{"id":"CVE-2019-11922","aliases":["ALPINE-CVE-2019-11922","BELL-CVE-2019-11922","DEBIAN-CVE-2019-11922","EUVD-2019-3580","GHSA-w77f-wv46-4vcx","MGASA-2019-0257","UBUNTU-CVE-2019-11922","USN-4108-1","USN-5593-1","openSUSE-SU-2019:1845-1","openSUSE-SU-2019:1952-1","openSUSE-SU-2019:2008-1","openSUSE-SU-2024:11544-1"],"status":"published","title":"A race condition in the one-pass compression functions of Zstandard prior to version 1.3.8 could...","description":"A race condition in the one-pass compression functions of Zstandard prior to version 1.3.8 could allow an attacker to write bytes out of bounds if an output buffer smaller than the recommended size was used.","severity":{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01419,"percentile":0.72994,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1395","CWE-362"],"published":"2019-07-25T00:00:00Z","modified":"2026-10-30T10:45:38Z","fixes":[{"ecosystem":"Alpine:v3.11","package":"zstd","fixed_in":["1.3.8-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"zstd","fixed_in":["1.3.8-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"zstd","fixed_in":["1.3.8-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"zstd","fixed_in":["1.3.8-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"zstd","fixed_in":["1.3.8-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"zstd","fixed_in":["1.3.8-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"zstd","fixed_in":["1.3.8-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"zstd","fixed_in":["1.3.8-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"zstd","fixed_in":["1.3.8-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"zstd","fixed_in":["1.3.8-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"zstd","fixed_in":["1.3.8-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"zstd","fixed_in":["1.3.8-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"zstd","fixed_in":["1.3.8-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"zstd","fixed_in":["1.3.8-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libzstd","fixed_in":["1.3.8+dfsg-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libzstd","fixed_in":["1.3.8+dfsg-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libzstd","fixed_in":["1.3.8+dfsg-2"],"sources":["osv"]},{"ecosystem":"Mageia:6","package":"zstd","fixed_in":["1.3.8-1.mga6"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libzstd","fixed_in":["1.3.1+dfsg-1~ubuntu0.16.04.1+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"libzstd","fixed_in":["1.3.3+dfsg-2ubuntu1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.1","package":"zstd","fixed_in":["1.4.2-lp151.3.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.0","package":"zstd","fixed_in":["1.4.2-lp150.2.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 15","package":"zstd","fixed_in":["1.4.2-bp151.4.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 15 SP1","package":"zstd","fixed_in":["1.4.2-bp151.4.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"zstd","fixed_in":["1.5.0-1.13"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.11","package":"zstd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.8-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"zstd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.8-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"zstd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.8-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"zstd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.8-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"zstd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.8-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"zstd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.8-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"zstd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.8-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"zstd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.8-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"zstd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.8-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"zstd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.8-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"zstd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.8-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"zstd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.8-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"zstd