Executive brief
zstd-jni is a Java library that provides bindings to the Zstandard compression algorithm. A flaw in the ZstdDictCompress constructor fails to properly validate offset and length parameters, allowing attackers to read arbitrary memory from the native heap. Exploitation typically results in JVM crashes, potentially causing denial of service in applications that use this library.
Technical details
The vulnerability is an out-of-bounds memory read in the ZstdDictCompress constructor, where offset and length parameters are not validated before use. An attacker can supply untrusted values to these parameters to read memory beyond intended boundaries into the compression dictionary. The attack vector is network or local, depending on how the application exposes the constructor (no specific authentication is mentioned as required). Successful exploitation can leak sensitive data from the JVM heap or trigger a crash; patches are available in version 1.5.7-14 and later.
Affected products
- Luben zstd-jni before 1.5.7-14
Timeline
- 2026-09-09: disclosed
- 2026-08-16: patched: Fixed in version 1.5.7-14