GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration
Search

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

    10 vulnerabilities by luben

    CVE-2026-87877 (GCVE-0-2026-87877)

    Vulnerability from nvd – Published: 2026-09-09 14:32 – Updated: 2026-09-09 15:57
    VLAI
    Title
    zstd-jni 1.3.8-4 through 1.5.7-13 Use-After-Free via Setters Called After close()
    Summary
    zstd-jni versions before 1.5.7-14 fail to validate closed state in setDict, setLongMax, setLevel and setRefMultipleDDicts methods of stream classes. Attackers can call these methods on closed streams to write through freed native pointers, corrupting unrelated objects or crashing the JVM.
    Severity
    7 (High)
    CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
    7.7 (High)
    CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
    SSVC
    Exploitation: poc Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-09-09 15:57 UTC
    CWE
    Assigner
    References
    Impacted products
    Vendor Product Version
    luben zstd-jni Affected: 1.3.8-4 , < 1.5.7-14 (custom)
    		Create a notification for this product.
    Date Public
    2026-08-19 00:00
    Credits
    Yu Bao, PayPal Cyber Security Team
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-87877",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-09T15:57:38.917828Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-09T15:57:53.652Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/luben/zstd-jni/security/advisories/GHSA-2jw3-mg7f-vw4q"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo1.maven.org/maven2/com/github/luben/zstd-jni/",
          "defaultStatus": "unaffected",
          "packageURL": "pkg:maven/com.github.luben/zstd-jni",
          "product": "zstd-jni",
          "repo": "https://github.com/luben/zstd-jni",
          "vendor": "luben",
          "versions": [
            {
              "lessThan": "1.5.7-14",
              "status": "affected",
              "version": "1.3.8-4",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Yu Bao, PayPal Cyber Security Team"
        }
      ],
      "datePublic": "2026-08-19T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "zstd-jni versions before 1.5.7-14 fail to validate closed state in setDict, setLongMax, setLevel and setRefMultipleDDicts methods of stream classes. Attackers can call these methods on closed streams to write through freed native pointers, corrupting unrelated objects or crashing the JVM."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-416",
              "description": "Use After Free",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T14:32:45.512Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-2jw3-mg7f-vw4q)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/luben/zstd-jni/security/advisories/GHSA-2jw3-mg7f-vw4q"
        },
        {
          "name": "Fix commit: closed-state guards on BaseZstdBufferDecompressingStreamNoFinalizer",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/luben/zstd-jni/commit/f38f9a1563113d96d0fc38baee543f7457dd8a8e"
        },
        {
          "name": "Fix commit: closed-state guards on the input and output stream setters",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/luben/zstd-jni/commit/393d7311766abbc285b149302c0fe1f94b16d555"
        },
        {
          "name": "Setters without the closed-state guard that readInternal already has, at v1.5.7-13",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/BaseZstdBufferDecompressingStreamNoFinalizer.java"
        },
        {
          "name": "final stream handle retained after close at v1.5.7-13",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/ZstdInputStreamNoFinalizer.java"
        },
        {
          "name": "zstd-jni v1.5.7-14 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14"
        },
        {
          "name": "Commit that made setDict write through the retained native stream handle (first released in 1.3.8-4)",
          "tags": [
            "technical-description",
            "patch"
          ],
          "url": "https://github.com/luben/zstd-jni/commit/0827ed02551bbd8d6f8e4bbff99d83bf50f91938"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/luben/zstd-jni"
        },
        {
          "name": "VulnCheck Advisory: zstd-jni 1.3.8-4 through 1.5.7-13 Use-After-Free via Setters Called After close()",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/zstd-jni-1.3.8-4-through-1.5.7-13-use-after-free-via-setters-called-after-close"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "zstd-jni 1.3.8-4 through 1.5.7-13 Use-After-Free via Setters Called After close()",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-87877",
    "datePublished": "2026-09-09T14:32:45.512Z",
    "dateReserved": "2026-09-09T14:02:07.708Z",
    "dateUpdated": "2026-09-09T15:57:53.652Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-87825 (GCVE-0-2026-87825)

    Vulnerability from nvd – Published: 2026-09-09 14:32 – Updated: 2026-09-09 14:32
    VLAI
    Title
    zstd-jni 1.3.8-4 through 1.5.7-13 Use-After-Free of Compression and Decompression Dictionaries
    Summary
    zstd-jni before 1.5.7-14 contains a use-after-free vulnerability where streams and contexts hold a dictionary's shared lock only during the load call, allowing the dictionary to be closed while still referenced. Attackers can close a dictionary after associating it with a stream or context, causing subsequent read or write operations to access freed native memory, resulting in silent data corruption or JVM crashes.
