Bug 2532604 (CVE-2026-90560)

Summary: CVE-2026-90560 com.github.luben/zstd-jni: zstd-jni: Denial of Service via out-of-bounds read in ZstdDictDecompress
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: amctagga, ant, anujha, aoconnor, asoldano, asyoung, ataylor, avibelli, bbaranow, bgeorges, bmaxwell, bniver, bstansbe, ccranfor, cescoffi, cmah, dandread, dkreling, dlofthou, ehugonne, ewittman, flucifre, fmariani, fmongiar, gmalinko, gmeno, groman, gsmet, gtanzill, istudens, ivassile, iweiss, janstey, jbuscemi, jhollowa, jmartisk, jnethert, jpechane, jwon, kaycoth, lthon, manderse, mbenjamin, mcarlett, mhackett, mosmerov, msvehla, nipatil, nwallace, olubyans, ozzy, pantinor, pberan, pdelbell, pesilva, pgallagh, pjindal, pmackay, prichard, probinso, rguimara, rhel-process-autobot, rkubis, rruss, rstancel, rstepani, rsvoboda, sbiarozk, sostapov, sthirugn, tcunning, thjenkin, tqvarnst, varjain, vdosoudi, vereddy, watson-tool-maintainers, yfang
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in zstd-jni. This vulnerability, an out-of-bounds read, occurs in the ZstdDictDecompress constructor due to insufficient validation of offset and length arguments against dictionary array bounds. A remote attacker could exploit this by providing specially crafted input, leading to memory being read beyond its allocated buffer. This could result in the termination of the Java Virtual Machine (JVM), causing a denial of service.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2533020, 2533022, 2533023, 2533021    
Bug Blocks:    

Description OSIDB Bzimport 2026-09-12 18:11:21 UTC 
zstd-jni versions 1.2.0 through 1.5.7-13 contain an out-of-bounds read vulnerability in the ZstdDictDecompress constructor because offset and length arguments are never validated against the dictionary array bounds. Attackers can supply arbitrary offset or length values to read memory past the end of the supplied array, potentially causing JVM termination.
Comment 2 Jon Orris 2026-09-22 14:01:56 UTC 
This issue has been addressed in the following products:

  Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP2

Via RHSA-2026:70257 https://access.redhat.com/errata/RHSA-2026:70257
Comment 3 Jon Orris 2026-09-24 19:58:17 UTC 
This issue has been addressed in the following products:

  Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16

Via RHSA-2026:71675 https://access.redhat.com/errata/RHSA-2026:71675