---
id: CVE-2026-87795
title: >-
  com.github.luben/zstd-jni: zstd-jni: Out-of-bounds read in ZstdDictCompress
  constructor leads to denial of service (CVE-2026-87795)
summary: >-
  A flaw was found in zstd-jni. This vulnerability occurs due to insufficient
  validation of offset and length parameters within the `ZstdDictCompress`
  constructor. An attacker can exploit this by providing untrusted values,
  leading to an out…
severity: high
cvss: 8.2
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H'
cvssSource: vendor
cwe: CWE-125
vendor: Red Hat
product: Red Hat Ceph Storage 9
affected:
  - exploit_intelligence
  - openshift_developer_tools_and_services
  - build_of_apache_camel_4_for_quarkus 3
  - build_of_apache_camel_for_spring_boot 4
  - build_of_apicurio_registry 3
  - build_of_debezium 3
  - ceph_storage 9
  - enterprise_linux 8
  - enterprise_linux 9
  - jboss_enterprise_application_platform_expansion_pack
  - openshift_ai_rhoai
published: '2026-09-09'
updated: '2026-09-21'
sourceUpdated: '2026-09-21T16:36:35+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-87795.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-87795.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-87795'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2530661'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-87795'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-87795'
  - url: 'https://github.com/luben/zstd-jni'
  - url: >-
      https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/ZstdDictCompress.java
  - url: >-
      https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/native/jni_fast_zstd.c
  - url: >-
      https://github.com/luben/zstd-jni/commit/0d64de4dee6606ff506be36c7f2e714ad0c80fdb
  - url: >-
      https://github.com/luben/zstd-jni/commit/1c4e5a6c3ce8458095225d987d669e6a0937734a
  - url: 'https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14'
  - url: 'https://github.com/luben/zstd-jni/security/advisories/GHSA-ff36-7w3w-g8rm'
  - url: >-
      https://www.vulncheck.com/advisories/zstd-jni-1.2.0-through-1.5.7-13-out-of-bounds-read-via-zstddictcompress
tags:
  - csaf
  - vex
  - red-hat
  - cve.org
  - exploit-available
epss: 0.00344
epssPercentile: 0.28009
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-14T13:02:05.211876Z'
ingestedAt: '2026-09-14T15:23:07.426Z'
---

## Overview

A flaw was found in zstd-jni. This vulnerability occurs due to insufficient validation of offset and length parameters within the `ZstdDictCompress` constructor. An attacker can exploit this by providing untrusted values, leading to an out-of-bounds memory read. This can result in the disclosure of sensitive native heap memory and cause the Java Virtual Machine (JVM) to crash, leading to a denial of service.

## Vendor advisories

- **Red Hat VEX** · Important · affected: Exploit Intelligence, OpenShift Developer Tools and Services, Red Hat build of Apache Camel 4 for Quarkus 3, Red Hat build of Apache Camel for Spring Boot 4, Red Hat build of Apicurio Registry 3, Red Hat build of Debezium 3, … · no fix planned: Red Hat Ceph Storage 9, Exploit Intelligence, OpenShift Developer Tools and Services, Red Hat build of Apache Camel 4 for Quarkus 3, … · updated 2026-09-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-87795.json)

**com.github.luben/zstd-jni: zstd-jni: Out-of-bounds read in ZstdDictCompress constructor leads to denial of service** — rated Important by Red Hat. Released 2026-09-09, updated 2026-09-21.

Affected:

- Exploit Intelligence
- OpenShift Developer Tools and Services
- Red Hat build of Apache Camel 4 for Quarkus 3
- Red Hat build of Apache Camel for Spring Boot 4
- Red Hat build of Apicurio Registry 3
- Red Hat build of Debezium 3
- Red Hat Ceph Storage 9
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat JBoss Enterprise Application Platform Expansion Pack
- Red Hat OpenShift AI (RHOAI)

No fix planned:

- Red Hat Ceph Storage 9
- Exploit Intelligence
- OpenShift Developer Tools and Services
- Red Hat build of Apache Camel 4 for Quarkus 3
- Red Hat build of Apache Camel for Spring Boot 4
- Red Hat build of Apicurio Registry 3
- Red Hat build of Debezium 3
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat JBoss Enterprise Application Platform Expansion Pack
- Red Hat OpenShift AI (RHOAI)

Not affected:

- Red Hat Fuse 7
- Red Hat Hardened Images
- Red Hat JBoss Enterprise Application Platform 8
- Red Hat OpenShift AI (RHOAI)

## Remediation

Fix deferred

Workarounds / mitigations:

- Update com.github.luben/zstd-jni to version 1.5.7-14 or later. Until updated, do not pass attacker-controlled offset or length values to ZstdDictCompress.