    Severity
    7 (High)
    CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
    7.7 (High)
    CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
    CWE
    Assigner
    References
    Impacted products
    Vendor Product Version
    luben zstd-jni Affected: 1.3.8-4 , < 1.5.7-14 (custom)
    		Create a notification for this product.
    Date Public
    2026-08-19 00:00
    Credits
    Yu Bao, PayPal Cyber Security Team
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo1.maven.org/maven2/com/github/luben/zstd-jni/",
          "defaultStatus": "unaffected",
          "packageURL": "pkg:maven/com.github.luben/zstd-jni",
          "product": "zstd-jni",
          "repo": "https://github.com/luben/zstd-jni",
          "vendor": "luben",
          "versions": [
            {
              "lessThan": "1.5.7-14",
              "status": "affected",
              "version": "1.3.8-4",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Yu Bao, PayPal Cyber Security Team"
        }
      ],
      "datePublic": "2026-08-19T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "zstd-jni before 1.5.7-14 contains a use-after-free vulnerability where streams and contexts hold a dictionary\u0027s shared lock only during the load call, allowing the dictionary to be closed while still referenced. Attackers can close a dictionary after associating it with a stream or context, causing subsequent read or write operations to access freed native memory, resulting in silent data corruption or JVM crashes."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-416",
              "description": "Use After Free",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T14:32:44.795Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-947w-pxjj-c7m9)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/luben/zstd-jni/security/advisories/GHSA-947w-pxjj-c7m9"
        },
        {
          "name": "Fix commit: hold the dictionary shared lock for the stream\u0027s usage window",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/luben/zstd-jni/commit/393d7311766abbc285b149302c0fe1f94b16d555"
        },
        {
          "name": "Fix commit: cross-object lifetime tracking for dictionaries and contexts",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/luben/zstd-jni/commit/a560131d7834598afd9cea6b7c107bc88e915936"
        },
        {
          "name": "Shared lock released as soon as the dictionary is loaded at v1.5.7-13",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/ZstdInputStreamNoFinalizer.java"
        },
        {
          "name": "Same lock lifecycle in the buffer stream base class at v1.5.7-13",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/BaseZstdBufferDecompressingStreamNoFinalizer.java"
        },
        {
          "name": "zstd-jni v1.5.7-14 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14"
        },
        {
          "name": "Commit that made setDict load the dictionary eagerly into the native context (first released in 1.3.8-4)",
          "tags": [
            "technical-description",
            "patch"
          ],
          "url": "https://github.com/luben/zstd-jni/commit/0827ed02551bbd8d6f8e4bbff99d83bf50f91938"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/luben/zstd-jni"
        },
        {
          "name": "VulnCheck Advisory: zstd-jni 1.3.8-4 through 1.5.7-13 Use-After-Free of Compression and Decompression Dictionaries",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/zstd-jni-1.3.8-4-through-1.5.7-13-use-after-free-of-compression-and-decompression-dictionaries"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "zstd-jni 1.3.8-4 through 1.5.7-13 Use-After-Free of Compression and Decompression Dictionaries",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-87825",
    "datePublished": "2026-09-09T14:32:44.795Z",
    "dateReserved": "2026-09-09T10:32:34.110Z",
    "dateUpdated": "2026-09-09T14:32:44.795Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-87824 (GCVE-0-2026-87824)

    Vulnerability from nvd – Published: 2026-09-09 14:32 – Updated: 2026-09-09 14:32
    VLAI
    Title
    zstd-jni 1.3.3-1 through 1.5.7-13 Out-of-Bounds Read via Zstd.trainFromBufferDirect
    Summary
    zstd-jni before 1.5.7-14 fails to validate the samples buffer capacity in Zstd.trainFromBufferDirect, allowing attackers to read past buffer boundaries by supplying oversized per-sample lengths. Attackers can trigger out-of-bounds memory access by providing crafted sample length arrays that cause the native implementation to walk past the buffer allocation, resulting in JVM termination.
    Severity
    8.7 (High)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
    7.5 (High)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
    CWE
    Assigner
    References
    Impacted products
    Vendor Product Version
    luben zstd-jni Affected: 1.3.3-1 , < 1.5.7-14 (custom)
    		Create a notification for this product.