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.8-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"zstd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.8-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libzstd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.8+dfsg-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libzstd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.8+dfsg-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libzstd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.8+dfsg-2"}]}]},{"source":"osv","ecosystem":"Mageia:6","package":"zstd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.8-1.mga6"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libzstd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.1+dfsg-1~ubuntu0.16.04.1+esm2"}]}],"versions":["0.4.5-1","0.5.1-1","1.3.1+dfsg-1~ubuntu0.16.04.1","1.3.1+dfsg-1~ubuntu0.16.04.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libzstd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.3+dfsg-2ubuntu1.1"}]}],"versions":["1.3.1+dfsg-1","1.3.2+dfsg-1","1.3.2+dfsg2-1","1.3.3+dfsg-1","1.3.3+dfsg-1ubuntu1","1.3.3+dfsg-2ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libzstd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.3+dfsg-2ubuntu1.1"}]}],"versions":["1.3.1+dfsg-1","1.3.2+dfsg-1","1.3.2+dfsg2-1","1.3.3+dfsg-1","1.3.3+dfsg-1ubuntu1","1.3.3+dfsg-2ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libzstd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.1+dfsg-1~ubuntu0.16.04.1+esm2"}]}],"versions":["0.4.5-1","0.5.1-1","1.3.1+dfsg-1~ubuntu0.16.04.1","1.3.1+dfsg-1~ubuntu0.16.04.1+esm1"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"zstd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2-lp151.3.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.0","package":"zstd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2-lp150.2.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Package Hub 15","package":"zstd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2-bp151.4.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP1","package":"zstd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2-bp151.4.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"zstd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.0-1.13"}]}]}],"products":[{"vendor":"facebook","product":"zstandard"}],"references":[{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00008.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00062.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://usn.ubuntu.com/4108-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00078.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://www.oracle.com/security-alerts/cpuoct2020.html","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://www.facebook.com/security/advisories/cve-2019-11922","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","report"]},{"url":"https://github.com/facebook/zstd/pull/1404/commits/3e5cdf1b6a85843e991d7d10f6a2567c15580da0","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-11922"},{"url":"https://usn.ubuntu.com/4108-1"},{"url":"https://github.com/advisories/GHSA-w77f-wv46-4vcx","tags":["advisory"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2019-11922","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2019-11922","tags":["advisory"]},{"url":"https://cpan.org/modules","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/14xxx/CVE-2024-14030.json","tags":["advisory"]},{"url":"https://metacpan.org/release/YVES/Sereal-Decoder-4.010/changes","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-14030","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-11922","tags":["advisory","report"]},{"url":"https://github.com/Sereal/Sereal","tags":["package"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/14xxx/CVE-2024-14031.json","tags":["advisory"]},{"url":"https://metacpan.org/release/YVES/Sereal-Encoder-4.010/changes","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-14031","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-11922","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2019-0257.