Description
zstd-jni versions before 1.5.7-14 fail to validate offset and length parameters in the ZstdDictCompress constructor, allowing out-of-bounds memory reads. Attackers can supply untrusted offset or length values to read native heap memory into the compression dictionary, typically causing JVM crashes.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
luben zstd-jni
Default version status: unaffected
1.2.0 to < 1.5.7-14affected
pkg:maven/com.github.luben/zstd-jniReferences
- https://github.com/luben/zstd-jni/security/advisories/GHSA-ff36-7w3w-g8rm ↗
- https://github.com/luben/zstd-jni/commit/0d64de4dee6606ff506be36c7f2e714ad0c80fdb ↗
- https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/ZstdDictCompress.java ↗
- https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/native/jni_fast_zstd.c ↗
- https://github.com/luben/zstd-jni/commit/1c4e5a6c3ce8458095225d987d669e6a0937734a ↗
- https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14 ↗
- https://github.com/luben/zstd-jni ↗
- https://www.vulncheck.com/advisories/zstd-jni-1.2.0-through-1.5.7-13-out-of-bounds-read-via-zstddictcompress ↗