    Date Public
    2026-08-19 00:00
    Credits
    Yu Bao, PayPal Cyber Security Team
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo1.maven.org/maven2/com/github/luben/zstd-jni/",
          "defaultStatus": "unaffected",
          "packageURL": "pkg:maven/com.github.luben/zstd-jni",
          "product": "zstd-jni",
          "repo": "https://github.com/luben/zstd-jni",
          "vendor": "luben",
          "versions": [
            {
              "lessThan": "1.5.7-14",
              "status": "affected",
              "version": "1.3.3-1",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Yu Bao, PayPal Cyber Security Team"
        }
      ],
      "datePublic": "2026-08-19T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "zstd-jni before 1.5.7-14 fails to validate the samples buffer capacity in Zstd.trainFromBufferDirect, allowing attackers to read past buffer boundaries by supplying oversized per-sample lengths. Attackers can trigger out-of-bounds memory access by providing crafted sample length arrays that cause the native implementation to walk past the buffer allocation, resulting in JVM termination."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T14:32:44.099Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-257p-3h6w-pg7h)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/luben/zstd-jni/security/advisories/GHSA-257p-3h6w-pg7h"
        },
        {
          "name": "Fix commit: validate the samples buffer capacity against the declared sample sizes",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/luben/zstd-jni/commit/bba6cfca2c0897f1fa004f4193247479f10da853"
        },
        {
          "name": "Samples buffer capacity never read at v1.5.7-13",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/native/jni_zdict.c"
        },
        {
          "name": "Java wrapper that only checks the sample count at v1.5.7-13",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/Zstd.java"
        },
        {
          "name": "zstd-jni v1.5.7-14 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14"
        },
        {
          "name": "Commit that introduced the direct-buffer dictionary trainer without a samples capacity check (first released in 1.3.3-1)",
          "tags": [
            "technical-description",
            "patch"
          ],
          "url": "https://github.com/luben/zstd-jni/commit/53d3c6342883f7d6717b2477a7f9c1b4a4a56980"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/luben/zstd-jni"
        },
        {
          "name": "VulnCheck Advisory: zstd-jni 1.3.3-1 through 1.5.7-13 Out-of-Bounds Read via Zstd.trainFromBufferDirect",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/zstd-jni-1.3.3-1-through-1.5.7-13-out-of-bounds-read-via-zstd-trainfrombufferdirect"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "zstd-jni 1.3.3-1 through 1.5.7-13 Out-of-Bounds Read via Zstd.trainFromBufferDirect",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-87824",
    "datePublished": "2026-09-09T14:32:44.099Z",
    "dateReserved": "2026-09-09T10:32:34.110Z",
    "dateUpdated": "2026-09-09T14:32:44.099Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-87823 (GCVE-0-2026-87823)

    Vulnerability from nvd – Published: 2026-09-09 14:32 – Updated: 2026-09-09 16:13
    VLAI
    Title
    zstd-jni 1.1.1 through 1.5.7-13 Out-of-Bounds Read via Direct ByteBuffer Frame-Size Methods
    Summary
    zstd-jni before 1.5.7-14 performs 32-bit signed bounds checks on three direct-ByteBuffer frame-size native methods, allowing out-of-bounds memory reads via negative or overflowing offsets. Attackers can supply negative offset values near Integer.MIN_VALUE to read unmapped memory, causing JVM termination or extracting arbitrary frame size data from unintended memory locations.
    Severity
    8.8 (High)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
    8.2 (High)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
    SSVC
    Exploitation: poc Automatable: yes Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-09-09 16:12 UTC
    CWE
    • CWE-190 - Integer Overflow or Wraparound
    Assigner
    References
    Impacted products
    Vendor Product Version
    luben zstd-jni Affected: 1.1.1 , < 1.5.7-14 (custom)
    		Create a notification for this product.
    Date Public
    2026-08-19 00:00
    Credits
    Yu Bao, PayPal Cyber Security Team
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-87823",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-09T16:12:29.082517Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-09T16:13:14.420Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/luben/zstd-jni/security/advisories/GHSA-jfr6-9xqw-2g2q"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo1.maven.org/maven2/com/github/luben/zstd-jni/",
          "defaultStatus": "unaffected",
          "packageURL": "pkg:maven/com.github.luben/zstd-jni",
          "product": "zstd-jni",
          "repo": "https://github.com/luben/zstd-jni",
          "vendor": "luben",
          "versions": [
            {
              "lessThan": "1.5.7-14",
              "status": "affected",
              "version": "1.1.1",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Yu Bao, PayPal Cyber Security Team"
        }
      ],
      "datePublic": "2026-08-19T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "zstd-jni before 1.5.7-14 performs 32-bit signed bounds checks on three direct-ByteBuffer frame-size native methods, allowing out-of-bounds memory reads via negative or overflowing offsets. Attackers can supply negative offset values near Integer.MIN_VALUE to read unmapped memory, causing JVM termination or extracting arbitrary frame size data from unintended memory locations."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-190",
              "description": "Integer Overflow or Wraparound",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T14:32:43.442Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-jfr6-9xqw-2g2q)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/luben/zstd-jni/security/advisories/GHSA-jfr6-9xqw-2g2q"
