Vulnerability-Lookup

CVE-2026-90852 (GCVE-0-2026-90852)

Vulnerability from cvelistv5 – Published: 2026-09-15 02:15 – Updated: 2026-09-15 18:19 X_Open Source

Title

luben zstd-jni Dictionary Sharing ZstdCompressCtx.java ZstdCompressCtx.loadDict use after free

Summary

A vulnerability has been found in luben zstd-jni up to 1.5.7-13. This vulnerability affects the function ZstdCompressCtx.loadDict of the file ZstdCompressCtx.java of the component Dictionary Sharing. Such manipulation leads to use after free. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.5.7-14 is able to resolve this issue. The name of the patch is a560131d7834598afd9cea6b7c107bc88e915936. The affected component should be upgraded. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

7.3 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C

7.3 (High)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-15 18:17 UTC

CWE

CWE-416 - Use After Free
CWE-119 - Memory Corruption

Assigner

VulDB mitre root

References

8 references

URL	Tags
https://vuldb.com/vuln/403407	vdb-entrytechnical-description
https://vuldb.com/vuln/403407/cti	signaturepermissions-required
https://vuldb.com/cve/CVE-2026-90852	third-party-advisory
https://vuldb.com/submit/927022	third-party-advisory
https://github.com/luben/zstd-jni/issues/404	exploitissue-tracking
https://github.com/luben/zstd-jni/commit/a560131d…	patch
https://github.com/luben/zstd-jni/releases/tag/v1…	patch
https://github.com/luben/zstd-jni/	product

Impacted products

1 product

Vendor	Product	Version	CPE status
luben	zstd-jni	Affected: 1.5.7-13 Unaffected: 1.5.7-14 cpe:2.3:a:luben:zstd-jni::::::::

