Executive brief
zstd-jni is a Java library that provides compression/decompression functionality using the Zstandard algorithm. A flaw in the ZstdDictDecompress constructor fails to validate offset and length parameters against dictionary array bounds, allowing attackers to trigger out-of-bounds memory reads that can crash the Java Virtual Machine.
Technical details
The vulnerability is a classic out-of-bounds read (CWE-125) in the ZstdDictDecompress constructor. The root cause is insufficient input validation: offset and length arguments are never checked against the dictionary array bounds before being used. An attacker can supply arbitrary offset or length values to the constructor, causing the code to read past the end of the supplied array. This can result in memory corruption or JVM termination (denial of service). The vulnerability affects versions 1.2.0 through 1.5.7-13; versions 1.5.7-14 and later appear to have fixes applied. Network reachability depends on whether the affected application exposes this constructor to untrusted input.
Affected products
- Luben zstd-jni 1.2.0 through 1.5.7-13
Timeline
- 2026-09-12: disclosed