HighFix available
zstd-jni-java — security advisory
zstd-jni versions before 1.5.7-14 fail to validate closed state in setDict, setLongMax, setLevel and setRefMultipleDDicts methods of stream classes. Attackers can call these methods on closed streams to write through freed native pointers, corrupting unrelated objects or crashing the JVM.
- Products
- zstd-jni-java
- Affected versions
- 1.5.2-5+ds-3, 1.5.2-5+ds-4, 1.5.2-5+ds-5, 1.5.2-5+ds-6, 1.5.2-5+ds-7, 1.5.2-5+ds-8, 1.5.4-2+ds-1, 1.5.4-2+ds-2, 1.5.4-2+ds-3~exp1, 1.5.4-2+ds-3~exp2, 1.5.4-2+ds-3~exp3, 1.5.4-2+ds-3~exp4, 1.5.7-23+ds-1, 1.5.7-23+ds-2
- Fixed versions
- 1.5.7-23+ds-1
- CVEs
- CVE-2026-87877
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 05:16 UTC · Revision 1
Source evidence
zstd-jni versions before 1.5.7-14 fail to validate closed state in setDict, setLongMax, setLevel and setRefMultipleDDicts methods of stream classes. Attackers can call these methods on closed streams to write through freed native pointers, corrupting unrelated objects or crashing the JVM.
osv:DEBIAN-CVE-2026-87877
zstd-jni-java
Fixed versions: Not specified
zstd-jni-java
Fixed versions: Not specified
zstd-jni-java
Fixed versions: 1.5.7-23+ds-1
Complete source record
{
"id": "2167d25f01bf16c92ab87daead887ede868024bac232e04eeb3dadf2c0332393",
"url": "https://osv.dev/vulnerability/DEBIAN-CVE-2026-87877",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "DEBIAN-CVE-2026-87877",
"summary": "zstd-jni versions before 1.5.7-14 fail to validate closed state in setDict, setLongMax, setLevel and setRefMultipleDDicts methods of stream classes. Attackers can call these methods on closed streams to write through freed native pointers, corrupting unrelated objects or crashing the JVM.",
"evidence": "osv:DEBIAN-CVE-2026-87877",
"products": [
{
"name": {
"value": "zstd-jni-java",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.5.2-5+ds-3",
"evidence": "/affected/0/versions"
},
{
"value": "1.5.2-5+ds-4",
"evidence": "/affected/0/versions"
},
{
"value": "1.5.2-5+ds-5",
"evidence": "/affected/0/versions"
},
{
"value": "1.5.2-5+ds-6",
"evidence": "/affected/0/versions"
},
{
"value": "1.5.2-5+ds-7",
"evidence": "/affected/0/versions"
},
{
"value": "1.5.2-5+ds-8",
"evidence": "/affected/0/versions"
},
{
"value": "1.5.4-2+ds-1",
"evidence": "/affected/0/versions"
},
{
"value": "1.5.4-2+ds-2",
"evidence": "/affected/0/versions"
},
{
"value": "1.5.4-2+ds-3~exp1",
"evidence": "/affected/0/versions"
},
{
"value": "1.5.4-2+ds-3~exp2",
"evidence": "/affected/0/versions"
},
{
"value": "1.5.4-2+ds-3~exp3",
"evidence": "/affected/0/versions"
},
{
"value": "1.5.4-2+ds-3~exp4",
"evidence": "/affected/0/versions"
},
{
"value": "1.5.7-23+ds-1",
"evidence": "/affected/0/versions"
},
{
"value": "1.5.7-23+ds-2",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "zstd-jni-java",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.5.2-5+ds-7",
"evidence": "/affected/1/versions"
},
{
"value": "1.5.2-5+ds-8",
"evidence": "/affected/1/versions"
},
{
"value": "1.5.4-2+ds-1",