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=25375","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-11922","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4108-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-5593-1","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/QXHXFC7RU7NI42XMFKHE6KI6JEJOMZ3W/#QXHXFC7RU7NI42XMFKHE6KI6JEJOMZ3W","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1082318","tags":["report"]},{"url":"https://bugzilla.suse.com/1133297","tags":["report"]},{"url":"https://bugzilla.suse.com/1142941","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11922","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/HT6YNXG36NBKEYPS62NKEGLNJE6LYX7J/#HT6YNXG36NBKEYPS62NKEGLNJE6LYX7J","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/K7K2UOXWEY5FAQGWUDI7235YCQ2R5UPH/#K7K2UOXWEY5FAQGWUDI7235YCQ2R5UPH","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2019-11922","description":"A race condition in the one-pass compression functions of Zstandard prior to version 1.3.8 could allow an attacker to write bytes out of bounds if an output buffer smaller than the recommended size was used.","status":"published","published":"2019-07-25T20:32:44Z","modified":"2024-08-04T23:10:29.677Z","updated_at":"2026-11-02T14:20:26.416173Z"}],"euvd":[{"id":"EUVD-2019-3580","description":"A race condition in the one-pass compression functions of Zstandard prior to version 1.3.8 could allow an attacker to write bytes out of bounds if an output buffer smaller than the recommended size was used.","status":"published","published":"2019-07-25T20:32:44Z","modified":"2024-08-04T23:10:29Z","updated_at":"2026-11-03T02:40:47.960625Z"}],"ghsa":[{"id":"GHSA-w77f-wv46-4vcx","title":"A race condition in the one-pass compression functions of Zstandard prior to version 1.3.8 could...","description":"A race condition in the one-pass compression functions of Zstandard prior to version 1.3.8 could allow an attacker to write bytes out of bounds if an output buffer smaller than the recommended size was used.","status":"published","published":"2022-05-24T16:51:23Z","modified":"2024-04-04T01:22:10Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-362"],"updated_at":"2026-11-02T14:55:57.831324Z"}],"nvd":[{"id":"CVE-2019-11922","description":"A race condition in the one-pass compression functions of Zstandard prior to version 1.3.8 could allow an attacker to write bytes out of bounds if an output buffer smaller than the recommended size was used.","status":"published","published":"2019-07-25T21:15:11.6Z","modified":"2026-06-17T02:13:50.39Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-362"],"updated_at":"2026-11-02T14:05:21.892729Z"}],"osv":[{"id":"ALPINE-CVE-2019-11922","description":"A race condition in the one-pass compression functions of Zstandard prior to version 1.3.8 could allow an attacker to write bytes out of bounds if an output buffer smaller than the recommended size was used.","status":"published","published":"2019-07-25T21:15:11.6Z","modified":"2026-09-21T06:17:52.461857483Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:47.663013Z"},{"id":"BELL-CVE-2019-11922","title":"CVE-2019-11922 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:13:40.125622Z","modified":"2026-09-04T07:15:03.353582268Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:15.340685Z"},{"id":"CVE-2019-11922","description":"A race condition in the one-pass compression functions of Zstandard prior to version 1.3.8 could allow an attacker to write bytes out of bounds if an output buffer smaller than the recommended size was used.","status":"published","published":"2019-07-25T21:15:11.6Z","modified":"2026-10-30T10:45:38.912550369Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:10.718934Z"},{"id":"CVE-2024-14030","title":"Sereal::Decoder versions from 4.000 through 4.009_002 for Perl embeds a vulnerable version of the Zstandard library","description":"Sereal::Decoder versions from 4.000 through 4.009_002 for Perl embeds a vulnerable version of the Zstandard library.\n\nSereal::Decoder embeds a version of the Zstandard (zstd) library that is vulnerable to CVE-2019-11922.  This is a race condition in the one-pass compression functions of Zstandard prior to version 1.3.8 could allow an attacker to write bytes out of bounds if an output buffer smaller than the recommended size was used.","status":"published","published":"2026-03-31T11:31:08.541Z","modified":"2026-10-28T02:31:14.838560957Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-1395"],"updated_at":"2026-11-02T15:44:37.917085Z"},{"id":"CVE-2024-14031","title":"Sereal::Encoder versions from 4.000 through 4.009_002 for Perl embeds a vulnerable version of the Zstandard library","description":"Sereal::Encoder versions from 4.000 through 4.009_002 for Perl embeds a vulnerable version of the Zstandard library.