[From nobody Wed Oct 14 12:37:12 2026 Received: (at submit) by bugs.debian.org; 11 Sep 2026 14:43:35 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02 (2024-03-25) on buxtehude.debian.org X-Spam-Level: X-Spam-Status: No, score=-10.0 required=4.0 tests=BAYES_00,FROMDEVELOPER, NO_RELAYS,XMAILER_REPORTBUG autolearn=ham autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02 X-Spam-Bayes: score:0.0000 Tokens: new, 78; hammy, 150; neutral, 123; spammy, 0. spammytokens: hammytokens:0.000-+--XDebbugsCc, 0.000-+--X-Debbugs-Cc, 0.000-+--H*F:U*carnil, 0.000-+--H*Ad:N*Bug, 0.000-+--HTo:N*Debian Return-path: <carnil@debian.org> Received: via submission by buxtehude.debian.org with esmtp (Exim 4.96) (envelope-from <carnil@debian.org>) id 1x52TW-006ocM-0w for submit@bugs.debian.org; Fri, 11 Sep 2026 14:43:35 +0000 Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit From: Salvatore Bonaccorso <carnil@debian.org> To: Debian Bug Tracking System <submit@bugs.debian.org> Subject: zstd-jni-java: CVE-2026-87795 CVE-2026-87823 CVE-2026-87824 CVE-2026-87825 CVE-2026-87877 CVE-2026-89045 CVE-2026-89046 Message-ID: <178913781334.2612984.10923210497049901396.reportbug@eldamar.lan> X-Mailer: reportbug 13.2.0+nmu1 Date: Fri, 11 Sep 2026 16:43:33 +0200 Delivered-To: submit@bugs.debian.org Source: zstd-jni-java Version: 1.5.2-5+ds-8 Severity: grave Tags: security upstream Justification: user security hole X-Debbugs-Cc: carnil@debian.org, Debian Security Team <team@security.debian.org> Hi, The following vulnerabilities were published for zstd-jni-java. CVE-2026-87795[0]: | zstd-jni versions before 1.5.7-14 fail to validate offset and length | parameters in the ZstdDictCompress constructor, allowing out-of- | bounds memory reads. Attackers can supply untrusted offset or length | values to read native heap memory into the compression dictionary, | typically causing JVM crashes. CVE-2026-87823[1]: | zstd-jni before 1.5.7-14 performs 32-bit signed bounds checks on | three direct-ByteBuffer frame-size native methods, allowing out-of- | bounds memory reads via negative or overflowing offsets. Attackers | can supply negative offset values near Integer.MIN_VALUE to read | unmapped memory, causing JVM termination or extracting arbitrary | frame size data from unintended memory locations. CVE-2026-87824[2]: | zstd-jni before 1.5.7-14 fails to validate the samples buffer | capacity in Zstd.trainFromBufferDirect, allowing attackers to read | past buffer boundaries by supplying oversized per-sample lengths. | Attackers can trigger out-of-bounds memory access by providing | crafted sample length arrays that cause the native implementation to | walk past the buffer allocation, resulting in JVM termination. CVE-2026-87825[3]: | zstd-jni before 1.5.7-14 contains a use-after-free vulnerability | where streams and contexts hold a dictionary's shared lock only | during the load call, allowing the dictionary to be closed while | still referenced. Attackers can close a dictionary after associating | it with a stream or context, causing subsequent read or write | operations to access freed native memory, resulting in silent data | corruption or JVM crashes. CVE-2026-87877[4]: | zstd-jni versions before 1.5.7-14 fail to validate closed state in | setDict, setLongMax, setLevel and setRefMultipleDDicts methods of | stream classes. Attackers can call these methods on closed streams | to write through freed native pointers, corrupting unrelated objects | or crashing the JVM. CVE-2026-89045[5]: | zstd-jni versions 1.4.8-4 through 1.5.7-13 fail to validate negative | length parameters in ZstdInputStreamNoFinalizer.read(), allowing | attackers to trigger infinite loops. Attackers can pass negative | length values to cause the read method to spin indefinitely while | holding the stream monitor, blocking all other threads from | accessing the stream. CVE-2026-89046[6]: | zstd-jni versions 1.5.5-6 through 1.5.7-13 contain an out-of-bounds | read vulnerability in Zstd.getFrameContentSize that fails to | validate negative srcPosition arguments. Attackers can supply | negative offset values that bypass bounds checks and reach the | native frame-header parser, causing out-of-bounds memory reads that | lead to information disclosure or JVM crashes. If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-87795 https://www.cve.org/CVERecord?id=CVE-2026-87795 [1] https://security-tracker.debian.org/tracker/CVE-2026-87823 https://www.cve.org/CVERecord?id=CVE-2026-87823 [2] https://security-tracker.debian.org/tracker/CVE-2026-87824 https://www.cve.org/CVERecord?id=CVE-2026-87824 [3] https://security-tracker.debian.org/tracker/CVE-2026-87825 https://www.cve.org/CVERecord?id=CVE-2026-87825 [4] https://security-tracker.debian.org/tracker/CVE-2026-87877 https://www.cve.org/CVERecord?id=CVE-2026-87877 [5] https://security-tracker.debian.org/tracker/CVE-2026-89045 https://www.cve.org/CVERecord?id=CVE-2026-89045 [6] https://security-tracker.debian.org/tracker/CVE-2026-89046 https://www.cve.org/CVERecord?id=CVE-2026-89046 Please adjust the affected versions in the BTS as needed. Regards, Salvatore ]