"evidence": "/affected/1/versions"
},
{
"value": "1.5.4-2+ds-2",
"evidence": "/affected/1/versions"
},
{
"value": "1.5.4-2+ds-3~exp1",
"evidence": "/affected/1/versions"
},
{
"value": "1.5.4-2+ds-3~exp2",
"evidence": "/affected/1/versions"
},
{
"value": "1.5.4-2+ds-3~exp3",
"evidence": "/affected/1/versions"
},
{
"value": "1.5.4-2+ds-3~exp4",
"evidence": "/affected/1/versions"
},
{
"value": "1.5.7-23+ds-1",
"evidence": "/affected/1/versions"
},
{
"value": "1.5.7-23+ds-2",
"evidence": "/affected/1/versions"
}
]
},
{
"name": {
"value": "zstd-jni-java",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.5.7-23+ds-1",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": [
{
"value": "1.5.2-5+ds-7",
"evidence": "/affected/2/versions"
},
{
"value": "1.5.2-5+ds-8",
"evidence": "/affected/2/versions"
},
{
"value": "1.5.4-2+ds-1",
"evidence": "/affected/2/versions"
},
{
"value": "1.5.4-2+ds-2",
"evidence": "/affected/2/versions"
},
{
"value": "1.5.4-2+ds-3~exp1",
"evidence": "/affected/2/versions"
},
{
"value": "1.5.4-2+ds-3~exp2",
"evidence": "/affected/2/versions"
},
{
"value": "1.5.4-2+ds-3~exp3",
"evidence": "/affected/2/versions"
},
{
"value": "1.5.4-2+ds-3~exp4",
"evidence": "/affected/2/versions"
}
]
}
],
"severity": "high",
"structured": {
"id": "DEBIAN-CVE-2026-87877",
"aliases": [
"DEBIAN-CVE-2026-87877"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "zstd-jni-java",
"purl": "pkg:deb/debian/zstd-jni-java?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"versions": [
"1.5.2-5+ds-3",
"1.5.2-5+ds-4",
"1.5.2-5+ds-5",
"1.5.2-5+ds-6",
"1.5.2-5+ds-7",
"1.5.2-5+ds-8",
"1.5.4-2+ds-1",
"1.5.4-2+ds-2",
"1.5.4-2+ds-3~exp1",
"1.5.4-2+ds-3~exp2",
"1.5.4-2+ds-3~exp3",
"1.5.4-2+ds-3~exp4",
"1.5.7-23+ds-1",
"1.5.7-23+ds-2"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-87877.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "zstd-jni-java",
"purl": "pkg:deb/debian/zstd-jni-java?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"versions": [
"1.5.2-5+ds-7",
"1.5.2-5+ds-8",
"1.5.4-2+ds-1",
"1.5.4-2+ds-2",
"1.5.4-2+ds-3~exp1",
"1.5.4-2+ds-3~exp2",
"1.5.4-2+ds-3~exp3",
"1.5.4-2+ds-3~exp4",
"1.5.7-23+ds-1",
"1.5.7-23+ds-2"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-87877.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.5.7-23+ds-1"
}
]
}
],
"package": {
"name": "zstd-jni-java",
"purl": "pkg:deb/debian/zstd-jni-java?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"versions": [
"1.5.2-5+ds-7",
"1.5.2-5+ds-8",
"1.5.4-2+ds-1",
"1.5.4-2+ds-2",
"1.5.4-2+ds-3~exp1",
"1.5.4-2+ds-3~exp2",
"1.5.4-2+ds-3~exp3",
"1.5.4-2+ds-3~exp4"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-87877.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
],
"modified": "2026-10-18T04:00:08.333256146Z",
"provider": "osv",
"upstream": [
"CVE-2026-87877"
],
"references": [
"https://security-tracker.debian.org/tracker/CVE-2026-87877"
]
},
"related_cves": [
{
"value": "CVE-2026-87877",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 366683,
"published_at": "2026-09-09T15:17:28.07+00:00"
}