CVE-2026-90560: zstd-jni 1.2.0 through 1.5.7-13 Out-of-Bounds Read via ZstdDictDecompress
zstd-jni versions 1.2.0 through 1.5.7-13 contain an out-of-bounds read vulnerability in the ZstdDictDecompress constructor because offset and length arguments are never validated against the dictionary array bounds. Attackers can supply arbitrary offset or length values to read memory past the end of the supplied array, potentially causing JVM termination.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
zstd-jnito a version that resolves this vulnerability.Fixed in 1.5.7-13 - Compensating control
Ensure that any code paths invoking zstd-jni ZstdDictDecompress validate (or constrain) provided offset and length values to be within dictionary array bounds, since the vulnerability description states that offset/length are never validated against the dictionary array bounds.
Event History
Frequently Asked Questions
What conditions are required for exploitation?
An attacker must be able to cause the application to invoke the ZstdDictDecompress constructor with attacker-controlled offset or length values and a supplied dictionary array. No authentication or user interaction is required according to the CVSS vector.
What is the likely operational impact?
Invalid offset or length values can cause reads past the end of the dictionary array, potentially terminating the JVM. The reported impact includes high availability impact and low confidentiality impact.
Which releases should be investigated?
Investigate deployments using zstd-jni versions 1.2.0 through 1.5.7-13, inclusive. Review both direct dependencies and bundled or transitive uses of zstd-jni.