{"id":"CVE-2026-87877","aliases":["DEBIAN-CVE-2026-87877","EUVD-2026-75024","GHSA-2jw3-mg7f-vw4q","GHSA-mwq5-v3w5-qr6v","SUSE-SU-2026:23858-1","SUSE-SU-2026:23868-1","UBUNTU-CVE-2026-87877","openSUSE-SU-2026:21902-1"],"status":"published","title":"zstd-jni 1.3.8-4 through 1.5.7-13 Use-After-Free via Setters Called After close()","description":"zstd-jni versions before 1.5.7-14 fail to validate closed state in setDict, setLongMax, setLevel and setRefMultipleDDicts methods of stream classes. Attackers can call these methods on closed streams to write through freed native pointers, corrupting unrelated objects or crashing the JVM.","severity":{"version":"4.0","score":7,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00221,"percentile":0.12753,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-416"],"published":"2026-09-09T14:32:45Z","modified":"2026-10-28T11:00:51Z","fixes":[{"ecosystem":"Debian:14","package":"zstd-jni-java","fixed_in":["1.5.7-23+ds-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"zstd-jni-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5.2-5+ds-3","1.5.2-5+ds-4","1.5.2-5+ds-5","1.5.2-5+ds-6","1.5.2-5+ds-7","1.5.2-5+ds-8","1.5.4-2+ds-1","1.5.4-2+ds-2","1.5.4-2+ds-3~exp1","1.5.4-2+ds-3~exp2","1.5.4-2+ds-3~exp3","1.5.4-2+ds-3~exp4","1.5.7-23+ds-1","1.5.7-23+ds-2"]},{"source":"osv","ecosystem":"Debian:13","package":"zstd-jni-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5.2-5+ds-7","1.5.2-5+ds-8","1.5.4-2+ds-1","1.5.4-2+ds-2","1.5.4-2+ds-3~exp1","1.5.4-2+ds-3~exp2","1.5.4-2+ds-3~exp3","1.5.4-2+ds-3~exp4","1.5.7-23+ds-1","1.5.7-23+ds-2"]},{"source":"osv","ecosystem":"Debian:14","package":"zstd-jni-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.7-23+ds-1"}]}],"versions":["1.5.2-5+ds-7","1.5.2-5+ds-8","1.5.4-2+ds-1","1.5.4-2+ds-2","1.5.4-2+ds-3~exp1","1.5.4-2+ds-3~exp2","1.5.4-2+ds-3~exp3","1.5.4-2+ds-3~exp4"]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"zstd-jni","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.7.16-160000.1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"zstd-jni","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.7.16-160000.1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"zstd-jni","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.7.16-160000.1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"zstd-jni","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.7.16-160000.1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"zstd-jni-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5.2-5+ds-3","1.5.2-5+ds-3build1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"zstd-jni-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5.2-5+ds-8"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"zstd-jni-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5.2-5+ds-7","1.5.2-5+ds-7build1","1.5.2-5+ds-7ubuntu1","1.5.2-5+ds-8"]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"zstd-jni","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.7.16-160000.1.1"}]}],"bundled":4}],"products":[{"vendor":"luben","product":"zstd-jni"}],"references":[{"url":"https://github.com/luben/zstd-jni/security/advisories/GHSA-2jw3-mg7f-vw4q","tags":["vendor-advisory","exploit","advisory","report"]},{"url":"https://github.com/luben/zstd-jni/commit/f38f9a1563113d96d0fc38baee543f7457dd8a8e","tags":["patch","fix"]},{"url":"https://github.com/luben/zstd-jni/commit/393d7311766abbc285b149302c0fe1f94b16d555","tags":["patch","fix"]},{"url":"https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/BaseZstdBufferDecompressingStreamNoFinalizer.java","tags":["technical-description","article"]},{"url":"https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/ZstdInputStreamNoFinalizer.java","tags":["technical-description","article"]},{"url":"https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14","tags":["release-notes","advisory"]},{"url":"https://github.com/luben/zstd-jni/commit/0827ed02551bbd8d6f8e4bbff99d83bf50f91938","tags":["technical-description","patch","fix"]},{"url":"https://github.com/luben/zstd-jni","tags":["product","package"]},{"url":"https://www.vulncheck.com/advisories/zstd-jni-1.3.8-4-through-1.5.7-13-use-after-free-via-setters-called-after-close","tags":["third-party-advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87877","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-mwq5-v3w5-qr6v"},{"url":"https://repo1.maven.org/maven2/com/github/luben/zstd-jni/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/87xxx/CVE-2026-87877.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-87877","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623858-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1279953","tags":["report"]},{"url":"https://bugzilla.suse.com/1279954","tags":["report"]},{"url":"https://bugzilla.suse.com/1279955","tags":["report"]},{"url":"https://bugzilla.suse.com/1279956","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-87823","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-87824","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-87825","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-87877","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623868-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-87877","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-87877","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-87877","title":"zstd-jni 1.3.8-4 through 1.5.7-13 Use-After-Free via Setters Called After close()","description":"zstd-jni versions before 1.5.7-14 fail to validate closed state in setDict, setLongMax, setLevel and setRefMultipleDDicts methods of stream classes. Attackers can call these methods on closed streams to write through freed native pointers, corrupting unrelated objects or crashing the JVM.","status":"published","published":"2026-09-09T14:32:45.512Z","modified":"2026-09-09T15:57:53.652Z","cvss":[{"version":"4.0","score":7,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"},{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T13:37:47.463822Z"}],"euvd":[{"id":"EUVD-2026-75024","description":"zstd-jni