RHSA-2026:95221

zstd-jni versions 1.2.0 through 1.5.7-13 contain an out-of-bounds read vulnerability in the ZstdDictDecompress constructor because offset and length arguments are never validated against the dictionary array bounds.

zstd-jni versions 1.5.5-6 through 1.5.7-13 contain an out-of-bounds read vulnerability in Zstd.getFrameContentSize that fails to validate negative srcPosition arguments.

zstd-jni versions before 1.5.7-14 fail to validate offset and length parameters in the ZstdDictCompress constructor, allowing out-of-bounds memory reads.

A flaw was found in RESTEasy's IIOImageProvider, which decodes attacker-supplied image request bodies without enforcing any limit on the declared image dimensions or pixel count.

jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to DatatypeFactory.newDuration(value) or newXMLGregorianCalendar(v…

A vulnerability has been found in luben zstd-jni up to 1.5.7-13.

A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins ("*"), reflects the request's Origin header back in the Access-Control-Allow-Origin response together with Access-Control-Allow-Crede…

zstd-jni versions before 1.5.7-14 fail to validate closed state in setDict, setLongMax, setLevel and setRefMultipleDDicts methods of stream classes.

zstd-jni before 1.5.7-14 contains a use-after-free vulnerability where streams and contexts hold a dictionary's shared lock only during the load call, allowing the dictionary to be closed while still referenced.

A flaw was found in Netty.

A flaw was found in Netty's HTTP/2 codec.

zstd-jni before 1.5.7-14 fails to validate the samples buffer capacity in Zstd.trainFromBufferDirect, allowing attackers to read past buffer boundaries by supplying oversized per-sample lengths.

A flaw was found in Netty.

A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service.

A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service.

A pre-authentication attacker could leverage unbounded symbol value caching to cause resource exhaustion leading to denial of service.

A flaw was found in RESTEasy's SourceProvider.

Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments.

A flaw was found in Netty's HTTP/2 stack.

Netty is an asynchronous, event-driven network application framework.

A flaw was found in Netty's HTTP/2 HpackEncoder.

An unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a crafted add_auth("ensemble", ...) request containing newline characters (\n).

Using untrusted, non-normalized input as-is for metrics data (such as metric names, tag keys, or tag values) is a dangerous antipattern that general-purpose instrumentation should never perform.