Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-09-15T02:15:10 com.github.luben/zstd-jni: luben zstd-jni: Remote use-after-free vulnerability in dictionary sharing 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L CWE-825

A vulnerability has been found in luben zstd-jni up to 1.5.7-13. This vulnerability affects the function ZstdCompressCtx.loadDict of the file ZstdCompressCtx.java of the component Dictionary Sharing. Such manipulation leads to use after free. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.5.7-14 is able to resolve this issue. The name of the patch is a560131d7834598afd9cea6b7c107bc88e915936. The affected component should be upgraded. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

A flaw was found in luben zstd-jni. This flaw involves a use-after-free vulnerability in the ZstdCompressCtx.loadDict function, which handles dictionary sharing. A remote attacker could exploit this by manipulating dictionary sharing operations, potentially leading to denial of service, information disclosure, or arbitrary code execution.

This is an Important remote use-after-free vulnerability in the `zstd-jni` library's dictionary sharing functionality. The flaw, affecting the `ZstdCompressCtx.loadDict` function, could allow an unauthenticated attacker to trigger a crash or potentially execute arbitrary code due to public exploit disclosure. Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Exploit Intelligence Affected exploit-intelligence/agent-client-rhel9 OpenShift Developer Tools and Services Affected jenkins-2-plugins OpenShift Developer Tools and Services Affected ocp-tools-4/jenkins-rhel8 OpenShift Developer Tools and Services Affected ocp-tools-4/jenkins-rhel9 Red Hat AMQ Clients Not affected zstd-jni Red Hat build of Apache Camel 4 for Quarkus 3 Affected zstd-jni Red Hat build of Apache Camel for Spring Boot 4 Affected zstd-jni Red Hat build of Apicurio Registry 3 Affected zstd-jni Red Hat build of Debezium 3 Affected zstd-jni Red Hat Ceph Storage 9 Fix deferred libarrow Red Hat Enterprise Linux 8 Not affected javapackages-tools:201801/apache-commons-compress Red Hat Enterprise Linux 9 Affected jmc Red Hat Fuse 7 Not affected zstd-jni Red Hat Hardened Images Not affected maven3.9 Red Hat JBoss Enterprise Application Platform 8 Affected zstd-jni Red Hat JBoss Enterprise Application Platform Expansion Pack Affected zstd-jni Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-spark-operator-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-th06-cpu-torch210-py312-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-th06-cpu-torch291-py312-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-th06-cuda130-torch210-py312-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-th06-cuda130-torch291-py312-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-th06-rocm64-torch291-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-th-torch-cpu-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-th-torch-cuda-py312-rhel9 https://www.cve.org/CVERecord?id=CVE-2026-90852 https://nvd.nist.gov/vuln/detail/CVE-2026-90852 https://github.com/luben/zstd-jni/ https://github.com/luben/zstd-jni/commit/a560131d7834598afd9cea6b7c107bc88e915936 https://github.com/luben/zstd-jni/issues/404 https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14 https://vuldb.com/cve/CVE-2026-90852 https://vuldb.com/submit/927022 https://vuldb.com/vuln/403407 https://vuldb.com/vuln/403407/cti