Read the docs
TI-2026-59916 Aliases CVE-2026-87795GHSA-vc57-7frc-7vqx

zstd-jni 1.2.0 through 1.5.7-13 Out-of-Bounds Read via ZstdDictCompress

Priority HIGH 77CWE-125Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
Low · None · High
Fix status
Partial Red Hat: 17 fixed, 8 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat.

Summary

zstd-jni versions before 1.5.7-14 fail to validate offset and length parameters in the ZstdDictCompress constructor, allowing out-of-bounds memory reads. Attackers can supply untrusted offset or length values to read native heap memory into the compression dictionary, typically causing JVM crashes.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00633 50th percentileScored 2026-11-07
Fix Partial zstd-jni (luben): 1.5.7-14Red Hat: 17 advisoriesRed Hat: 17 fixed, 8 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
lubenzstd-jni1.2.0 to before 1.5.7-141.5.7-14Patch availableCNA
  • zstd-jni Vendorluben Affected 1.2.0 to before 1.5.7-14 Fixed in 1.5.7-14 Patch available CNA

Remediation

  • Fix · CNA zstd-jni (luben) Fixed in 1.5.7-14

Red Hat 17 advisories

  • RHSA-2026:95221 Released 2026-11-04 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 8.1.9 XP 6.0.7.GA release
    • Red Hat JBoss Enterprise Application Platform 8.1
  • RHSA-2026:88159 Released 2026-10-22 · Red Hat rating Critical
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.17 security update.
    • OpenShift Developer Tools and Services 4.17 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:88158 Released 2026-10-22 · Red Hat rating Critical
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.19 security update.
    • OpenShift Developer Tools and Services 4.19 registry.redhat.io/ocp-tools-4/jenkins-rhel9
Show 14 more Red Hat advisories
  • RHSA-2026:88157 Released 2026-10-22 · Red Hat rating Critical
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.20 security update.
    • OpenShift Developer Tools and Services 4.20 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:88156 Released 2026-10-22 · Red Hat rating Critical
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.16 security update.
    • OpenShift Developer Tools and Services 4.16 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:88155 Released 2026-10-22 · Red Hat rating Critical
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.21 security update.
    • OpenShift Developer Tools and Services 4.21 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:88154 Released 2026-10-22 · Red Hat rating Critical
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.22 security update.
    • OpenShift Developer Tools and Services 4.22 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:88153 Released 2026-10-22 · Red Hat rating Critical
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.18 security update.
    • OpenShift Developer Tools and Services 4.18 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:88151 Released 2026-10-22 · Red Hat rating Critical
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.14 security update.
    • OpenShift Developer Tools and Services 4.14 registry.redhat.io/ocp-tools-4/jenkins-rhel8
  • RHSA-2026:88152 Released 2026-10-22 · Red Hat rating Critical
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.12 security update.
    • OpenShift Developer Tools and Services 4.12 registry.redhat.io/ocp-tools-4/jenkins-rhel8
  • RHSA-2026:88149 Released 2026-10-22 · Red Hat rating Critical
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.13 security update.
    • OpenShift Developer Tools and Services 4.13 registry.redhat.io/ocp-tools-4/jenkins-rhel8
  • RHSA-2026:88150 Released 2026-10-22 · Red Hat rating Critical
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.15 security update.
    • OpenShift Developer Tools and Services 4.15 registry.redhat.io/ocp-tools-4/jenkins-rhel8
  • RHSA-2026:84734 Released 2026-10-19 · Red Hat rating Critical
    RHOAI 3.4.5 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-ai-gateway-payload-processing-rhel9, registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-autorag-rhel9 +47
  • RHSA-2026:71675 Released 2026-09-24 · Red Hat rating Important
    Red Hat Build of Apache Camel 4.18.4 for Spring Boot release.
    • Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16
  • RHSA-2026:70257 Released 2026-09-22 · Red Hat rating Important
    Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 update is now available (RHBQ 3.33.3.SP2)
    • Red Hat Build of Apache Camel 3.33.3.SP2 com.github.luben.zstd-jni-1.5.7.16-rhel8-redhat-00001.jar, com.squareup.wire.wire-runtime-6.4.7.jar, com.squareup.wire.wire-runtime-jvm-6.4.7.jar +7
  • RHSA-2026:69440 Released 2026-09-21 · Red Hat rating Important
    Red Hat build of Quarkus 3.33.3.SP2 release and security update
    • Red Hat build of Quarkus 3.33.3.SP2
  • RHSA-2026:69470 Released 2026-09-21 · Red Hat rating Important
    Red Hat build of Quarkus 3.27.5.SP2 release and security update
    • Red Hat build of Quarkus 3.27.5.SP2

