AIKIDO-2026-536802
zstd-jni is vulnerable to Use-After-Free
77
High Risk
This Affects:
zstd-jniTL;DR
setDict, setLongMax, setLevel, and setRefMultipleDDicts on the zstd stream classes do not check whether the stream is already closed. close() frees the native context but leaves the numeric handle in place, so a later setter writes through that freed pointer and can crash the JVM. The fix rejects those calls after close().
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your code calls a setter on a zstd stream after close().
Background info
zstd-jni is vulnerable to Use-After-Free in versions 1.3.8-4 - 1.5.7-13.
How to fix this
Upgrade the com.github.luben:zstd-jni library to the patch version.
Links
GitHub Release
Fix Commits
github.com/luben/zstd-jni/commit/0827ed02551bbd8d6f8e4bbff99d83bf50f91938github.com/luben/zstd-jni/commit/393d7311766abbc285b149302c0fe1f94b16d555github.com/luben/zstd-jni/commit/f38f9a1563113d96d0fc38baee543f7457dd8a8eOther
github.com/luben/zstd-jni/compare/v1.5.7-13...v1.5.7-14github.com/luben/zstd-jnigithub.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/BaseZstdBufferDecompressingStreamNoFinalizer.javagithub.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/ZstdInputStreamNoFinalizer.java
vulncheck.com/advisories/zstd-jni-1.3.8-4-through-1.5.7-13-use-after-free-via-setters-called-after-close
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.