Bug 2533566 (CVE-2026-90852) - CVE-2026-90852 com.github.luben/zstd-jni: luben zstd-jni: Remote use-after-free vulnerability in dictionary sharing
Summary: CVE-2026-90852 com.github.luben/zstd-jni: luben zstd-jni: Remote use-after-fr...
Keywords:
Status: NEW
Alias: CVE-2026-90852
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2533568 2533569 2533570 2533571 2533572 2533573
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-09-15 02:41 UTC by OSIDB Bzimport
Modified: 2026-09-24 19:58 UTC (History)
76 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2026:70257 0 None None None 2026-09-22 14:01:59 UTC
Red Hat Product Errata RHSA-2026:71675 0 None None None 2026-09-24 19:58:22 UTC

Description OSIDB Bzimport 2026-09-15 02:41:26 UTC 
A vulnerability has been found in luben zstd-jni up to 1.5.7-13. This vulnerability affects the function ZstdCompressCtx.loadDict of the file ZstdCompressCtx.java of the component Dictionary Sharing. Such manipulation leads to use after free. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.5.7-14 is able to resolve this issue. The name of the patch is a560131d7834598afd9cea6b7c107bc88e915936. The affected component should be upgraded. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Comment 1 Jon Orris 2026-09-22 14:01:55 UTC 
This issue has been addressed in the following products:

  Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP2

Via RHSA-2026:70257 https://access.redhat.com/errata/RHSA-2026:70257
Comment 2 Jon Orris 2026-09-24 19:58:18 UTC 
This issue has been addressed in the following products:

  Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16

Via RHSA-2026:71675 https://access.redhat.com/errata/RHSA-2026:71675
Note You need to log in before you can comment on or make changes to this bug.