CVE-2026-87877

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-87877", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-09-09T14:02:07.708Z", "datePublished": "2026-09-09T14:32:45.512Z", "dateUpdated": "2026-09-09T15:57:53.652Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-09-09T14:32:45.512Z"}, "datePublic": "2026-08-19T00:00:00.000Z", "title": "zstd-jni 1.3.8-4 through 1.5.7-13 Use-After-Free via Setters Called After close()", "descriptions": [{"lang": "en", "value": "zstd-jni versions before 1.5.7-14 fail to validate closed state in setDict, setLongMax, setLevel and setRefMultipleDDicts methods of stream classes. Attackers can call these methods on closed streams to write through freed native pointers, corrupting unrelated objects or crashing the JVM."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Use After Free", "cweId": "CWE-416", "type": "CWE"}]}], "affected": [{"vendor": "luben", "product": "zstd-jni", "collectionURL": "https://repo1.maven.org/maven2/com/github/luben/zstd-jni/", "repo": "https://github.com/luben/zstd-jni", "defaultStatus": "unaffected", "packageURL": "pkg:maven/com.github.luben/zstd-jni", "versions": [{"version": "1.3.8-4", "lessThan": "1.5.7-14", "status": "affected", "versionType": "custom"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N", "attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 7, "baseSeverity": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseScore": 7.7, "baseSeverity": "HIGH"}}], "references": [{"url": "https://github.com/luben/zstd-jni/security/advisories/GHSA-2jw3-mg7f-vw4q", "tags": ["vendor-advisory"], "name": "GitHub Security Advisory (GHSA-2jw3-mg7f-vw4q)"}, {"url": "https://github.com/luben/zstd-jni/commit/f38f9a1563113d96d0fc38baee543f7457dd8a8e", "tags": ["patch"], "name": "Fix commit: closed-state guards on BaseZstdBufferDecompressingStreamNoFinalizer"}, {"url": "https://github.com/luben/zstd-jni/commit/393d7311766abbc285b149302c0fe1f94b16d555", "tags": ["patch"], "name": "Fix commit: closed-state guards on the input and output stream setters"}, {"url": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/BaseZstdBufferDecompressingStreamNoFinalizer.java", "tags": ["technical-description"], "name": "Setters without the closed-state guard that readInternal already has, at v1.5.7-13"}, {"url": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/ZstdInputStreamNoFinalizer.java", "tags": ["technical-description"], "name": "final stream handle retained after close at v1.5.7-13"}, {"url": "https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14", "tags": ["release-notes"], "name": "zstd-jni v1.5.7-14 Release Notes"}, {"url": "https://github.com/luben/zstd-jni/commit/0827ed02551bbd8d6f8e4bbff99d83bf50f91938", "tags": ["technical-description", "patch"], "name": "Commit that made setDict write through the retained native stream handle (first released in 1.3.8-4)"}, {"url": "https://github.com/luben/zstd-jni", "tags": ["product"]}, {"name": "VulnCheck Advisory: zstd-jni 1.3.8-4 through 1.5.7-13 Use-After-Free via Setters Called After close()", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/zstd-jni-1.3.8-4-through-1.5.7-13-use-after-free-via-setters-called-after-close"}], "credits": [{"lang": "en", "value": "Yu Bao, PayPal Cyber Security Team", "type": "finder"}], "x_generator": {"engine": "vulncheck-endgame"}, "source": {"discovery": "EXTERNAL"}}, "adp": [{"references": [{"url": "https://github.com/luben/zstd-jni/security/advisories/GHSA-2jw3-mg7f-vw4q", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-09T15:57:38.917828Z", "id": "CVE-2026-87877", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-09T15:57:53.652Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-87877", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-09-09T15:57:38.917828Z"}}}], "references": [{"url": "https://github.com/luben/zstd-jni/security/advisories/GHSA-2jw3-mg7f-vw4q", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-09T15:57:47.831Z"}}], "cna": {"title": "zstd-jni 1.3.8-4 through 1.5.7-13 Use-After-Free via Setters Called After close()", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Yu Bao, PayPal Cyber Security Team"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 7, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.7, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"repo": "https://github.com/luben/zstd-jni", "vendor": "luben", "product": "zstd-jni", "versions": [{"status": "affected", "version": "1.3.8-4", "lessThan": "1.5.7-14", "versionType": "custom"}], "packageURL": "pkg:maven/com.github.luben/zstd-jni", "collectionURL": "https://repo1.maven.org/maven2/com/github/luben/zstd-jni/", "defaultStatus": "unaffected"}], "datePublic": "2026-08-19T00:00:00.000Z", "references": [{"url": "https://github.com/luben/zstd-jni/security/advisories/GHSA-2jw3-mg7f-vw4q", "name": "GitHub Security Advisory (GHSA-2jw3-mg7f-vw4q)", "tags": ["vendor-advisory"]}, {"url": "https://github.com/luben/zstd-jni/commit/f38f9a1563113d96d0fc38baee543f7457dd8a8e", "name": "Fix