CVE-2026-119434

Name of the Vulnerable Software and Affected Versions silviucpp ezstd versions 1.0.5 through 1.2.4

Description Improper handling of highly compressed data (data amplification) allows an attacker to exhaust memory and terminate the Erlang VM. By supplying a zstd frame to the ezstd:decompress using ddict/2 function, an attacker can use a small frame that declares a very large content size to trigger an unbounded allocation. Specifically, the zstd nif decompress using ddict function in c src/ezstd nif.cc uses ZSTD getFrameContentSize to read the declared size and passes it to enif make new binary without the 1 GiB MAX BUFFER SIZE check applied in other paths. Because this allocation occurs within a Native Implemented Function (NIF), exceeding available memory causes the operating system to kill the entire BEAM process (the Erlang VM) rather than just the calling process.

Recommendations Update silviucpp ezstd to version 1.2.5. As a temporary workaround, replace calls to ezstd:decompress using ddict/2 with the streaming API by creating a context with ezstd:create decompression context/1, attaching the dictionary with ezstd:select ddict/2, and decompressing with ezstd:decompress streaming/2.