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    luben zstd-jni 1.5.7-14

    5 records Highest priority Priority HIGH 3 HIGH, 2 MEDIUM

    Other records, highest priority first

    • TI-2026-59940 zstd-jni 1.1.1 through 1.5.7-13 Out-of-Bounds Read via Direct ByteBuffer Frame-Size MethodsPriority HIGH 77
    • TI-2026-59963 zstd-jni 1.3.8-4 through 1.5.7-13 Use-After-Free via Setters Called After close()Priority HIGH 66
    • TI-2026-59942 zstd-jni 1.3.8-4 through 1.5.7-13 Use-After-Free of Compression and Decompression DictionariesPriority MEDIUM 64
    Show all 5 records →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Exploit IntelligenceAffectedNo fix yet
OpenShift Developer Tools and ServicesAffectedNo fix yet
Red Hat Ceph Storage 9AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 9AffectedNo fix yet
Red Hat JBoss Enterprise Application Platform Expansion PackAffectedNo fix yet
Red Hat build of Apache Camel 4 for Quarkus 3AffectedNo fix yet
Red Hat build of Apicurio Registry 3AffectedNo fix yet
Red Hat build of Debezium 3AffectedNo fix yet
OpenShift Developer Tools and Services 4.12Fixed RHSA-2026:88152
OpenShift Developer Tools and Services 4.13Fixed RHSA-2026:88149
OpenShift Developer Tools and Services 4.14Fixed RHSA-2026:88151
OpenShift Developer Tools and Services 4.15Fixed RHSA-2026:88150
OpenShift Developer Tools and Services 4.16Fixed RHSA-2026:88156
OpenShift Developer Tools and Services 4.17Fixed RHSA-2026:88159
OpenShift Developer Tools and Services 4.18Fixed RHSA-2026:88153
OpenShift Developer Tools and Services 4.19Fixed RHSA-2026:88158
OpenShift Developer Tools and Services 4.20Fixed RHSA-2026:88157
OpenShift Developer Tools and Services 4.21Fixed RHSA-2026:88155
OpenShift Developer Tools and Services 4.22Fixed RHSA-2026:88154
Red Hat Build of Apache Camel 3.33.3.SP2Fixed RHSA-2026:70257
Red Hat JBoss Enterprise Application Platform 8.1Fixed RHSA-2026:95221
Red Hat OpenShift AI 3.4Fixed RHSA-2026:84734
Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16Fixed RHSA-2026:71675
Red Hat build of Quarkus 3.27.5.SP2Fixed RHSA-2026:69470
Red Hat build of Quarkus 3.33.3.SP2Fixed RHSA-2026:69440
Not affected: 18 products
  • OpenShift Developer Tools and Services 4.12
  • OpenShift Developer Tools and Services 4.13
  • OpenShift Developer Tools and Services 4.14
  • OpenShift Developer Tools and Services 4.15
  • OpenShift Developer Tools and Services 4.16
  • OpenShift Developer Tools and Services 4.17
  • OpenShift Developer Tools and Services 4.18
  • OpenShift Developer Tools and Services 4.19
  • OpenShift Developer Tools and Services 4.20
  • OpenShift Developer Tools and Services 4.21
  • OpenShift Developer Tools and Services 4.22
  • Red Hat Build of Apache Camel 3.33.3.SP2
