CVE-2026-90852
highA vulnerability has been found in luben zstd-jni up to 1.5.7-13.
A vulnerability has been found in luben zstd-jni up to 1.5.7-13. This vulnerability affects the function ZstdCompressCtx.loadDict of the file ZstdCompressCtx.java of the component Dictionary Sharing. Such manipulation leads to use after free. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.5.7-14 is able to resolve this issue. The name of the patch is a560131d7834598afd9cea6b7c107bc88e915936. The affected component should be upgraded. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/luben/zstd-jni/ cna@vuldb.com
- https://github.com/luben/zstd-jni/commit/a560131d7834598afd9cea6b7c107bc88e915936 cna@vuldb.com
- https://github.com/luben/zstd-jni/issues/404 cna@vuldb.com
- https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14 cna@vuldb.com
- https://vuldb.com/cve/CVE-2026-90852 cna@vuldb.com
- https://vuldb.com/submit/927022 cna@vuldb.com
- https://vuldb.com/vuln/403407 cna@vuldb.com
- https://vuldb.com/vuln/403407/cti cna@vuldb.com