Credits

Yu Bao from PayPal Cyber Security Team (VulDB User) VulDB CNA Team

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-90852",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-15T18:17:19.961312Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-15T18:19:04.282Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:luben:zstd-jni:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "Dictionary Sharing"
          ],
          "product": "zstd-jni",
          "vendor": "luben",
          "versions": [
            {
              "status": "affected",
              "version": "1.5.7-13"
            },
            {
              "status": "unaffected",
              "version": "1.5.7-14"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Yu Bao from PayPal Cyber Security Team (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability has been found in luben zstd-jni up to 1.5.7-13. This vulnerability affects the function ZstdCompressCtx.loadDict of the file ZstdCompressCtx.java of the component Dictionary Sharing. Such manipulation leads to use after free. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.5.7-14 is able to resolve this issue. The name of the patch is a560131d7834598afd9cea6b7c107bc88e915936. The affected component should be upgraded. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 7.5,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-416",
              "description": "Use After Free",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-119",
              "description": "Memory Corruption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-15T02:15:10.581Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-403407 | luben zstd-jni Dictionary Sharing ZstdCompressCtx.java ZstdCompressCtx.loadDict use after free",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/403407"
        },
        {
          "name": "VDB-403407 | CTI Indicators (IOB, IOC, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/403407/cti"
        },
        {
          "name": "CVE-2026-90852 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-90852"
        },
        {
          "name": "Submit #927022 | luben zstd-jni 1.5.7-13 Cross-Object Use-After-Free",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/927022"
        },
        {
          "tags": [
            "exploit",
            "issue-tracking"
          ],
          "url": "https://github.com/luben/zstd-jni/issues/404"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/luben/zstd-jni/commit/a560131d7834598afd9cea6b7c107bc88e915936"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/luben/zstd-jni/"
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-14T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-09-14T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-09-14T07:42:10.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "luben zstd-jni Dictionary Sharing ZstdCompressCtx.java ZstdCompressCtx.loadDict use after free",
      "x_generator": [
        "VulDB PVTS v202609"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-90852",
    "datePublished": "2026-09-15T02:15:10.581Z",
    "dateReserved": "2026-09-14T05:37:05.957Z",
    "dateUpdated": "2026-09-15T18:19:04.282Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-90852",
      "date": "2026-09-16",
      "epss": "0.00314",
      "percentile": "0.24362"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-90852\",\"sourceIdentifier\":\"cna@vuldb.com\",\"published\":\"2026-09-15T03:17:06.377\",\"lastModified\":\"2026-09-15T19:17:46.910\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A vulnerability has been found in luben zstd-jni up to 1.5.7-13. This vulnerability affects the function ZstdCompressCtx.loadDict of the file ZstdCompressCtx.java of the component Dictionary Sharing. Such manipulation leads to use after free. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.5.7-14 is able to resolve this issue. The name of the patch is a560131d7834598afd9cea6b7c107bc88e915936. The affected component should be upgraded. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.\"}],\"affected\":[{\"source\":\"cna@vuldb.com\",\"affectedData\":[{\"vendor\":\"luben\",\"product\":\"zstd-jni\",\"cpes\":[\"cpe:2.3:a:luben:zstd-jni:*:*:*:*:*:*:*:*\"],\"modules\":[\"Dictionary Sharing\"],\"versions\":[{\"version\":\"1.5.7-13\",\"status\":\"affected\"},{\"version\":\"1.5.7-14\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"cna@vuldb.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"LOW\",\"vulnIntegrityImpact\":\"LOW\",\"vulnAvailabilityImpact\":\"LOW\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"PROOF_OF_CONCEPT\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"cvssMetricV31\":[{\"source\":\"cna@vuldb.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L\",\"baseScore\":7.3,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":3.9,\"impactScore\":3.4}],\"cvssMetricV2\":[{\"source\":\"cna@vuldb.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:P/I:P/A:P\",\"baseScore\":7.5,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"HIGH\",\"exploitabilityScore\":10.0,\"impactScore\":6.4,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-09-15T18:17:19.961312Z\",\"id\":\"CVE-2026-90852\",\"options\":[{\"exploitation\":\"poc\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"cna@vuldb.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-119\"},{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"references\":[{\"url\":\"https://github.com/luben/zstd-jni/\",\"source\":\"cna@vuldb.com\"},{\"url\":\"https://github.com/luben/zstd-jni/commit/a560131d7834598afd9cea6b7c107bc88e915936\",\"source\":\"cna@vuldb.com\"},{\"url\":\"https://github.com/luben/zstd-jni/issues/404\",\"source\":\"cna@vuldb.com\"},{\"url\":\"https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14\",\"source\":\"cna@vuldb.com\"},{\"url\":\"https://vuldb.com/cve/CVE-2026-90852\",\"source\":\"cna@vuldb.com\"},{\"url\":\"https://vuldb.com/submit/927022\",\"source\":\"cna@vuldb.com\"},{\"url\":\"https://vuldb.com/vuln/403407\",\"source\":\"cna@vuldb.com\"},{\"url\":\"https://vuldb.com/vuln/403407/cti\",\"source\":\"cna@vuldb.com\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-09-15T18:28:16+00:00",