        },
        {
          "name": "Fix commit: reject negative offset and size in the three direct-ByteBuffer natives",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/luben/zstd-jni/commit/d7a1c99322d5e1fc71932e722c0b5bb2fc525d3f"
        },
        {
          "name": "Unchecked 32-bit bounds tests at v1.5.7-13",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/native/jni_zstd.c"
        },
        {
          "name": "Native declarations with no Java-side validation at v1.5.7-13",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/Zstd.java"
        },
        {
          "name": "zstd-jni v1.5.7-14 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14"
        },
        {
          "name": "Commit that introduced the unchecked direct-ByteBuffer size natives (first released in 1.1.1)",
          "tags": [
            "technical-description",
            "patch"
          ],
          "url": "https://github.com/luben/zstd-jni/commit/46dcb2a54c8b8f2ce2cad7187a7513f509c533ac"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/luben/zstd-jni"
        },
        {
          "name": "VulnCheck Advisory: zstd-jni 1.1.1 through 1.5.7-13 Out-of-Bounds Read via Direct ByteBuffer Frame-Size Methods",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/zstd-jni-1.1.1-through-1.5.7-13-out-of-bounds-read-via-direct-bytebuffer-frame-size-methods"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "zstd-jni 1.1.1 through 1.5.7-13 Out-of-Bounds Read via Direct ByteBuffer Frame-Size Methods",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-87823",
    "datePublished": "2026-09-09T14:32:43.442Z",
    "dateReserved": "2026-09-09T10:32:34.110Z",
    "dateUpdated": "2026-09-09T16:13:14.420Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-87795 (GCVE-0-2026-87795)

    Vulnerability from nvd – Published: 2026-09-09 10:07 – Updated: 2026-09-09 10:07
    VLAI
    Title
    zstd-jni 1.2.0 through 1.5.7-13 Out-of-Bounds Read via ZstdDictCompress
    Summary
    zstd-jni versions before 1.5.7-14 fail to validate offset and length parameters in the ZstdDictCompress constructor, allowing out-of-bounds memory reads. Attackers can supply untrusted offset or length values to read native heap memory into the compression dictionary, typically causing JVM crashes.
    Severity
    8.8 (High)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
    8.2 (High)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
    CWE
    Assigner
    References
    Impacted products
    Vendor Product Version
    luben zstd-jni Affected: 1.2.0 , < 1.5.7-14 (custom)
    		Create a notification for this product.
    Date Public
    2026-08-15 00:00
    Credits
    Yu Bao, PayPal Cyber Security Team
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo1.maven.org/maven2/com/github/luben/zstd-jni/",
          "defaultStatus": "unaffected",
          "packageURL": "pkg:maven/com.github.luben/zstd-jni",
          "product": "zstd-jni",
          "repo": "https://github.com/luben/zstd-jni",
          "vendor": "luben",
          "versions": [
            {
              "lessThan": "1.5.7-14",
              "status": "affected",
              "version": "1.2.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Yu Bao, PayPal Cyber Security Team"
        }
      ],
      "datePublic": "2026-08-15T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "zstd-jni versions before 1.5.7-14 fail to validate offset and length parameters in the ZstdDictCompress constructor, allowing out-of-bounds memory reads. Attackers can supply untrusted offset or length values to read native heap memory into the compression dictionary, typically causing JVM crashes."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T10:07:28.656Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-ff36-7w3w-g8rm)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/luben/zstd-jni/security/advisories/GHSA-ff36-7w3w-g8rm"
        },
        {
          "name": "Fix commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/luben/zstd-jni/commit/0d64de4dee6606ff506be36c7f2e714ad0c80fdb"
        },
        {
          "name": "Broken bounds check at v1.5.7-13",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/ZstdDictCompress.java"
        },
        {
          "name": "Native init that trusts the offset and length",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/native/jni_fast_zstd.c"
        },
        {
          "name": "Commit that introduced the unchecked native path",
          "tags": [
            "technical-description",
            "patch"
          ],
          "url": "https://github.com/luben/zstd-jni/commit/1c4e5a6c3ce8458095225d987d669e6a0937734a"
        },
        {
          "name": "zstd-jni v1.5.7-14 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/luben/zstd-jni"
        },
        {
          "name": "VulnCheck Advisory: zstd-jni 1.2.0 through 1.5.7-13 Out-of-Bounds Read via ZstdDictCompress",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/zstd-jni-1.2.0-through-1.5.7-13-out-of-bounds-read-via-zstddictcompress"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "zstd-jni 1.2.0 through 1.5.7-13 Out-of-Bounds Read via ZstdDictCompress",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-87795",
    "datePublished": "2026-09-09T10:07:28.656Z",
    "dateReserved": "2026-09-09T09:37:58.558Z",
    "dateUpdated": "2026-09-09T10:07:28.656Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-87877 (GCVE-0-2026-87877)

    Vulnerability from cvelistv5 – Published: 2026-09-09 14:32 – Updated: 2026-09-09 15:57
    VLAI
    Title
    zstd-jni 1.3.8-4 through 1.5.7-13 Use-After-Free via Setters Called After close()
    Summary
    zstd-jni versions before 1.5.7-14 fail to validate closed state in setDict, setLongMax, setLevel and setRefMultipleDDicts methods of stream classes. Attackers can call these methods on closed streams to write through freed native pointers, corrupting unrelated objects or crashing the JVM.
