CVE-2026-87824

Name of the Vulnerable Software and Affected Versions zstd-jni versions prior to 1.5.7-14

Description The Zstd.trainFromBufferDirect() function fails to validate the samples buffer capacity. An attacker can provide crafted sample length arrays with oversized per-sample lengths, causing the native implementation to read past buffer boundaries. This out-of-bounds memory access can lead to Java Virtual Machine (JVM) termination, resulting in a denial of service.

Recommendations Update to version 1.5.7-14 or later. As a temporary workaround, restrict the use of the Zstd.trainFromBufferDirect() function until the update is applied.