      "cve": "CVE-2026-90852",
      "id": "CVE-2026-90852",
      "initial_release_date": "2026-09-15T02:15:10.581000+00:00",
      "product_status:known_affected": "24",
      "product_status:known_not_affected": "7",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "com.github.luben/zstd-jni: luben zstd-jni: Remote use-after-free vulnerability in dictionary sharing",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-90852.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-15T23:58:52Z",
      "cve": "CVE-2026-90852",
      "id": "CVE-2026-90852",
      "initial_release_date": "2026-09-15T23:58:52Z",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-90852",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-90852.json",
      "version": "2"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-90852\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-09-15T18:17:19.961312Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-09-15T18:18:55.544Z\"}}], \"cna\": {\"tags\": [\"x_open-source\"], \"title\": \"luben zstd-jni Dictionary Sharing ZstdCompressCtx.java ZstdCompressCtx.loadDict use after free\", \"credits\": [{\"lang\": \"en\", \"type\": \"reporter\", \"value\": \"Yu Bao from PayPal Cyber Security Team (VulDB User)\"}, {\"lang\": \"en\", \"type\": \"coordinator\", \"value\": \"VulDB CNA Team\"}], \"metrics\": [{\"cvssV4_0\": {\"version\": \"4.0\", \"baseScore\": 6.9, \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P\"}}, {\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.3, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C\"}}, {\"cvssV3_0\": {\"version\": \"3.0\", \"baseScore\": 7.3, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C\"}}, {\"cvssV2_0\": {\"version\": \"2.0\", \"baseScore\": 7.5, \"vectorString\": \"AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C\"}}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:luben:zstd-jni:*:*:*:*:*:*:*:*\"], \"vendor\": \"luben\", \"modules\": [\"Dictionary Sharing\"], \"product\": \"zstd-jni\", \"versions\": [{\"status\": \"affected\", \"version\": \"1.5.7-13\"}, {\"status\": \"unaffected\", \"version\": \"1.5.7-14\"}]}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-09-14T00:00:00.000Z\", \"value\": \"Advisory disclosed\"}, {\"lang\": \"en\", \"time\": \"2026-09-14T02:00:00.000Z\", \"value\": \"VulDB entry created\"}, {\"lang\": \"en\", \"time\": \"2026-09-14T07:42:10.000Z\", \"value\": \"VulDB entry last update\"}], \"references\": [{\"url\": \"https://vuldb.com/vuln/403407\", \"name\": \"VDB-403407 | luben zstd-jni Dictionary Sharing ZstdCompressCtx.java ZstdCompressCtx.loadDict use after free\", \"tags\": [\"vdb-entry\", \"technical-description\"]}, {\"url\": \"https://vuldb.com/vuln/403407/cti\", \"name\": \"VDB-403407 | CTI Indicators (IOB, IOC, IOA)\", \"tags\": [\"signature\", \"permissions-required\"]}, {\"url\": \"https://vuldb.com/cve/CVE-2026-90852\", \"name\": \"CVE-2026-90852 | CVE Analysis and Report\", \"tags\": [\"third-party-advisory\"]}, {\"url\": \"https://vuldb.com/submit/927022\", \"name\": \"Submit #927022 | luben zstd-jni 1.5.7-13 Cross-Object Use-After-Free\", \"tags\": [\"third-party-advisory\"]}, {\"url\": \"https://github.com/luben/zstd-jni/issues/404\", \"tags\": [\"exploit\", \"issue-tracking\"]}, {\"url\": \"https://github.com/luben/zstd-jni/commit/a560131d7834598afd9cea6b7c107bc88e915936\", \"tags\": [\"patch\"]}, {\"url\": \"https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14\", \"tags\": [\"patch\"]}, {\"url\": \"https://github.com/luben/zstd-jni/\", \"tags\": [\"product\"]}], \"x_generator\": [\"VulDB PVTS v202609\"], \"descriptions\": [{\"lang\": \"en\", \"value\": \"A vulnerability has been found in luben zstd-jni up to 1.5.7-13. This vulnerability affects the function ZstdCompressCtx.loadDict of the file ZstdCompressCtx.java of the component Dictionary Sharing. Such manipulation leads to use after free. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.5.7-14 is able to resolve this issue. The name of the patch is a560131d7834598afd9cea6b7c107bc88e915936. The affected component should be upgraded. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-416\", \"description\": \"Use After Free\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-119\", \"description\": \"Memory Corruption\"}]}], \"providerMetadata\": {\"orgId\": \"1af790b2-7ee1-4545-860a-a788eba489b5\", \"shortName\": \"VulDB\", \"dateUpdated\": \"2026-09-15T02:15:10.581Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-90852\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-09-15T18:19:04.282Z\", \"dateReserved\": \"2026-09-14T05:37:05.957Z\", \"assignerOrgId\": \"1af790b2-7ee1-4545-860a-a788eba489b5\", \"datePublished\": \"2026-09-15T02:15:10.581Z\", \"assignerShortName\": \"VulDB\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-90852

