AIKIDO-2026-954873
zstd-jni is vulnerable to Integer Overflow
57
Medium Risk
This Affects:
zstd-jniTL;DR
decompressedDirectByteBufferSize, getDirectByteBufferFrameContentSize, and findDirectByteBufferFrameCompressedSize add src_offset and src_size as signed 32-bit integers. A negative value or a sum that wraps makes the bounds check succeed, and the native code then reads outside the direct buffer and can crash the JVM. The fix rejects negative values and checks that the offset is not past the remaining buffer.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your code calls the direct ByteBuffer frame size methods.
Background info
zstd-jni is vulnerable to Integer Overflow in versions 1.1.1 - 1.5.7-13.
How to fix this
Upgrade the com.github.luben:zstd-jni library to the patch version.
Links
GitHub Release
Fix Commits
github.com/luben/zstd-jni/commit/46dcb2a54c8b8f2ce2cad7187a7513f509c533acgithub.com/luben/zstd-jni/commit/d7a1c99322d5e1fc71932e722c0b5bb2fc525d3fOther
github.com/luben/zstd-jni/compare/v1.5.7-13...v1.5.7-14github.com/luben/zstd-jnigithub.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/Zstd.javagithub.com/luben/zstd-jni/blob/v1.5.7-13/src/main/native/jni_zstd.c
vulncheck.com/advisories/zstd-jni-1.1.1-through-1.5.7-13-out-of-bounds-read-via-direct-bytebuffer-frame-size-methods
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.