Out-of-bounds ReadAffected versions of this package are vulnerable to Out-of-bounds Read through the ZstdDictDecompress(byte[] dict, int offset, int length) constructor in src/main/java/com/github/luben/zstd/ZstdDictDecompress.java. An attacker can read past the end of the supplied dictionary array by providing arbitrary offset or length values when constructing a decompression dictionary. This can expose adjacent JVM memory contents and, in affected deployments, terminate the JVM when the native code consumes the invalid range.
How to fix Out-of-bounds Read? Upgrade com.github.luben:zstd-jni to version 1.5.7-14 or higher.
| |
Infinite loopAffected versions of this package are vulnerable to Infinite loop due to negative length validation in read(byte[], int, int) in src/main/java/com/github/luben/zstd/ZstdInputStreamNoFinalizer.java. An attacker can spin a caller thread indefinitely by supplying a negative len to read(), which leaves the method retrying without making progress. Because the method is synchronized, the stuck read holds the stream’s monitor and blocks other threads that try to use the same ZstdInputStreamNoFinalizer instance, causing a thread-exhaustion denial of service.
How to fix Infinite loop? Upgrade com.github.luben:zstd-jni to version 1.5.7-14 or higher.
| |
Out-of-bounds ReadAffected versions of this package are vulnerable to Out-of-bounds Read via the getFrameContentSize(byte[], int, int, boolean) bounds check in src/main/java/com/github/luben/zstd/Zstd.java. An attacker can trigger a JVM crash or read past the start of the input buffer by supplying a negative srcPosition when calling this public API. The method only rejected offsets at or beyond src.length, so a negative offset and matching length could reach the native frame-header parser with an invalid pointer into attacker-controlled input.
How to fix Out-of-bounds Read? Upgrade com.github.luben:zstd-jni to version 1.5.7-14 or higher.
| |
Use After FreeAffected versions of this package are vulnerable to Use After Free in the setDict, setLongMax, setLevel, and setRefMultipleDDicts methods of its streaming classes. An attacker can corrupt native heap state or crash the JVM by calling these setters on a stream after close(), causing them to write through a freed native context handle. The vulnerable code lives in BaseZstdBufferDecompressingStreamNoFinalizer, ZstdInputStreamNoFinalizer, and ZstdOutputStreamNoFinalizer, where these post-close setters still pass the stale native pointer into zstd's dictionary and parameter-loading routines. In applications that reuse or retain stream objects across lifecycle boundaries, the resulting write can alter an unrelated live native object or trigger a JVM crash.
How to fix Use After Free? Upgrade com.github.luben:zstd-jni to version 1.5.7-14 or higher.
| |
Use After FreeAffected versions of this package are vulnerable to Use After Free through the dictionary handling in ZstdInputStreamNoFinalizer, ZstdOutputStreamNoFinalizer, ZstdCompressCtx, and ZstdDecompressCtx. An attacker can trigger native memory corruption or a JVM crash by closing a compression or decompression dictionary after it has been attached to a stream or context and then continuing to call read() or write() on that object. The vulnerable code releases the dictionary’s shared lock immediately after the native load call, while the stream or context still keeps a raw reference to the freed native dictionary. This leaves later compression or decompression operations using dangling dictionary state, which can produce silent data corruption or abort the Java process.
How to fix Use After Free? Upgrade com.github.luben:zstd-jni to version 1.5.7-14 or higher.
| |
Integer Overflow or WraparoundAffected versions of this package are vulnerable to Integer Overflow or Wraparound in the findDirectByteBufferFrameCompressedSize, decompressedDirectByteBufferSize, and getDirectByteBufferFrameContentSize native handlers in src/main/native/jni_zstd.c. An attacker can crash the JVM or trigger an out-of-bounds read by supplying crafted src_offset and src_size values to these direct ByteBuffer frame-size queries, including values near Integer.MIN_VALUE that wrap the 32-bit arithmetic used in the capacity check.
How to fix Integer Overflow or Wraparound? Upgrade com.github.luben:zstd-jni to version 1.5.7-14 or higher.
| |
Out-of-bounds ReadAffected versions of this package are vulnerable to Out-of-bounds Read through Zstd.trainFromBufferDirect0 in src/main/native/jni_zdict.c. An attacker can crash the JVM by supplying a direct samples buffer with an oversized sampleSizes array whose total length exceeds the buffer’s actual capacity. The native dictionary trainer passes the caller-provided lengths to ZDICT_trainFromBuffer without checking that they fit within the direct buffer, so it reads past the end of the sample data and can terminate applications that train dictionaries from untrusted input.
How to fix Out-of-bounds Read? Upgrade com.github.luben:zstd-jni to version 1.5.7-14 or higher.
| |
Out-of-bounds ReadAffected versions of this package are vulnerable to Out-of-bounds Read due to the ZstdDictCompress(byte[] dict, int offset, int length, int level) constructor in ZstdDictCompress.java. An attacker can trigger a native heap read, crash the JVM, or leak adjacent memory by supplying a negative offset or an oversized length when constructing a compression dictionary from untrusted input.
How to fix Out-of-bounds Read? Upgrade com.github.luben:zstd-jni to version 1.5.7-14 or higher.
| |