Vulnerability from fkie_nvd - Published: 2026-09-15 03:17 - Updated: 2026-09-15 19:17

Severity

7.3 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Summary

References

	URL	Tags
	cna@vuldb.com	https://github.com/luben/zstd-jni/
	cna@vuldb.com	https://github.com/luben/zstd-jni/commit/a560131d7834598afd9cea6b7c107bc88e915936
	cna@vuldb.com	https://github.com/luben/zstd-jni/issues/404
	cna@vuldb.com	https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14
	cna@vuldb.com	https://vuldb.com/cve/CVE-2026-90852
	cna@vuldb.com	https://vuldb.com/submit/927022
	cna@vuldb.com	https://vuldb.com/vuln/403407
	cna@vuldb.com	https://vuldb.com/vuln/403407/cti

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:luben:zstd-jni:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "Dictionary Sharing"
          ],
          "product": "zstd-jni",
          "vendor": "luben",
          "versions": [
            {
              "status": "affected",
              "version": "1.5.7-13"
            },
            {
              "status": "unaffected",
              "version": "1.5.7-14"
            }
          ]
        }
      ],
      "source": "cna@vuldb.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability has been found in luben zstd-jni up to 1.5.7-13. This vulnerability affects the function ZstdCompressCtx.loadDict of the file ZstdCompressCtx.java of the component Dictionary Sharing. Such manipulation leads to use after free. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.5.7-14 is able to resolve this issue. The name of the patch is a560131d7834598afd9cea6b7c107bc88e915936. The affected component should be upgraded. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product."
    }
  ],
  "id": "CVE-2026-90852",
  "lastModified": "2026-09-15T19:17:46.910",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 7.5,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "cna@vuldb.com",
        "type": "Secondary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 7.3,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.4,
        "source": "cna@vuldb.com",
        "type": "Secondary"
      }
    ],
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 5.5,
          "baseSeverity": "MEDIUM",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "PROOF_OF_CONCEPT",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "LOW",
          "vulnConfidentialityImpact": "LOW",
          "vulnIntegrityImpact": "LOW",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "cna@vuldb.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-90852",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-09-15T18:17:19.961312Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-09-15T03:17:06.377",
  "references": [
    {
      "source": "cna@vuldb.com",
      "url": "https://github.com/luben/zstd-jni/"
    },
    {
      "source": "cna@vuldb.com",
      "url": "https://github.com/luben/zstd-jni/commit/a560131d7834598afd9cea6b7c107bc88e915936"
    },
    {
      "source": "cna@vuldb.com",
      "url": "https://github.com/luben/zstd-jni/issues/404"
    },
    {
      "source": "cna@vuldb.com",
      "url": "https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14"
    },
    {
      "source": "cna@vuldb.com",
      "url": "https://vuldb.com/cve/CVE-2026-90852"
    },
    {
      "source": "cna@vuldb.com",
      "url": "https://vuldb.com/submit/927022"
    },
    {
      "source": "cna@vuldb.com",
      "url": "https://vuldb.com/vuln/403407"
    },
    {
      "source": "cna@vuldb.com",
      "url": "https://vuldb.com/vuln/403407/cti"
    }
  ],
  "sourceIdentifier": "cna@vuldb.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-119"
        },
        {
          "lang": "en",
          "value": "CWE-416"
        }
      ],
      "source": "cna@vuldb.com",
      "type": "Secondary"
    }
  ]
}

GHSA-HHH7-CPVM-VXXC

Vulnerability from github – Published: 2026-09-15 03:30 – Updated: 2026-09-15 03:30