commit: closed-state guards on BaseZstdBufferDecompressingStreamNoFinalizer", "tags": ["patch"]}, {"url": "https://github.com/luben/zstd-jni/commit/393d7311766abbc285b149302c0fe1f94b16d555", "name": "Fix commit: closed-state guards on the input and output stream setters", "tags": ["patch"]}, {"url": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/BaseZstdBufferDecompressingStreamNoFinalizer.java", "name": "Setters without the closed-state guard that readInternal already has, at v1.5.7-13", "tags": ["technical-description"]}, {"url": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/ZstdInputStreamNoFinalizer.java", "name": "final stream handle retained after close at v1.5.7-13", "tags": ["technical-description"]}, {"url": "https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14", "name": "zstd-jni v1.5.7-14 Release Notes", "tags": ["release-notes"]}, {"url": "https://github.com/luben/zstd-jni/commit/0827ed02551bbd8d6f8e4bbff99d83bf50f91938", "name": "Commit that made setDict write through the retained native stream handle (first released in 1.3.8-4)", "tags": ["technical-description", "patch"]}, {"url": "https://github.com/luben/zstd-jni", "tags": ["product"]}, {"url": "https://www.vulncheck.com/advisories/zstd-jni-1.3.8-4-through-1.5.7-13-use-after-free-via-setters-called-after-close", "name": "VulnCheck Advisory: zstd-jni 1.3.8-4 through 1.5.7-13 Use-After-Free via Setters Called After close()", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "zstd-jni versions before 1.5.7-14 fail to validate closed state in setDict, setLongMax, setLevel and setRefMultipleDDicts methods of stream classes. Attackers can call these methods on closed streams to write through freed native pointers, corrupting unrelated objects or crashing the JVM."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-416", "description": "Use After Free"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-09-09T14:32:45.512Z"}}}, "cveMetadata": {"cveId": "CVE-2026-87877", "state": "PUBLISHED", "dateUpdated": "2026-09-09T15:57:53.652Z", "dateReserved": "2026-09-09T14:02:07.708Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-09-09T14:32:45.512Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://repo1.maven.org/maven2/com/github/luben/zstd-jni/", "defaultStatus": "unaffected", "packageURL": "pkg:maven/com.github.luben/zstd-jni", "product": "zstd-jni", "repo": "https://github.com/luben/zstd-jni", "vendor": "luben", "versions": [{"lessThan": "1.5.7-14", "status": "affected", "version": "1.3.8-4", "versionType": "custom"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "zstd-jni versions before 1.5.7-14 fail to validate closed state in setDict, setLongMax, setLevel and setRefMultipleDDicts methods of stream classes. Attackers can call these methods on closed streams to write through freed native pointers, corrupting unrelated objects or crashing the JVM."}], "id": "CVE-2026-87877", "lastModified": "2026-09-09T20:16:54.383", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.5, "impactScore": 5.2, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.0, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-87877", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-09-09T15:57:38.917828Z", "version": "2.0.3"}}]}, "published": "2026-09-09T15:17:28.070", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/luben/zstd-jni"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/BaseZstdBufferDecompressingStreamNoFinalizer.java"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/ZstdInputStreamNoFinalizer.java"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/luben/zstd-jni/commit/0827ed02551bbd8d6f8e4bbff99d83bf50f91938"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/luben/zstd-jni/commit/393d7311766abbc285b149302c0fe1f94b16d555"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/luben/zstd-jni/commit/f38f9a1563113d96d0fc38baee543f7457dd8a8e"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/luben/zstd-jni/security/advisories/GHSA-2jw3-mg7f-vw4q"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/zstd-jni-1.3.8-4-through-1.5.7-13-use-after-free-via-setters-called-after-close"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/luben/zstd-jni/security/advisories/GHSA-2jw3-mg7f-vw4q"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{"bugzilla": {"description": "com.github.luben/zstd-jni: zstd-jni: Use-After-Free vulnerability allows memory corruption and denial of service", "id": "2531003", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2531003"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.7", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "status": "draft"}, "cwe": "CWE-416", "details": ["A flaw was found in zstd-jni. An attacker could exploit a use-after-free vulnerability by calling specific methods on closed streams without proper validation. This could lead to memory corruption, potentially allowing the attacker to corrupt unrelated objects or cause the Java Virtual Machine (JVM) to crash, resulting in a denial of service."], "mitigation": {"lang": "en:us", "value": "No complete workaround is currently available. As a temporary measure, applications using zstd-jni should not call setDict(), setLongMax(), setLevel(), or setRefMultipleDDicts() on a stream after close(). Upgrade to a Red Hat product release containing zstd-jni 1.5.7-14 or later when available."