  • Red Hat Enterprise Linux 8
  • Red Hat Fuse 7
  • Red Hat Hardened Images
  • Red Hat JBoss Enterprise Application Platform 8
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift AI 3.4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-87795
  2. 2026-10-03 Alias added: GHSA-vc57-7frc-7vqx
  3. 2026-10-09 Fix available: RHSA-2026:69440 · Red Hat
  4. 2026-10-09 Fix available: RHSA-2026:69470 · Red Hat
  5. 2026-10-09 Fix available: RHSA-2026:70257 · Red Hat
  6. 2026-10-09 Fix available: Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP2, Red Hat build of Quarkus 3.27.5.SP2, Red Hat build of Quarkus 3.33.3.SP2 · Red Hat
  7. 2026-10-10 Fix available: Red Hat Build of Apache Camel 3.33.3.SP2 · Red Hat
  8. 2026-10-13 Affected versions changed · Red Hat
  9. 2026-10-20 Fix available: RHSA-2026:84734 · Red Hat
  10. 2026-10-20 Fix available: Red Hat OpenShift AI 3.4 · Red Hat
  11. 2026-10-23 Fix available: RHSA-2026:88149 · Red Hat
  12. 2026-10-23 Fix available: RHSA-2026:88152 · Red Hat
  13. 2026-10-23 Fix available: RHSA-2026:88150 · Red Hat
  14. 2026-10-23 Fix available: RHSA-2026:88156 · Red Hat
  15. 2026-10-23 Fix available: RHSA-2026:88153 · Red Hat
  16. 2026-10-23 Fix available: RHSA-2026:88154 · Red Hat
  17. 2026-10-23 Fix available: RHSA-2026:88157 · Red Hat
  18. 2026-10-23 Fix available: RHSA-2026:88155 · Red Hat
  19. 2026-10-23 Fix available: RHSA-2026:88151 · Red Hat
  20. 2026-10-23 Fix available: RHSA-2026:88158 · Red Hat
  21. 2026-10-23 Fix available: RHSA-2026:88159 · Red Hat
  22. 2026-10-23 Fix available: OpenShift Developer Tools and Services 4.12, OpenShift Developer Tools and Services 4.13, OpenShift Developer Tools and Services 4.14 +8 · Red Hat
  23. 2026-10-25 EPSS moved to the 50th–90th percentile
  24. 2026-11-04 Fix available: RHSA-2026:95221 · Red Hat
  25. 2026-11-04 Fix available: Red Hat JBoss Enterprise Application Platform 8.1 · Red Hat

References

Patch 2

Advisory 1

Other 4

  • TI-2026-61574 zstd-jni 1.2.0 through 1.5.7-13 Out-of-Bounds Read via ZstdDictDecompress CVSS 4.0HIGH 8.8
  • TI-2026-60350 zstd-jni 1.5.5-6 through 1.5.7-13 Out-of-Bounds Read via Negative Offset CVSS 4.0HIGH 8.8
  • TI-2026-59940 zstd-jni 1.1.1 through 1.5.7-13 Out-of-Bounds Read via Direct ByteBuffer Frame-Size Methods CVSS 4.0HIGH 8.8
  • TI-2026-61747 luben zstd-jni Dictionary Sharing ZstdCompressCtx.java ZstdCompressCtx.loadDict use after free CVSS 4.0MEDIUM 6.9
  • TI-2026-59963 zstd-jni 1.3.8-4 through 1.5.7-13 Use-After-Free via Setters Called After close() CVSS 4.0HIGH 7.0
  • TI-2026-59942 zstd-jni 1.3.8-4 through 1.5.7-13 Use-After-Free of Compression and Decompression Dictionaries CVSS 4.0HIGH 7.0
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences