Home
Home
Trends
Trends
Vulnerabilities
Vulnerabilities
News
News
Researchers
Researchers
Why dbugs?
Why dbugs?
Settings

Silviu Caragea

#45050of 60,400
6.9Total CVSS
Vulnerabilities · 1
PT-2026-137731
2026-11-05
6.9
CVE-2026-119434
Silviucpp
Ezstd
Improper handling of highly compressed data (data amplification) allows an attacker to exhaust memory and terminate the Erlang VM. By supplying a zstd frame to the `ezstd:decompress using ddict/2` function, an attacker can use a small frame that declares a very large content size to trigger an unbounded allocation. Specifically, the `zstd nif decompress using ddict` function in `c src/ezstd nif.cc` uses `ZSTD getFrameContentSize` to read the declared size and passes it to `enif make new binary` without the 1 GiB `MAX BUFFER SIZE` check applied in other paths. Because this allocation occurs within a Native Implemented Function (NIF), exceeding available memory causes the operating system to kill the entire BEAM process (the Erlang VM) rather than just the calling process.