\n\nSereal::Encoder embeds a version of the Zstandard (zstd) library that is vulnerable to CVE-2019-11922.  This is a race condition in the one-pass compression functions of Zstandard prior to version 1.3.8 could allow an attacker to write bytes out of bounds if an output buffer smaller than the recommended size was used.","status":"published","published":"2026-03-31T11:31:28.1Z","modified":"2026-10-28T02:30:46.849077632Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-1395"],"updated_at":"2026-11-02T15:44:37.917085Z"},{"id":"DEBIAN-CVE-2019-11922","description":"A race condition in the one-pass compression functions of Zstandard prior to version 1.3.8 could allow an attacker to write bytes out of bounds if an output buffer smaller than the recommended size was used.","status":"published","published":"2019-07-25T21:15:11.6Z","modified":"2026-09-21T07:01:45.989124229Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:31.467893Z"},{"id":"UBUNTU-CVE-2019-11922","description":"A race condition in the one-pass compression functions of Zstandard prior to version 1.3.8 could allow an attacker to write bytes out of bounds if an output buffer smaller than the recommended size was used.","status":"published","published":"2019-07-25T00:00:00Z","modified":"2026-04-22T12:08:01.943011Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:19.202697Z"},{"id":"MGASA-2019-0257","title":"Updated zstd packages fix security vulnerability","description":"Updated zstd packages fix security vulnerability:\n\nIt was discovered that Zstandard incorrectly handled certain inputs.\nAn attacker could possibly use this issue to execute arbitrary code\n(CVE-2019-11922).\n","status":"published","published":"2019-09-06T21:09:08Z","modified":"2026-04-16T04:42:38.316083224Z","updated_at":"2026-11-02T15:49:40.793816Z"},{"id":"openSUSE-SU-2019:1845-1","title":"Security update for zstd","description":"This update for zstd to version 1.4.2 fixes the following issues:\n\nSecurity issues fixed:\n\t  \n- CVE-2019-11922: Fixed race condition in one-pass compression functions that could allow out of bounds write (boo#1142941).\n\nNon-security issues fixed:\n\t  \n- Added --[no-]compress-literals CLI flag to enable or disable literal compression.\n- Added new --rsyncable mode.\n- Added handling of -f flag to zstdgrep.\n- Added CPU load indicator for each file on -vv mode.\n- Changed --no-progress flag to preserve the final summary.\n- Added new command --adapt for compressed network piping of data adjusted to the perceived network conditions.\n","status":"published","published":"2019-08-12T14:08:51Z","modified":"2026-02-04T03:06:47.202652Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2019:1952-1","title":"Security update for zstd","description":"This update for zstd fixes the following issues:\n\n- Update to version 1.4.2:\n  * bug: Fix bug in zstd-0.5 decoder by @terrelln (#1696)\n  * bug: Fix seekable decompression in-memory API by @iburinoc (#1695)\n  * bug: Close minor memory leak in CLI by @LeeYoung624 (#1701)\n  * misc: Validate blocks are smaller than size limit by @vivekmig (#1685)\n  * misc: Restructure source files by @ephiepark (#1679)\n\n- Update to version 1.4.1:\n  * bug: Fix data corruption in niche use cases by @terrelln (#1659)\n  * bug: Fuzz legacy modes, fix uncovered bugs by @terrelln (#1593, #1594, #1595)\n  * bug: Fix out of bounds read by @terrelln (#1590)\n  * perf: Improve decode speed by ~7% @mgrice (#1668)\n  * perf: Slightly improved compression ratio of level 3 and 4 (ZSTD_dfast) by @cyan4973 (#1681)\n  * perf: Slightly faster compression speed when re-using a context by @cyan4973 (#1658)\n  * perf: Improve compression ratio for small windowLog by @cyan4973 (#1624)\n  * perf: Faster compression speed in high compression mode for repetitive data by @terrelln (#1635)\n  * api: Add parameter to generate smaller dictionaries by @tyler-tran (#1656)\n  * cli: Recognize symlinks when built in C99 mode by @felixhandte (#1640)\n  * cli: Expose cpu load indicator for each file on -vv mode by @ephiepark (#1631)\n  * cli: Restrict read permissions on destination files by @chungy (#1644)\n  * cli: zstdgrep: handle -f flag by @felixhandte (#1618)\n  * cli: zstdcat: follow symlinks by @vejnar (#1604)\n  * doc: Remove extra size limit on compressed blocks by @felixhandte (#1689)\n  * doc: Fix typo by @yk-tanigawa (#1633)\n  * doc: Improve documentation on streaming buffer sizes by @cyan4973 (#1629)\n  * build: CMake: support building with LZ4 @leeyoung624 (#1626)\n  * build: CMake: install zstdless and zstdgrep by @leeyoung624 (#1647)\n  * build: CMake: respect existing uninstall target by @j301scott (#1619)\n  * build: Make: skip multithread tests when built without support by @michaelforney (#1620)\n  * build: Make: Fix examples/ test target by @sjnam (#1603)\n  * build: Meson: rename options out of deprecated namespace by @lzutao (#1665)\n  * build: Meson: fix build by @lzutao (#1602)\n  * build: Visual Studio: don't export symbols in static lib by @scharan (#1650)\n  * build: Visual Studio: fix linking by @absotively (#1639)\n  * build: Fix MinGW-W64 build by @myzhang1029 (#1600)\n  * misc: Expand decodecorpus coverage by @ephiepark (#1664)\n\n- Add baselibs.conf: libarchive gained zstd support and provides\n  -32bit libraries. This means, zstd also needs to provide -32bit\n  libs.\n\n- Update to new upstream release 1.4.0\n  * perf: level 1 compression speed was improved\n  * cli: added --[no-]compress-literals flag to enable or disable\n    literal compression\n- Reword 'real-time' in description by some actual statistics,\n  because 603MB/s (lowest zstd level) is not 'real-time' for\n  quite some applications.\n\n- zstd 1.3.8:\n  * better decompression speed on large files (+7%) and cold\n    dictionaries (+15%)\n  * slightly better compression ratio at high compression modes\n  * new --rsyncable mode\n  * support decompression of empty frames into NULL (used to be an\n    error)\n  * support ZSTD_CLEVEL environment variable\n  * --no-progress flag, preserving final summary\n  * various CLI fixes\n  * fix race condition in one-pass compression functions that could\n    allow out of bounds write (CVE-2019-11922, boo#1142941)\n\n- zstd 1.3.7:\n  * fix ratio for dictionary compression at levels 9 and 10\n  * add man pages for zstdless and zstdgrep\n- includes changes from zstd 1.3.6:\n  * faster dictionary builder, also the new default for --train\n  * previous (slower, slightly higher quality) dictionary builder\n    to be selected via --train-cover\n  * Faster dictionary decompression and compression under memory\n    limits with many dictionaries used simultaneously\n  * New command --adapt for compressed network piping of data\n    adjusted to the perceived network conditions\n\n- update to 1.3.5:\n  * much faster dictionary compression\n  * small quality improvement for dictionary generation\n  * slightly improved performance at high compression levels\n  * automatic memory release for long duration contexts\n  * fix overlapLog can be manually set\n  * fix decoding invalid lz4 frames\n  * fix performance degradation for dictionary compression when\n    using advanced API\n\n- fix pzstd tests\n- enable pzstd (parallel zstd)\n\n- Use %license instead of %doc [boo#1082318]\n- Add disk _constraints to fix ppc64le build\n- Use FAT LTO objects in order to provide proper static library (boo#1133297).\n\n","status":"published","published":"2019-08-19T11:36:36Z","modified":"2026-02-04T03:05:57.155123Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2019:2008-1","title":"Security update for zstd","description":"This update for zstd fixes the following issues:\n\n- Update to version 1.4.2:\n  * bug: Fix bug in zstd-0.5 decoder by @terrelln (#1696)\n  * bug: Fix seekable decompression in-memory API by @iburinoc (#1695)\n  * bug: Close minor memory leak in CLI by @LeeYoung624 (#1701)\n  * misc: Validate blocks are smaller than size limit by @vivekmig (#1685)\n  * misc: Restructure source files by @ephiepark (#1679)\n\n- Update to version 1.4.1:\n  * bug: Fix data corruption in niche use cases by @terrelln (#1659)\n  * bug: Fuzz legacy modes, fix uncovered bugs by @terrelln (#1593, #1594, #1595)\n  * bug: Fix out of bounds read by @terrelln (#1590)\n  * perf: Improve decode speed by ~7% @mgrice (#1668)\n  * perf: Slightly improved compression ratio of level 3 and 4 (ZSTD_dfast) by @cyan4973 (#1681)\n  * perf: Slightly faster compression speed when re-using a context by @cyan4973 (#1658)\n  * perf: Improve compression ratio for small windowLog by @cyan4973 (#1624)\n  * perf: Faster compression speed in high compression mode for repetitive data by @terrelln (#1635)\n  * api: Add parameter to generate smaller dictionaries by @tyler-tran (#1656)\n  * cli: Recognize symlinks when built in C99 mode by @felixhandte (#1640)\n  * cli: Expose cpu load indicator for each file on -vv mode by @ephiepark (#1631)\n  * cli: Restrict read permissions on destination