AIKIDO-2026-989226
zstd-jni is vulnerable to Out-of-bounds Read
75
High Risk
This Affects:
zstd-jniTL;DR
Zstd.trainFromBufferDirect checks the dictionary buffer capacity but not the samples buffer. Each entry in sampleSizes is copied into the native trainer, so a sum larger than samples.capacity() makes the trainer read past the buffer and crash the JVM. The fix rejects a negative sample size and a total that exceeds the samples buffer.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your code calls Zstd.trainFromBufferDirect.
Background info
zstd-jni is vulnerable to Out-of-bounds Read in versions 1.3.3-1 - 1.5.7-13.
How to fix this
Upgrade the com.github.luben:zstd-jni library to the patch version.
Links
GitHub Release
Fix Commits
github.com/luben/zstd-jni/commit/53d3c6342883f7d6717b2477a7f9c1b4a4a56980github.com/luben/zstd-jni/commit/bba6cfca2c0897f1fa004f4193247479f10da853Other
github.com/luben/zstd-jni/compare/v1.5.7-13...v1.5.7-14github.com/luben/zstd-jnigithub.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/Zstd.javagithub.com/luben/zstd-jni/blob/v1.5.7-13/src/main/native/jni_zdict.c
vulncheck.com/advisories/zstd-jni-1.3.3-1-through-1.5.7-13-out-of-bounds-read-via-zstd-trainfrombufferdirect
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.