods of stream classes. Attackers can call these methods on closed streams to write through freed native pointers, corrupting unrelated objects or crashing the JVM.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
High
Availability
High

Exploit likelihood

0.22%Unchanged since Sep 10, 2026
90%50%10%1%

What each source reports

CVE List Score used 7.0

zstd-jni 1.3.8-4 through 1.5.7-13 Use-After-Free via Setters Called After close()

zstd-jni versions before 1.5.7-14 fail to validate closed state in setDict, setLongMax, setLevel and setRefMultipleDDicts methods of stream classes. Attackers can call these methods on closed streams to write through freed native pointers, corrupting unrelated objects or crashing the JVM.

Record
CVE-2026-87877
CVSS 4.0
7.0 HighCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
7.7 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Weakness
CWE-416
Updated
2026-11-02
EUVDEUVD-2026-75024 7.0

zstd-jni versions before 1.5.7-14 fail to validate closed state in setDict, setLongMax, setLevel and setRefMultipleDDicts methods of stream classes. Attackers can call these methods on closed streams to write through freed native pointers, corrupting unrelated objects or crashing the JVM.

Record
EUVD-2026-75024
CVSS 4.0
7.0 HighCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-mwq5-v3w5-qr6v 7.0

zstd-jni versions before 1.5.7-14 fail to validate closed state in setDict, setLongMax, setLevel...

zstd-jni versions before 1.5.7-14 fail to validate closed state in setDict, setLongMax, setLevel and setRefMultipleDDicts methods of stream classes. Attackers can call these methods on closed streams to write through freed native pointers, corrupting unrelated objects or crashing the JVM.

Record
GHSA-mwq5-v3w5-qr6v
CVSS 4.0
7.0 HighCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
7.7 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Weakness
CWE-416
Updated
2026-11-02
NVD 7.0

zstd-jni versions before 1.5.7-14 fail to validate closed state in setDict, setLongMax, setLevel and setRefMultipleDDicts methods of stream classes. Attackers can call these methods on closed streams to write through freed native pointers, corrupting unrelated objects or crashing the JVM.

Record
CVE-2026-87877
CVSS 4.0
7.0 HighCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
7.7 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Weakness
CWE-416
Updated
2026-11-02
OSV 7.0

zstd-jni 1.3.8-4 through 1.5.7-13 Use-After-Free via Setters Called After close()

zstd-jni versions before 1.5.7-14 fail to validate closed state in setDict, setLongMax, setLevel and setRefMultipleDDicts methods of stream classes. Attackers can call these methods on closed streams to write through freed native pointers, corrupting unrelated objects or crashing the JVM.

Record
CVE-2026-87877
CVSS 4.0
7.0 HighCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-416
Updated
2026-11-02
OSVDEBIAN-CVE-2026-87877 7.0

zstd-jni versions before 1.5.7-14 fail to validate closed state in setDict, setLongMax, setLevel and setRefMultipleDDicts methods of stream classes. Attackers can call these methods on closed streams to write through freed native pointers, corrupting unrelated objects or crashing the JVM.

Record
DEBIAN-CVE-2026-87877
CVSS 4.0
7.0 HighCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
Show 4 moreShow less
OSVUBUNTU-CVE-2026-87877 7.0

zstd-jni versions before 1.5.7-14 fail to validate closed state in setDict, setLongMax, setLevel and setRefMultipleDDicts methods of stream classes. Attackers can call these methods on closed streams to write through freed native pointers, corrupting unrelated objects or crashing the JVM.

Record
UBUNTU-CVE-2026-87877
CVSS 4.0
7.0 HighCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
7.7 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Updated
2026-11-02
OSVopenSUSE-SU-2026:21902-1 No score

Security update for zstd-jni

This update for zstd-jni fixes the following issues:

  • CVE-2026-87823: denial of Service or Information Disclosure via out-of-bounds read (bsc#1279953).
  • CVE-2026-87824: denial of Service (DoS) via out-of-bounds read in Zstd.trainFromBufferDirect (bsc#1279956).
  • CVE-2026-87825: use-after-free resulting in silent data corruption or JVM crashes (bsc#1279955).
  • CVE-2026-87877: use-After-Free vulnerability allows memory corruption and denial of service (bsc#1279954).