files by @chungy (#1644)\n  * cli: zstdgrep: handle -f flag by @felixhandte (#1618)\n  * cli: zstdcat: follow symlinks by @vejnar (#1604)\n  * doc: Remove extra size limit on compressed blocks by @felixhandte (#1689)\n  * doc: Fix typo by @yk-tanigawa (#1633)\n  * doc: Improve documentation on streaming buffer sizes by @cyan4973 (#1629)\n  * build: CMake: support building with LZ4 @leeyoung624 (#1626)\n  * build: CMake: install zstdless and zstdgrep by @leeyoung624 (#1647)\n  * build: CMake: respect existing uninstall target by @j301scott (#1619)\n  * build: Make: skip multithread tests when built without support by @michaelforney (#1620)\n  * build: Make: Fix examples/ test target by @sjnam (#1603)\n  * build: Meson: rename options out of deprecated namespace by @lzutao (#1665)\n  * build: Meson: fix build by @lzutao (#1602)\n  * build: Visual Studio: don't export symbols in static lib by @scharan (#1650)\n  * build: Visual Studio: fix linking by @absotively (#1639)\n  * build: Fix MinGW-W64 build by @myzhang1029 (#1600)\n  * misc: Expand decodecorpus coverage by @ephiepark (#1664)\n\n- Add baselibs.conf: libarchive gained zstd support and provides\n  -32bit libraries. This means, zstd also needs to provide -32bit\n  libs.\n\n- Update to new upstream release 1.4.0\n  * perf: level 1 compression speed was improved\n  * cli: added --[no-]compress-literals flag to enable or disable\n    literal compression\n- Reword 'real-time' in description by some actual statistics,\n  because 603MB/s (lowest zstd level) is not 'real-time' for\n  quite some applications.\n\n- zstd 1.3.8:\n  * better decompression speed on large files (+7%) and cold\n    dictionaries (+15%)\n  * slightly better compression ratio at high compression modes\n  * new --rsyncable mode\n  * support decompression of empty frames into NULL (used to be an\n    error)\n  * support ZSTD_CLEVEL environment variable\n  * --no-progress flag, preserving final summary\n  * various CLI fixes\n  * fix race condition in one-pass compression functions that could\n    allow out of bounds write (CVE-2019-11922, boo#1142941)\n\n- zstd 1.3.7:\n  * fix ratio for dictionary compression at levels 9 and 10\n  * add man pages for zstdless and zstdgrep\n- includes changes from zstd 1.3.6:\n  * faster dictionary builder, also the new default for --train\n  * previous (slower, slightly higher quality) dictionary builder\n    to be selected via --train-cover\n  * Faster dictionary decompression and compression under memory\n    limits with many dictionaries used simultaneously\n  * New command --adapt for compressed network piping of data\n    adjusted to the perceived network conditions\n\n- update to 1.3.5:\n  * much faster dictionary compression\n  * small quality improvement for dictionary generation\n  * slightly improved performance at high compression levels\n  * automatic memory release for long duration contexts\n  * fix overlapLog can be manually set\n  * fix decoding invalid lz4 frames\n  * fix performance degradation for dictionary compression when\n    using advanced API\n\n- fix pzstd tests\n- enable pzstd (parallel zstd)\n\n- Use %license instead of %doc [boo#1082318]\n- Add disk _constraints to fix ppc64le build\n- Use FAT LTO objects in order to provide proper static library (boo#1133297).\n\n\nThis update was imported from the openSUSE:Leap:15.0:Update update project.","status":"published","published":"2019-08-24T16:20:28Z","modified":"2026-02-04T04:40:56.033739Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2024:11544-1","title":"libzstd-devel-1.5.0-1.13 on GA media","description":"These are all security issues fixed in the libzstd-devel-1.5.0-1.13 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:27:28.263306Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"USN-4108-1","title":"libzstd vulnerability","description":"It was discovered that Zstandard incorrectly handled certain inputs.\nAn attacker could possibly use this issue to execute arbitrary code.\n","status":"published","published":"2019-08-21T13:30:58Z","modified":"2026-04-22T09:59:44.020953Z","updated_at":"2026-11-02T16:58:14.019824Z"},{"id":"USN-5593-1","title":"libzstd vulnerability","description":"It was discovered that Zstandard incorrectly handled certain inputs.\nAn attacker could possibly use this issue to execute arbitrary code.\n","status":"published","published":"2022-09-01T23:00:45Z","modified":"2026-06-25T13:31:21.556930766Z","updated_at":"2026-11-02T16:58:16.20937Z"}]}}