    Severity
    7 (High)
    CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
    7.7 (High)
    CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
    SSVC
    Exploitation: poc Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-09-09 15:57 UTC
    CWE
    Assigner
    References
    Impacted products
    Vendor Product Version
    luben zstd-jni Affected: 1.3.8-4 , < 1.5.7-14 (custom)
    		Create a notification for this product.
    Date Public
    2026-08-19 00:00
    Credits
    Yu Bao, PayPal Cyber Security Team
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-87877",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-09T15:57:38.917828Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-09T15:57:53.652Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/luben/zstd-jni/security/advisories/GHSA-2jw3-mg7f-vw4q"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo1.maven.org/maven2/com/github/luben/zstd-jni/",
          "defaultStatus": "unaffected",
          "packageURL": "pkg:maven/com.github.luben/zstd-jni",
          "product": "zstd-jni",
          "repo": "https://github.com/luben/zstd-jni",
          "vendor": "luben",
          "versions": [
            {
              "lessThan": "1.5.7-14",
              "status": "affected",
              "version": "1.3.8-4",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Yu Bao, PayPal Cyber Security Team"
        }
      ],
      "datePublic": "2026-08-19T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "zstd-jni versions before 1.5.7-14 fail to validate closed state in setDict, setLongMax, setLevel and setRefMultipleDDicts methods of stream classes. Attackers can call these methods on closed streams to write through freed native pointers, corrupting unrelated objects or crashing the JVM."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-416",
              "description": "Use After Free",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T14:32:45.512Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-2jw3-mg7f-vw4q)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/luben/zstd-jni/security/advisories/GHSA-2jw3-mg7f-vw4q"
        },
        {
          "name": "Fix commit: closed-state guards on BaseZstdBufferDecompressingStreamNoFinalizer",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/luben/zstd-jni/commit/f38f9a1563113d96d0fc38baee543f7457dd8a8e"
        },
        {
          "name": "Fix commit: closed-state guards on the input and output stream setters",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/luben/zstd-jni/commit/393d7311766abbc285b149302c0fe1f94b16d555"
        },
        {
          "name": "Setters without the closed-state guard that readInternal already has, at v1.5.7-13",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/BaseZstdBufferDecompressingStreamNoFinalizer.java"
        },
        {
          "name": "final stream handle retained after close at v1.5.7-13",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/ZstdInputStreamNoFinalizer.java"
        },
        {
          "name": "zstd-jni v1.5.7-14 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14"
        },
        {
          "name": "Commit that made setDict write through the retained native stream handle (first released in 1.3.8-4)",
          "tags": [
            "technical-description",
            "patch"
          ],
          "url": "https://github.com/luben/zstd-jni/commit/0827ed02551bbd8d6f8e4bbff99d83bf50f91938"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/luben/zstd-jni"
        },
        {
          "name": "VulnCheck Advisory: zstd-jni 1.3.8-4 through 1.5.7-13 Use-After-Free via Setters Called After close()",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/zstd-jni-1.3.8-4-through-1.5.7-13-use-after-free-via-setters-called-after-close"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "zstd-jni 1.3.8-4 through 1.5.7-13 Use-After-Free via Setters Called After close()",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-87877",
    "datePublished": "2026-09-09T14:32:45.512Z",
    "dateReserved": "2026-09-09T14:02:07.708Z",
    "dateUpdated": "2026-09-09T15:57:53.652Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-87825 (GCVE-0-2026-87825)

    Vulnerability from cvelistv5 – Published: 2026-09-09 14:32 – Updated: 2026-09-09 14:32
    VLAI
    Title
    zstd-jni 1.3.8-4 through 1.5.7-13 Use-After-Free of Compression and Decompression Dictionaries
    Summary
    zstd-jni before 1.5.7-14 contains a use-after-free vulnerability where streams and contexts hold a dictionary's shared lock only during the load call, allowing the dictionary to be closed while still referenced. Attackers can close a dictionary after associating it with a stream or context, causing subsequent read or write operations to access freed native memory, resulting in silent data corruption or JVM crashes.
