Bug 2530661 (CVE-2026-87795)

Summary:	CVE-2026-87795 com.github.luben/zstd-jni: zstd-jni: Out-of-bounds read in ZstdDictCompress constructor leads to denial of service
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	amctagga, ant, anujha, aoconnor, asoldano, asyoung, avibelli, bbaranow, bgeorges, bmaxwell, bniver, bstansbe, ccranfor, cescoffi, cmah, dandread, dkreling, dlofthou, ewittman, flucifre, fmariani, fmongiar, gmalinko, gmeno, groman, gsmet, gtanzill, istudens, ivassile, iweiss, janstey, jbuscemi, jhollowa, jmartisk, jnethert, jpechane, jwon, kaycoth, lthon, manderse, mbenjamin, mcarlett, mhackett, mosmerov, msvehla, nipatil, nwallace, olubyans, pantinor, pberan, pdelbell, pesilva, pgallagh, pjindal, pmackay, prichard, probinso, rguimara, rhel-process-autobot, rkubis, rruss, rstancel, rstepani, rsvoboda, sbiarozk, sostapov, sthirugn, tcunning, thjenkin, tqvarnst, vdosoudi, vereddy, watson-tool-maintainers, yfang
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in zstd-jni. This vulnerability occurs due to insufficient validation of offset and length parameters within the `ZstdDictCompress` constructor. An attacker can exploit this by providing untrusted values, leading to an out-of-bounds memory read. This can result in the disclosure of sensitive native heap memory and cause the Java Virtual Machine (JVM) to crash, leading to a denial of service.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2531384, 2531385, 2531386, 2531387
Bug Blocks:

Description OSIDB Bzimport 2026-09-09 10:24:09 UTC

zstd-jni versions before 1.5.7-14 fail to validate offset and length parameters in the ZstdDictCompress constructor, allowing out-of-bounds memory reads. Attackers can supply untrusted offset or length values to read native heap memory into the compression dictionary, typically causing JVM crashes.

Comment 3 Jon Orris 2026-09-22 14:02:15 UTC

This issue has been addressed in the following products:

  Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP2

Via RHSA-2026:70257 https://access.redhat.com/errata/RHSA-2026:70257

Comment 4 Jon Orris 2026-09-24 19:57:59 UTC

This issue has been addressed in the following products:

  Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16

Via RHSA-2026:71675 https://access.redhat.com/errata/RHSA-2026:71675