CVE-2026-90560
zstd-jni 1.2.0 through 1.5.7-13 Out-of-Bounds Read via ZstdDictDecompress
CVSS Score
8.2
EPSS Score
0.0%
EPSS Percentile
0th
zstd-jni versions 1.2.0 through 1.5.7-13 contain an out-of-bounds read vulnerability in the ZstdDictDecompress constructor because offset and length arguments are never validated against the dictionary array bounds. Attackers can supply arbitrary offset or length values to read memory past the end of the supplied array, potentially causing JVM termination.
| CWE | CWE-125 |
| Vendor | luben |
| Product | zstd-jni |
| Published | Sep 12, 2026 |
| Last Updated | Sep 14, 2026 |
Stay Ahead of the Next One
Get instant alerts for luben zstd-jni
Be the first to know when new high vulnerabilities affecting luben zstd-jni are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
High
Affected Versions
luben / zstd-jni
1.2.0 < 1.5.7-14
References
github.com: https://github.com/luben/zstd-jni/issues/405 github.com: https://github.com/luben/zstd-jni github.com: https://github.com/luben/zstd-jni/commit/b74ab242d640c40897e62aab4c744ddfad1f915f github.com: https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/ZstdDictDecompress.java#L49 github.com: https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14 github.com: https://github.com/luben/zstd-jni/blob/v1.2.0/src/main/java/com/github/luben/zstd/ZstdDictDecompress.java#L37 vulncheck.com: https://www.vulncheck.com/advisories/zstd-jni-1.2.0-through-1.5.7-13-out-of-bounds-read-via-zstddictdecompress
Credits
Yu Bao, PayPal Cyber Security Team