Changes for zstd-jni:

  • update to version v1.5.7.16.
Record
openSUSE-SU-2026:21902-1
Updated
2026-11-02
OSVSUSE-SU-2026:23858-1 No score

Security update for zstd-jni

This update for zstd-jni fixes the following issues:

  • CVE-2026-87823: denial of Service or Information Disclosure via out-of-bounds read (bsc#1279953).
  • CVE-2026-87824: denial of Service (DoS) via out-of-bounds read in Zstd.trainFromBufferDirect (bsc#1279956).
  • CVE-2026-87825: use-after-free resulting in silent data corruption or JVM crashes (bsc#1279955).
  • CVE-2026-87877: use-After-Free vulnerability allows memory corruption and denial of service (bsc#1279954).

Changes for zstd-jni:

  • update to version v1.5.7.16.
Record
SUSE-SU-2026:23858-1
Updated
2026-11-02
OSVSUSE-SU-2026:23868-1 No score

Security update for zstd-jni

This update for zstd-jni fixes the following issues:

  • CVE-2026-87823: denial of Service or Information Disclosure via out-of-bounds read (bsc#1279953).
  • CVE-2026-87824: denial of Service (DoS) via out-of-bounds read in Zstd.trainFromBufferDirect (bsc#1279956).
  • CVE-2026-87825: use-after-free resulting in silent data corruption or JVM crashes (bsc#1279955).
  • CVE-2026-87877: use-After-Free vulnerability allows memory corruption and denial of service (bsc#1279954).

Changes for zstd-jni:

  • update to version v1.5.7.16.
Record
SUSE-SU-2026:23868-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
zstd-jni-java
Debian:12
 All versions, plus listed versions
1.5.2-5+ds-31.5.2-5+ds-41.5.2-5+ds-51.5.2-5+ds-61.5.2-5+ds-7
Show 9 moreShow less
1.5.2-5+ds-81.5.4-2+ds-11.5.4-2+ds-21.5.4-2+ds-3~exp11.5.4-2+ds-3~exp21.5.4-2+ds-3~exp31.5.4-2+ds-3~exp41.5.7-23+ds-11.5.7-23+ds-2
 None known
zstd-jni-java
Debian:13
 All versions, plus listed versions
1.5.2-5+ds-71.5.2-5+ds-81.5.4-2+ds-11.5.4-2+ds-21.5.4-2+ds-3~exp1
Show 5 moreShow less
1.5.4-2+ds-3~exp21.5.4-2+ds-3~exp31.5.4-2+ds-3~exp41.5.7-23+ds-11.5.7-23+ds-2
 None known
zstd-jni-java
Debian:14
 before 1.5.7-23+ds-1, plus listed versions
1.5.2-5+ds-71.5.2-5+ds-81.5.4-2+ds-11.5.4-2+ds-21.5.4-2+ds-3~exp11.5.4-2+ds-3~exp21.5.4-2+ds-3~exp31.5.4-2+ds-3~exp4
1.5.7-23+ds-1
zstd-jni
SUSE:Linux Enterprise Server 16.0
From an advisory covering 4 CVEs
 before 1.5.7.16-160000.1.1
1.5.7.16-160000.1.1
zstd-jni
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 4 CVEs
 before 1.5.7.16-160000.1.1
1.5.7.16-160000.1.1
zstd-jni-java
Ubuntu:24.04:LTS
 All versions, plus listed versions
1.5.2-5+ds-31.5.2-5+ds-3build1
 None known
zstd-jni-java
Ubuntu:26.10
 All versions, plus listed versions
1.5.2-5+ds-8
 None known
zstd-jni-java
Ubuntu:26.04:LTS
 All versions, plus listed versions
1.5.2-5+ds-71.5.2-5+ds-7build11.5.2-5+ds-7ubuntu11.5.2-5+ds-8
 None known
zstd-jni
openSUSE:Leap 16.0
From an advisory covering 4 CVEs
 before 1.5.7.16-160000.1.1
1.5.7.16-160000.1.1

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-87877 is a high vulnerability (CVSS 7.0) in Luben Zstd-jni, published September 9, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.22%, the 12th percentile. Fixed in zstd-jni-java 1.5.7-23+ds-1.

References

Show 20 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open