    Severity
    7 (High)
    CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
    7.7 (High)
    CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
    CWE
    Assigner
    References
    Impacted products
    Vendor Product Version
    luben zstd-jni Affected: 1.3.8-4 , < 1.5.7-14 (custom)
    		Create a notification for this product.
    Date Public
    2026-08-19 00:00
    Credits
    Yu Bao, PayPal Cyber Security Team
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo1.maven.org/maven2/com/github/luben/zstd-jni/",
          "defaultStatus": "unaffected",
          "packageURL": "pkg:maven/com.github.luben/zstd-jni",
          "product": "zstd-jni",
          "repo": "https://github.com/luben/zstd-jni",
          "vendor": "luben",
          "versions": [
            {
              "lessThan": "1.5.7-14",
              "status": "affected",
              "version": "1.3.8-4",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Yu Bao, PayPal Cyber Security Team"
        }
      ],
      "datePublic": "2026-08-19T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "zstd-jni before 1.5.7-14 contains a use-after-free vulnerability where streams and contexts hold a dictionary\u0027s shared lock only during the load call, allowing the dictionary to be closed while still referenced. Attackers can close a dictionary after associating it with a stream or context, causing subsequent read or write operations to access freed native memory, resulting in silent data corruption or JVM crashes."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-416",
              "description": "Use After Free",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T14:32:44.795Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-947w-pxjj-c7m9)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/luben/zstd-jni/security/advisories/GHSA-947w-pxjj-c7m9"
        },
        {
          "name": "Fix commit: hold the dictionary shared lock for the stream\u0027s usage window",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/luben/zstd-jni/commit/393d7311766abbc285b149302c0fe1f94b16d555"
        },
        {
          "name": "Fix commit: cross-object lifetime tracking for dictionaries and contexts",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/luben/zstd-jni/commit/a560131d7834598afd9cea6b7c107bc88e915936"
        },
        {
          "name": "Shared lock released as soon as the dictionary is loaded at v1.5.7-13",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/ZstdInputStreamNoFinalizer.java"
        },
        {
          "name": "Same lock lifecycle in the buffer stream base class at v1.5.7-13",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/BaseZstdBufferDecompressingStreamNoFinalizer.java"
        },
        {
          "name": "zstd-jni v1.5.7-14 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14"
        },
        {
          "name": "Commit that made setDict load the dictionary eagerly into the native context (first released in 1.3.8-4)",
          "tags": [
            "technical-description",
            "patch"
          ],
          "url": "https://github.com/luben/zstd-jni/commit/0827ed02551bbd8d6f8e4bbff99d83bf50f91938"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/luben/zstd-jni"
        },
        {
          "name": "VulnCheck Advisory: zstd-jni 1.3.8-4 through 1.5.7-13 Use-After-Free of Compression and Decompression Dictionaries",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/zstd-jni-1.3.8-4-through-1.5.7-13-use-after-free-of-compression-and-decompression-dictionaries"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "zstd-jni 1.3.8-4 through 1.5.7-13 Use-After-Free of Compression and Decompression Dictionaries",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-87825",
    "datePublished": "2026-09-09T14:32:44.795Z",
    "dateReserved": "2026-09-09T10:32:34.110Z",
    "dateUpdated": "2026-09-09T14:32:44.795Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-87824 (GCVE-0-2026-87824)

    Vulnerability from cvelistv5 – Published: 2026-09-09 14:32 – Updated: 2026-09-09 14:32
    VLAI
    Title
    zstd-jni 1.3.3-1 through 1.5.7-13 Out-of-Bounds Read via Zstd.trainFromBufferDirect
    Summary
    zstd-jni before 1.5.7-14 fails to validate the samples buffer capacity in Zstd.trainFromBufferDirect, allowing attackers to read past buffer boundaries by supplying oversized per-sample lengths. Attackers can trigger out-of-bounds memory access by providing crafted sample length arrays that cause the native implementation to walk past the buffer allocation, resulting in JVM termination.
    Severity
    8.7 (High)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
    7.5 (High)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
    CWE
    Assigner
    References
    Impacted products
    Vendor Product Version
    luben zstd-jni Affected: 1.3.3-1 , < 1.5.7-14 (custom)
    		Create a notification for this product.
