Packages / Debian 13 (Trixie) / Source / libs / zstd-jni-java
JNI bindings for Zstd (Architecture-specific files)
JNI bindings for Zstd (Java files)
Matching against OpenFactory catalog package versions is in progress.
| CVE | Severity | Version impact |
|---|---|---|
| [CVE-2026-90852] Published: A vulnerability has been found in luben zstd-jni up to 1.5.7-13. This vulnerability affects the function ZstdCompressCtx.loadDict of the file ZstdCompressCtx.java of the component Dictionary Sharing. | High(7.3) | AffectedDetails (4)
|
| [CVE-2026-90560] Published: zstd-jni versions 1.2.0 through 1.5.7-13 contain an out-of-bounds read vulnerability in the ZstdDictDecompress constructor because offset and length arguments are never validated against the dictionar | High(8.8) | AffectedDetails (4)
|
| [CVE-2026-89046] Published: zstd-jni versions 1.5.5-6 through 1.5.7-13 contain an out-of-bounds read vulnerability in Zstd.getFrameContentSize that fails to validate negative srcPosition arguments. Attackers can supply negative | High(8.8) | AffectedDetails (4)
|
| [CVE-2026-89045] Published: zstd-jni versions 1.4.8-4 through 1.5.7-13 fail to validate negative length parameters in ZstdInputStreamNoFinalizer.read(), allowing attackers to trigger infinite loops. Attackers can pass negative l | Medium(5.1) | AffectedDetails (4)
|
| [CVE-2026-87877] Published: zstd-jni versions before 1.5.7-14 fail to validate closed state in setDict, setLongMax, setLevel and setRefMultipleDDicts methods of stream classes. Attackers can call these methods on closed streams | High(7.7) | AffectedDetails (4)
|
| [CVE-2026-87825] Published: zstd-jni before 1.5.7-14 contains a use-after-free vulnerability where streams and contexts hold a dictionary's shared lock only during the load call, allowing the dictionary to be closed while still | High(7.7) | AffectedDetails (4)
|
| [CVE-2026-87824] Published: zstd-jni before 1.5.7-14 fails to validate the samples buffer capacity in Zstd.trainFromBufferDirect, allowing attackers to read past buffer boundaries by supplying oversized per-sample lengths. Attac | High(8.7) | AffectedDetails (4)
|
| [CVE-2026-87823] Published: zstd-jni before 1.5.7-14 performs 32-bit signed bounds checks on three direct-ByteBuffer frame-size native methods, allowing out-of-bounds memory reads via negative or overflowing offsets. Attackers c | High(8.8) | AffectedDetails (4)
|
| [CVE-2026-87795] Published: zstd-jni versions before 1.5.7-14 fail to validate offset and length parameters in the ZstdDictCompress constructor, allowing out-of-bounds memory reads. Attackers can supply untrusted offset or lengt | High(8.8) | AffectedDetails (4)
|
Last synced:
Authoritative source; repository metadata signature verified
trixie-main-amd64:3ab4e811cf4f3e5a335d382c58cc19d85f1abe7a4ef4689160ca1f637fa0e9b3
Authoritative source; repository metadata signature verified
trixie-main-arm64:753da751bbc7a679f48bd1b623ffd4479cb6861c426118284c76eb82909e4908