versions before 1.5.7-14 fail to validate closed state in setDict, setLongMax, setLevel and setRefMultipleDDicts methods of stream classes. Attackers can call these methods on closed streams to write through freed native pointers, corrupting unrelated objects or crashing the JVM.","status":"published","published":"2026-09-09T14:32:45Z","modified":"2026-09-09T15:57:53Z","cvss":[{"version":"4.0","score":7,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T17:28:26.437971Z"}],"ghsa":[{"id":"GHSA-mwq5-v3w5-qr6v","title":"zstd-jni versions before 1.5.7-14 fail to validate closed state in setDict, setLongMax, setLevel...","description":"zstd-jni versions before 1.5.7-14 fail to validate closed state in setDict, setLongMax, setLevel and setRefMultipleDDicts methods of stream classes. Attackers can call these methods on closed streams to write through freed native pointers, corrupting unrelated objects or crashing the JVM.","status":"published","published":"2026-09-09T15:35:16Z","modified":"2026-09-09T15:35:22Z","cvss":[{"version":"4.0","score":7,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"},{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"high"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T15:11:38.712835Z"}],"nvd":[{"id":"CVE-2026-87877","description":"zstd-jni versions before 1.5.7-14 fail to validate closed state in setDict, setLongMax, setLevel and setRefMultipleDDicts methods of stream classes. Attackers can call these methods on closed streams to write through freed native pointers, corrupting unrelated objects or crashing the JVM.","status":"published","published":"2026-09-09T15:17:28.07Z","modified":"2026-09-09T20:16:54.383Z","cvss":[{"version":"4.0","score":7,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:12:45.93749Z"}],"osv":[{"id":"CVE-2026-87877","title":"zstd-jni 1.3.8-4 through 1.5.7-13 Use-After-Free via Setters Called After close()","description":"zstd-jni versions before 1.5.7-14 fail to validate closed state in setDict, setLongMax, setLevel and setRefMultipleDDicts methods of stream classes. Attackers can call these methods on closed streams to write through freed native pointers, corrupting unrelated objects or crashing the JVM.","status":"published","published":"2026-09-09T14:32:45.512Z","modified":"2026-10-28T11:00:51.576430919Z","cvss":[{"version":"4.0","score":7,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T15:45:19.210277Z"},{"id":"DEBIAN-CVE-2026-87877","description":"zstd-jni versions before 1.5.7-14 fail to validate closed state in setDict, setLongMax, setLevel and setRefMultipleDDicts methods of stream classes. Attackers can call these methods on closed streams to write through freed native pointers, corrupting unrelated objects or crashing the JVM.","status":"published","published":"2026-09-09T15:17:28.07Z","modified":"2026-10-18T04:00:08.333256146Z","cvss":[{"version":"4.0","score":7,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-02T15:46:05.506112Z"},{"id":"UBUNTU-CVE-2026-87877","description":"zstd-jni versions before 1.5.7-14 fail to validate closed state in setDict, setLongMax, setLevel and setRefMultipleDDicts methods of stream classes. Attackers can call these methods on closed streams to write through freed native pointers, corrupting unrelated objects or crashing the JVM.","status":"published","published":"2026-09-09T15:17:00Z","modified":"2026-10-17T13:01:15.154511251Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"high"},{"version":"4.0","score":7,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T16:57:24.828975Z"},{"id":"openSUSE-SU-2026:21902-1","title":"Security update for zstd-jni","description":"This update for zstd-jni fixes the following issues:\n\n- CVE-2026-87823: denial of Service or Information Disclosure via out-of-bounds read (bsc#1279953).\n- CVE-2026-87824: denial of Service (DoS) via out-of-bounds read in Zstd.trainFromBufferDirect (bsc#1279956).\n- CVE-2026-87825: use-after-free resulting in silent data corruption or JVM crashes (bsc#1279955).\n- CVE-2026-87877: use-After-Free vulnerability allows memory corruption and denial of service (bsc#1279954).\n\nChanges for zstd-jni:\n\n- update to version v1.5.7.16.\n","status":"published","published":"2026-09-21T17:44:10Z","modified":"2026-09-25T18:23:12.440162389Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"SUSE-SU-2026:23858-1","title":"Security update for zstd-jni","description":"This update for zstd-jni fixes the following issues:\n\n- CVE-2026-87823: denial of Service or Information Disclosure via out-of-bounds read (bsc#1279953).\n- CVE-2026-87824: denial of Service (DoS) via out-of-bounds read in Zstd.trainFromBufferDirect (bsc#1279956).\n- CVE-2026-87825: use-after-free resulting in silent data corruption or JVM crashes (bsc#1279955).\n- CVE-2026-87877: use-After-Free vulnerability allows memory corruption and denial of service (bsc#1279954).\n\nChanges for zstd-jni:\n\n- update to version v1.5.7.16.\n","status":"published","published":"2026-09-21T17:43:14Z","modified":"2026-09-27T18:23:16.186423891Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:23868-1","title":"Security update for zstd-jni","description":"This update for zstd-jni fixes the following issues:\n\n- CVE-2026-87823: denial of Service or Information Disclosure via out-of-bounds read (bsc#1279953).\n- CVE-2026-87824: denial of Service (DoS) via out-of-bounds read in Zstd.trainFromBufferDirect (bsc#1279956).\n- CVE-2026-87825: use-after-free resulting in silent data corruption or JVM crashes (bsc#1279955).\n- CVE-2026-87877: use-After-Free vulnerability allows memory corruption and denial of service (bsc#1279954).\n\nChanges for zstd-jni:\n\n- update to version v1.5.7.16.\n","status":"published","published":"2026-09-21T17:43:14Z","modified":"2026-09-27T18:23:16.691242275Z","updated_at":"2026-11-02T15:54:03.991985Z"}]}}