zstd-jni is vulnerable to Use-After-Free
77
High Risk
Stream and context setDict and loadDict methods hold the dictionary lock only while the native load call runs, then release it. close() on the dictionary frees the native dictionary while the stream or context still stores that pointer, so a later read or write uses freed memory and can crash the JVM. The fix keeps the dictionary lock until the stream or context is closed.
You are affected if you are using a version that falls within the vulnerable range and your code closes a dictionary that a stream or context still uses.
zstd-jni is vulnerable to Use-After-Free in versions 1.3.8-4 - 1.5.7-13.
Upgrade the com.github.luben:zstd-jni library to the patch version.
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.