Details

Severity

7.3 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

5.5 (Medium)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-90852"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-119"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-15T03:17:06Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability has been found in luben zstd-jni up to 1.5.7-13. This vulnerability affects the function ZstdCompressCtx.loadDict of the file ZstdCompressCtx.java of the component Dictionary Sharing. Such manipulation leads to use after free. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.5.7-14 is able to resolve this issue. The name of the patch is a560131d7834598afd9cea6b7c107bc88e915936. The affected component should be upgraded. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.",
  "id": "GHSA-hhh7-cpvm-vxxc",
  "modified": "2026-09-15T03:30:30Z",
  "published": "2026-09-15T03:30:30Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-90852"
    },
    {
      "type": "WEB",
      "url": "https://github.com/luben/zstd-jni/issues/404"
    },
    {
      "type": "WEB",
      "url": "https://github.com/luben/zstd-jni/commit/a560131d7834598afd9cea6b7c107bc88e915936"
    },
    {
      "type": "WEB",
      "url": "https://github.com/luben/zstd-jni"
    },
    {
      "type": "WEB",
      "url": "https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/cve/CVE-2026-90852"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/submit/927022"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/vuln/403407"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/vuln/403407/cti"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

ubuntu-cve-2026-90852

Vulnerability from osv_ubuntu

Published

2026-09-15 03:17

Modified

2026-09-15 03:17

Summary

Details

Severity

7.3 (High)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

5.5 (Medium)


                    
                      CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2026-90852	REPORT
	https://www.cve.org/CVERecord?id=CVE-2026-90852	REPORT
	https://github.com/luben/zstd-jni/issues/404	REPORT
	https://github.com/luben/zstd-jni/	REPORT
	https://github.com/luben/zstd-jni/commit/a560131d…	REPORT
	https://github.com/luben/zstd-jni/releases/tag/v1…	REPORT
	https://vuldb.com/cve/CVE-2026-90852	REPORT
	https://vuldb.com/submit/927022	REPORT
	https://vuldb.com/vuln/403407	REPORT
	https://vuldb.com/vuln/403407/cti	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libzstd-jni-java",
            "binary_version": "1.5.2-5+ds-3build1"
          },
          {
            "binary_name": "libzstd-jni1",
            "binary_version": "1.5.2-5+ds-3build1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "zstd-jni-java",
        "purl": "pkg:deb/ubuntu/zstd-jni-java@1.5.2-5+ds-3build1?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.5.2-5+ds-3",
        "1.5.2-5+ds-3build1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libzstd-jni-java",
            "binary_version": "1.5.2-5+ds-8"
          },
          {
            "binary_name": "libzstd-jni1",
            "binary_version": "1.5.2-5+ds-8"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "zstd-jni-java",
        "purl": "pkg:deb/ubuntu/zstd-jni-java@1.5.2-5+ds-8?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.5.2-5+ds-7",
        "1.5.2-5+ds-7build1",
        "1.5.2-5+ds-7ubuntu1",
        "1.5.2-5+ds-8"
      ]
    }
  ],
  "aliases": [],
  "details": "A vulnerability has been found in luben zstd-jni up to 1.5.7-13. This vulnerability affects the function ZstdCompressCtx.loadDict of the file ZstdCompressCtx.java of the component Dictionary Sharing. Such manipulation leads to use after free. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.5.7-14 is able to resolve this issue. The name of the patch is a560131d7834598afd9cea6b7c107bc88e915936. The affected component should be upgraded. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.",
  "id": "UBUNTU-CVE-2026-90852",
  "modified": "2026-09-15T03:17:00Z",
  "published": "2026-09-15T03:17:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-90852"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-90852"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/luben/zstd-jni/issues/404"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/luben/zstd-jni/"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/luben/zstd-jni/commit/a560131d7834598afd9cea6b7c107bc88e915936"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14"
    },
    {
      "type": "REPORT",
      "url": "https://vuldb.com/cve/CVE-2026-90852"
    },
    {
      "type": "REPORT",
      "url": "https://vuldb.com/submit/927022"
    },
    {
      "type": "REPORT",
      "url": "https://vuldb.com/vuln/403407"
    },
    {
      "type": "REPORT",
      "url": "https://vuldb.com/vuln/403407/cti"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
      "type": "CVSS_V4"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2026-90852"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-90852 (GCVE-0-2026-90852)

FKIE_CVE-2026-90852

GHSA-HHH7-CPVM-VXXC

ubuntu-cve-2026-90852

Vulnerability from osv_ubuntu

Tags

Sightings

Nomenclature

Related by attack behaviour