    Date Public
    2026-08-19 00:00
    Credits
    Yu Bao, PayPal Cyber Security Team
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo1.maven.org/maven2/com/github/luben/zstd-jni/",
          "defaultStatus": "unaffected",
          "packageURL": "pkg:maven/com.github.luben/zstd-jni",
          "product": "zstd-jni",
          "repo": "https://github.com/luben/zstd-jni",
          "vendor": "luben",
          "versions": [
            {
              "lessThan": "1.5.7-14",
              "status": "affected",
              "version": "1.3.3-1",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Yu Bao, PayPal Cyber Security Team"
        }
      ],
      "datePublic": "2026-08-19T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "zstd-jni before 1.5.7-14 fails to validate the samples buffer capacity in Zstd.trainFromBufferDirect, allowing attackers to read past buffer boundaries by supplying oversized per-sample lengths. Attackers can trigger out-of-bounds memory access by providing crafted sample length arrays that cause the native implementation to walk past the buffer allocation, resulting in JVM termination."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T14:32:44.099Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-257p-3h6w-pg7h)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/luben/zstd-jni/security/advisories/GHSA-257p-3h6w-pg7h"
        },
        {
          "name": "Fix commit: validate the samples buffer capacity against the declared sample sizes",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/luben/zstd-jni/commit/bba6cfca2c0897f1fa004f4193247479f10da853"
        },
        {
          "name": "Samples buffer capacity never read at v1.5.7-13",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/native/jni_zdict.c"
        },
        {
          "name": "Java wrapper that only checks the sample count at v1.5.7-13",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/Zstd.java"
        },
        {
          "name": "zstd-jni v1.5.7-14 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14"
        },
        {
          "name": "Commit that introduced the direct-buffer dictionary trainer without a samples capacity check (first released in 1.3.3-1)",
          "tags": [
            "technical-description",
            "patch"
          ],
          "url": "https://github.com/luben/zstd-jni/commit/53d3c6342883f7d6717b2477a7f9c1b4a4a56980"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/luben/zstd-jni"
        },
        {
          "name": "VulnCheck Advisory: zstd-jni 1.3.3-1 through 1.5.7-13 Out-of-Bounds Read via Zstd.trainFromBufferDirect",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/zstd-jni-1.3.3-1-through-1.5.7-13-out-of-bounds-read-via-zstd-trainfrombufferdirect"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "zstd-jni 1.3.3-1 through 1.5.7-13 Out-of-Bounds Read via Zstd.trainFromBufferDirect",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-87824",
    "datePublished": "2026-09-09T14:32:44.099Z",
    "dateReserved": "2026-09-09T10:32:34.110Z",
    "dateUpdated": "2026-09-09T14:32:44.099Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-87823 (GCVE-0-2026-87823)

    Vulnerability from cvelistv5 – Published: 2026-09-09 14:32 – Updated: 2026-09-09 16:13
    VLAI
    Title
    zstd-jni 1.1.1 through 1.5.7-13 Out-of-Bounds Read via Direct ByteBuffer Frame-Size Methods
    Summary
    zstd-jni before 1.5.7-14 performs 32-bit signed bounds checks on three direct-ByteBuffer frame-size native methods, allowing out-of-bounds memory reads via negative or overflowing offsets. Attackers can supply negative offset values near Integer.MIN_VALUE to read unmapped memory, causing JVM termination or extracting arbitrary frame size data from unintended memory locations.
    Severity
    8.8 (High)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
    8.2 (High)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
    SSVC
    Exploitation: poc Automatable: yes Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-09-09 16:12 UTC
    CWE
    • CWE-190 - Integer Overflow or Wraparound
    Assigner
    References
    Impacted products
    Vendor Product Version
    luben zstd-jni Affected: 1.1.1 , < 1.5.7-14 (custom)
    		Create a notification for this product.
    Date Public
    2026-08-19 00:00
    Credits
    Yu Bao, PayPal Cyber Security Team
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-87823",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-09T16:12:29.082517Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-09T16:13:14.420Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/luben/zstd-jni/security/advisories/GHSA-jfr6-9xqw-2g2q"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo1.maven.org/maven2/com/github/luben/zstd-jni/",
          "defaultStatus": "unaffected",
          "packageURL": "pkg:maven/com.github.luben/zstd-jni",
          "product": "zstd-jni",
          "repo": "https://github.com/luben/zstd-jni",
          "vendor": "luben",
          "versions": [
            {
              "lessThan": "1.5.7-14",
              "status": "affected",
              "version": "1.1.1",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Yu Bao, PayPal Cyber Security Team"
        }
      ],
      "datePublic": "2026-08-19T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "zstd-jni before 1.5.7-14 performs 32-bit signed bounds checks on three direct-ByteBuffer frame-size native methods, allowing out-of-bounds memory reads via negative or overflowing offsets. Attackers can supply negative offset values near Integer.MIN_VALUE to read unmapped memory, causing JVM termination or extracting arbitrary frame size data from unintended memory locations."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-190",
              "description": "Integer Overflow or Wraparound",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T14:32:43.442Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-jfr6-9xqw-2g2q)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/luben/zstd-jni/security/advisories/GHSA-jfr6-9xqw-2g2q"
        },
        {
          "name": "Fix commit: reject negative offset and size in the three direct-ByteBuffer natives",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/luben/zstd-jni/commit/d7a1c99322d5e1fc71932e722c0b5bb2fc525d3f"
        },
        {
          "name": "Unchecked 32-bit bounds tests at v1.5.7-13",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/native/jni_zstd.c"
        },
        {
          "name": "Native declarations with no Java-side validation at v1.5.7-13",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/Zstd.java"
        },
        {
          "name": "zstd-jni v1.5.7-14 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14"
        },
        {
          "name": "Commit that introduced the unchecked direct-ByteBuffer size natives (first released in 1.1.1)",
          "tags": [
            "technical-description",
            "patch"
          ],
          "url": "https://github.com/luben/zstd-jni/commit/46dcb2a54c8b8f2ce2cad7187a7513f509c533ac"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/luben/zstd-jni"
        },
        {
          "name": "VulnCheck Advisory: zstd-jni 1.1.1 through 1.5.7-13 Out-of-Bounds Read via Direct ByteBuffer Frame-Size Methods",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/zstd-jni-1.1.1-through-1.5.7-13-out-of-bounds-read-via-direct-bytebuffer-frame-size-methods"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "zstd-jni 1.1.1 through 1.5.7-13 Out-of-Bounds Read via Direct ByteBuffer Frame-Size Methods",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-87823",
    "datePublished": "2026-09-09T14:32:43.442Z",
    "dateReserved": "2026-09-09T10:32:34.110Z",
    "dateUpdated": "2026-09-09T16:13:14.420Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-87795 (GCVE-0-2026-87795)

    Vulnerability from cvelistv5 – Published: 2026-09-09 10:07 – Updated: 2026-09-09 10:07
    VLAI
    Title
    zstd-jni 1.2.0 through 1.5.7-13 Out-of-Bounds Read via ZstdDictCompress
    Summary
    zstd-jni versions before 1.5.7-14 fail to validate offset and length parameters in the ZstdDictCompress constructor, allowing out-of-bounds memory reads. Attackers can supply untrusted offset or length values to read native heap memory into the compression dictionary, typically causing JVM crashes.
    Severity
    8.8 (High)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
    8.2 (High)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
    CWE
    Assigner
    References
    Impacted products
    Vendor Product Version
    luben zstd-jni Affected: 1.2.0 , < 1.5.7-14 (custom)
    		Create a notification for this product.
    Date Public
    2026-08-15 00:00
    Credits
    Yu Bao, PayPal Cyber Security Team
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo1.maven.org/maven2/com/github/luben/zstd-jni/",
          "defaultStatus": "unaffected",
          "packageURL": "pkg:maven/com.github.luben/zstd-jni",
          "product": "zstd-jni",
          "repo": "https://github.com/luben/zstd-jni",
          "vendor": "luben",
          "versions": [
            {
              "lessThan": "1.5.7-14",
              "status": "affected",
              "version": "1.2.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Yu Bao, PayPal Cyber Security Team"
        }
      ],
      "datePublic": "2026-08-15T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "zstd-jni versions before 1.5.7-14 fail to validate offset and length parameters in the ZstdDictCompress constructor, allowing out-of-bounds memory reads. Attackers can supply untrusted offset or length values to read native heap memory into the compression dictionary, typically causing JVM crashes."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T10:07:28.656Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-ff36-7w3w-g8rm)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/luben/zstd-jni/security/advisories/GHSA-ff36-7w3w-g8rm"
        },
        {
          "name": "Fix commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/luben/zstd-jni/commit/0d64de4dee6606ff506be36c7f2e714ad0c80fdb"
        },
        {
          "name": "Broken bounds check at v1.5.7-13",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/ZstdDictCompress.java"
        },
        {
          "name": "Native init that trusts the offset and length",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/native/jni_fast_zstd.c"
        },
        {
          "name": "Commit that introduced the unchecked native path",
          "tags": [
            "technical-description",
            "patch"
          ],
          "url": "https://github.com/luben/zstd-jni/commit/1c4e5a6c3ce8458095225d987d669e6a0937734a"
        },
        {
          "name": "zstd-jni v1.5.7-14 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/luben/zstd-jni"
        },
        {
          "name": "VulnCheck Advisory: zstd-jni 1.2.0 through 1.5.7-13 Out-of-Bounds Read via ZstdDictCompress",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/zstd-jni-1.2.0-through-1.5.7-13-out-of-bounds-read-via-zstddictcompress"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "zstd-jni 1.2.0 through 1.5.7-13 Out-of-Bounds Read via ZstdDictCompress",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-87795",
    "datePublished": "2026-09-09T10:07:28.656Z",
    "dateReserved": "2026-09-09T09:37:58.558Z",
    "dateUpdated": "2026-09-09T10:07:28.656Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}