}, "name": "CVE-2026-87877", "package_state": [{"cpe": "cpe:/a:redhat:exploit_intelligence:0", "fix_state": "Affected", "package_name": "exploit-intelligence/agent-client-rhel9", "product_name": "Exploit Intelligence"}, {"cpe": "cpe:/a:redhat:ocp_tools", "fix_state": "Affected", "package_name": "jenkins-2-plugins", "product_name": "OpenShift Developer Tools and Services"}, {"cpe": "cpe:/a:redhat:ocp_tools", "fix_state": "Affected", "package_name": "ocp-tools-4/jenkins-rhel8", "product_name": "OpenShift Developer Tools and Services"}, {"cpe": "cpe:/a:redhat:ocp_tools", "fix_state": "Affected", "package_name": "ocp-tools-4/jenkins-rhel9", "product_name": "OpenShift Developer Tools and Services"}, {"cpe": "cpe:/a:redhat:camel_quarkus:3", "fix_state": "Affected", "package_name": "zstd-jni", "product_name": "Red Hat build of Apache Camel 4 for Quarkus 3"}, {"cpe": "cpe:/a:redhat:camel_spring_boot:4", "fix_state": "Affected", "package_name": "zstd-jni", "product_name": "Red Hat build of Apache Camel for Spring Boot 4"}, {"cpe": "cpe:/a:redhat:apicurio_registry:3", "fix_state": "Affected", "package_name": "zstd-jni", "product_name": "Red Hat build of Apicurio Registry 3"}, {"cpe": "cpe:/a:redhat:debezium:3", "fix_state": "Affected", "package_name": "zstd-jni", "product_name": "Red Hat build of Debezium 3"}, {"cpe": "cpe:/a:redhat:quarkus:3", "fix_state": "Affected", "package_name": "zstd-jni", "product_name": "Red Hat build of Quarkus"}, {"cpe": "cpe:/a:redhat:ceph_storage:9", "fix_state": "Fix deferred", "package_name": "libarrow", "product_name": "Red Hat Ceph Storage 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "javapackages-tools:201801/apache-commons-compress", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "jmc", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:jboss_fuse:7", "fix_state": "Affected", "package_name": "zstd-jni", "product_name": "Red Hat Fuse 7"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "maven3.9", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:8", "fix_state": "Affected", "package_name": "zstd-jni", "product_name": "Red Hat JBoss Enterprise Application Platform 8"}, {"cpe": "cpe:/a:redhat:jbosseapxp", "fix_state": "Affected", "package_name": "zstd-jni", "product_name": "Red Hat JBoss Enterprise Application Platform Expansion Pack"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-spark-operator-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-th06-cpu-torch210-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-th06-cpu-torch291-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-th06-cuda130-torch210-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-th06-cuda130-torch291-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-th06-rocm64-torch291-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-th-torch-cpu-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-th-torch-cuda-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}], "public_date": "2026-09-09T14:32:45Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-87877\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-87877\nhttps://github.com/luben/zstd-jni\nhttps://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/BaseZstdBufferDecompressingStreamNoFinalizer.java\nhttps://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/ZstdInputStreamNoFinalizer.java\nhttps://github.com/luben/zstd-jni/commit/0827ed02551bbd8d6f8e4bbff99d83bf50f91938\nhttps://github.com/luben/zstd-jni/commit/393d7311766abbc285b149302c0fe1f94b16d555\nhttps://github.com/luben/zstd-jni/commit/f38f9a1563113d96d0fc38baee543f7457dd8a8e\nhttps://github.com/luben/zstd-jni/releases/tag/v1.5.7-14\nhttps://github.com/luben/zstd-jni/security/advisories/GHSA-2jw3-mg7f-vw4q\nhttps://www.vulncheck.com/advisories/zstd-jni-1.3.8-4-through-1.5.7-13-use-after-free-via-setters-called-after-close"], "statement": "Red Hat has determined that CVE-2026-87877 affects Red Hat products that include the zstd-jni library in a vulnerable version. The vulnerability can allow memory corruption or denial of service when specific stream methods are called after the stream has been closed.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.3.8-4,1.5.7-14)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "zstd-jni", "source": "cna", "vendor": "luben"}, "product": "zstd-jni", "vendor": "luben"}], "created": "2026-09-09T16:15:01.535481+00:00", "updated": "2026-09-10T20:10:17.543585+00:00", "vendors": ["luben", "luben$PRODUCT$zstd-jni"]}