{"id":"CVE-2026-87795","summary":"zstd-jni 1.2.0 through 1.5.7-13 Out-of-Bounds Read via ZstdDictCompress","details":"zstd-jni versions before 1.5.7-14 fail to validate offset and length parameters in the ZstdDictCompress constructor, allowing out-of-bounds memory reads. Attackers can supply untrusted offset or length values to read native heap memory into the compression dictionary, typically causing JVM crashes.","aliases":["GHSA-ff36-7w3w-g8rm"],"modified":"2026-10-28T11:19:07.031742653Z","published":"2026-09-09T10:07:28.656Z","database_specific":{"cwe_ids":["CWE-125"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/87xxx/CVE-2026-87795.json","cna_assigner":"VulnCheck"},"references":[{"type":"WEB","url":"https://repo1.maven.org/maven2/com/github/luben/zstd-jni/"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/87xxx/CVE-2026-87795.json"},{"type":"ADVISORY","url":"https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14"},{"type":"ADVISORY","url":"https://github.com/luben/zstd-jni/security/advisories/GHSA-ff36-7w3w-g8rm"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87795"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/zstd-jni-1.2.0-through-1.5.7-13-out-of-bounds-read-via-zstddictcompress"},{"type":"FIX","url":"https://github.com/luben/zstd-jni/commit/0d64de4dee6606ff506be36c7f2e714ad0c80fdb"},{"type":"FIX","url":"https://github.com/luben/zstd-jni/commit/1c4e5a6c3ce8458095225d987d669e6a0937734a"},{"type":"PACKAGE","url":"https://github.com/luben/zstd-jni"},{"type":"ARTICLE","url":"https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/ZstdDictCompress.java"},{"type":"ARTICLE","url":"https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/native/jni_fast_zstd.c"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/luben/zstd-jni","events":[{"introduced":"1c4e5a6c3ce8458095225d987d669e6a0937734a"},{"fixed":"3216860eea289fbbae0b191c0a4fd8b72dad949c"},{"fixed":"0d64de4dee6606ff506be36c7f2e714ad0c80fdb"},{"fixed":"1c4e5a6c3ce8458095225d987d669e6a0937734a"}],"database_specific":{"extracted_events":[{"range":[{"introduced":"1.2.0"},{"fixed":"1.5.7-14"}],"source":"AFFECTED_FIELD","strategy":"StandardRange"},{"source":"REFERENCES_COMMIT","range":[{"fixed":"0d64de4dee6606ff506be36c7f2e714ad0c80fdb"}]},{"range":[{"fixed":"1c4e5a6c3ce8458095225d987d669e6a0937734a"}],"source":"REFERENCES_COMMIT"},{"range":[{"fixed":"3216860eea289fbbae0b191c0a4fd8b72dad949c"}],"source":"REFERENCES_TAG","original_tag":"v1.5.7-14"}]}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-87795.json","vanir_signatures":[{"target":{"file":"src/main/native/jni_outputstream_zstd.c","function":"Java_com_github_luben_zstd_ZstdOutputStream_compressStream"},"deprecated":false,"digest":{"function_hash":"296315882562009165331251339308188686350","length":950},"id":"CVE-2026-87795-09b5be6f","signature_type":"Function","signature_version":"v1","source":"https://github.com/luben/zstd-jni/commit/1c4e5a6c3ce8458095225d987d669e6a0937734a"},{"deprecated":false,"digest":{"function_hash":"71497639941025998658137149744842583845","length":519},"id":"CVE-2026-87795-15b33acd","signature_type":"Function","signature_version":"v1","source":"https://github.com/luben/zstd-jni/commit/1c4e5a6c3ce8458095225d987d669e6a0937734a","target":{"function":"Java_com_github_luben_zstd_ZstdDictDecompress_init","file":"src/main/native/jni_fast_zstd.c"}},{"source":"https://github.com/luben/zstd-jni/commit/1c4e5a6c3ce8458095225d987d669e6a0937734a","target":{"file":"src/main/native/jni_zstd.c","function":"Java_com_github_luben_zstd_Zstd_compress"},"deprecated":false,"digest":{"length":753,"function_hash":"191119023894538054696776443774005661461"},"id":"CVE-2026-87795-196303e8","signature_type":"Function","signature_version":"v1"},{"source":"https://github.com/luben/zstd-jni/commit/1c4e5a6c3ce8458095225d987d669e6a0937734a","target":{"file":"src/main/native/jni_inputstream_zstd.c"},"deprecated":false,"digest":{"line_hashes":["186002527345049128151235259683797400754","319922103440569431767703440610165512946","222633343654351234960097707977500373820","290728846606620613009383116587856420582"],"threshold":0.9},"id":"CVE-2026-87795-1fc1c924","signature_type":"Line","signature_version":"v1"},{"target":{"file":"src/main/native/jni_zstd.