CVE-2026-119434
Description
A flaw was found in ezstd. An attacker can cause a Denial of Service (DoS) by providing a specially crafted compressed data frame that declares an excessively large uncompressed size. When decompressing the data using a dictionary, ezstd fails to enforce memory buffer limits, leading to memory exhaustion that causes the operating system to terminate the Erlang virtual machine.
Statement
This vulnerability is rated as Moderate impact for Red Hat environments because the blast radius is confined to a denial of service against the host Erlang runtime, with no compromise of system confidentiality or data integrity. In typical Red Hat deployments, ezstd is not included in default platform installations or standard system services, restricting potential exposure to customized Erlang applications. Furthermore, triggering the crash requires the application to actively accept and decompress untrusted input using dictionary decompression routines.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Amplification; DoS: Crash, Exit, or Restart; DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory)
System resources, CPU and memory, can be quickly consumed. This can lead to poor system performance or system crash.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