c","function":"Java_com_github_luben_zstd_Zstd_compressDirectByteBufferUsingDict"},"deprecated":false,"digest":{"function_hash":"115474370568863010193452150694506108978","length":1086},"id":"CVE-2026-87795-21a74a95","signature_type":"Function","signature_version":"v1","source":"https://github.com/luben/zstd-jni/commit/1c4e5a6c3ce8458095225d987d669e6a0937734a"},{"target":{"file":"src/main/native/jni_fast_zstd.c","function":"Java_com_github_luben_zstd_Zstd_decompressDirectByteBufferFastDict"},"deprecated":false,"digest":{"function_hash":"41687338444759206792472060370730912692","length":959},"id":"CVE-2026-87795-22745de2","signature_type":"Function","signature_version":"v1","source":"https://github.com/luben/zstd-jni/commit/1c4e5a6c3ce8458095225d987d669e6a0937734a"},{"target":{"file":"src/main/java/com/github/luben/zstd/AutoCloseBase.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["201810319311124399417167457672172620398","213155021943450682333257950915568057852","249501662347910373591583543620377532170","12015060395273793941819758175352646613","5824882579712405223075259412242113625","115140588722495800669216504450934842068","284774046003259245044807345099075044165","225327541096028837129032752269354596086","73504959713592999854188999286563421747","109549835627156227154966826578649081726","43918235204133421459147386494031181300","293949540968280903538352693917672011553","108587633537507210242609878158511307392","108587633537507210242609878158511307392","108587633537507210242609878158511307392"]},"id":"CVE-2026-87795-2c08903d","signature_type":"Line","signature_version":"v1","source":"https://github.com/luben/zstd-jni/commit/0d64de4dee6606ff506be36c7f2e714ad0c80fdb"},{"digest":{"function_hash":"226423536518056106590664531795542574583","length":183},"id":"CVE-2026-87795-30bc9ed5","signature_type":"Function","signature_version":"v1","source":"https://github.com/luben/zstd-jni/commit/1c4e5a6c3ce8458095225d987d669e6a0937734a","target":{"file":"src/main/native/jni_fast_zstd.c","function":"getNativePtr"},"deprecated":false},{"digest":{"length":1425,"function_hash":"153566990477443048128913891168655575752"},"id":"CVE-2026-87795-3643a3c1","signature_type":"Function","signature_version":"v1","source":"https://github.com/luben/zstd-jni/commit/1c4e5a6c3ce8458095225d987d669e6a0937734a","target":{"file":"src/main/native/jni_fast_zstd.c","function":"Java_com_github_luben_zstd_Zstd_compressFastDict"},"deprecated":false},{"source":"https://github.com/luben/zstd-jni/commit/0d64de4dee6606ff506be36c7f2e714ad0c80fdb","target":{"file":"src/main/java/com/github/luben/zstd/AutoCloseBase.java","function":"close"},"deprecated":false,"digest":{"function_hash":"114112441423332760535720991188023965463","length":249},"id":"CVE-2026-87795-3e6f8d73","signature_type":"Function","signature_version":"v1"},{"target":{"file":"src/main/native/jni_fast_zstd.c","function":"Java_com_github_luben_zstd_Zstd_decompressFastDict"},"deprecated":false,"digest":{"function_hash":"153566990477443048128913891168655575752","length":1425},"id":"CVE-2026-87795-3fdd8c80","signature_type":"Function","signature_version":"v1","source":"https://github.com/luben/zstd-jni/commit/1c4e5a6c3ce8458095225d987d669e6a0937734a"},{"target":{"function":"Java_com_github_luben_zstd_ZstdDictDecompress_free","file":"src/main/native/jni_fast_zstd.c"},"deprecated":false,"digest":{"function_hash":"175423890559638190565646337567703933767","length":140},"id":"CVE-2026-87795-41883fb0","signature_type":"Function","signature_version":"v1","source":"https://github.com/luben/zstd-jni/commit/1c4e5a6c3ce8458095225d987d669e6a0937734a"},{"id":"CVE-2026-87795-44dbbae1","signature_type":"Function","signature_version":"v1","source":"https://github.com/luben/zstd-jni/commit/3216860eea289fbbae0b191c0a4fd8b72dad949c","target":{"file":"src/main/native/jni_zstd.c","function":"Java_com_github_luben_zstd_Zstd_getDirectByteBufferFrameContentSize"},"deprecated":false,"digest":{"function_hash":"319696483832917712384682231278816072707","length":525}},{"deprecated":false,"digest":{"function_hash":"247644100059670334548379215931535463138","length":380},"id":"CVE-2026-87795-4757ae1c","signature_type":"Function","signature_version":"v1","source":"https://github.com/luben/zstd-jni/commit/1c4e5a6c3ce8458095225d987d669e6a0937734a","target":{"file":"src/main/java/com/github/luben/zstd/ZstdDictDecompress.java","function":"ZstdDictDecompress"}},{"deprecated":false,"digest":{"line_hashes":["305530341027247939358400165124499723689","244996029970187939260398610334567386343","83074194632860063153977426928287926038","1824068004868923671590702292323561082"],"threshold":0.9},"id":"CVE-2026-87795-4858ef69","signature_type":"Line","signature_version":"v1","source":"https://github.com/luben/zstd-jni/commit/0d64de4dee6606ff506be36c7f2e714ad0c80fdb","target":{"file":"src/main/java/com/github/luben/zstd/ZstdOutputStreamNoFinalizer.java"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/luben/zstd-jni/commit/1c4e5a6c3ce8458095225d987d669e6a0937734a","target":{"file":"src/main/java/com/github/luben/zstd/ZstdDictDecompress.java"},"deprecated":false,"digest":{"line_hashes":["145182736731800199294731629379638576401","291199900614424117501687203227948526592","234358335394572632422390615714576821656","289803637352121333259783497204254429370","259614403475019828389477577151434630317","318514952241952197391524385356615711798","263525429665522269555606705821481199670","20633577328658672793529113780313234668","100970983125725289565116434623667382823","254881659229508131082102148066833751787","5477471141322320865474338174724741092","27251147454671349464288620430022784104","257390482910052339473565723909528783212","68302914386215423308653007862247144422","229818690731547839478650062349880959263","97145874951526987300865484898173688754","80206419506447357949696485762430598209","78534491327879445452623266821950975146","150347044840610552402392042684475650950","307474618291127958505658554126852976207","265409269743780217452624748011156767875","303039214346202667766871263417928258214"],"threshold":0.9},"id":"CVE-2026-87795-5078ba53"},{"digest":{"line_hashes":["124707531680094268477657611897381176013","278209625644031623995998778694131632459","200162390163270026480228052814464056998"],"threshold":0.9},"id":"CVE-2026-87795-6f6de634","signature_type":"Line","signature_version":"v1","source":"https://github.com/luben/zstd-jni/commit/0d64de4dee6606ff506be36c7f2e714ad0c80fdb","target":{"file":"src/main/java/com/github/luben/zstd/ZstdDictCompress.java"},"deprecated":false},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/luben/zstd-jni/commit/1c4e5a6c3ce8458095225d987d669e6a0937734a","target":{"file":"src/main/java/com/github/luben/zstd/ZstdDictCompress.java","function":"ZstdDictCompress"},"deprecated":false,"digest":{"function_hash":"12189887396039776943823874100993380642","length":402},"id":"CVE-2026-87795-7424d313"},{"source":"https://github.com/luben/zstd-jni/commit/1c4e5a6c3ce8458095225d987d669e6a0937734a","target":{"file":"src/main/native/jni_outputstream_zstd.c"},"deprecated":false,"digest":{"line_hashes":["26227542207409589379836598995984946495","252158062018136559643587862381422343410","263676814350176365917181222524031649307","226318483840877330074328928596730994056"],"threshold":0.9},"id":"CVE-2026-87795-8205ee9a","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"338088567365487742912273932499298370088","length":541},"id":"CVE-2026-87795-8294815d","signature_type":"Function","signature_version":"v1","source":"https://github.com/luben/zstd-jni/commit/1c4e5a6c3ce8458095225d987d669e6a0937734a","target":{"function":"Java_com_github_luben_zstd_ZstdDictCompress_init","file":"src/main/native/jni_fast_zstd.c"}},{"digest":{"length":432,"function_hash":"174947492421595321449366708522111304634"},"id":"CVE-2026-87795-88643bac","signature_type":"Function","signature_version":"v1","source":"https://github.com/luben/zstd-jni/commit/1c4e5a6c3ce8458095225d987d669e6a0937734a","target":{"file":"src/main/native/jni_zstd.c","function":"Java_com_github_luben_zstd_Zstd_decompressedSize"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"41687338444759206792472060370730912692","length":959},"id":"CVE-2026-87795-8a86f9ec","signature_type":"Function","signature_version":"v1","source":"https://github.com/luben/zstd-jni/commit/1c4e5a6c3ce8458095225d987d669e6a0937734a","target":{"file":"src/main/native/jni_fast_zstd.c","function":"Java_com_github_luben_zstd_Zstd_compressDirectByteBufferFastDict"}},{"source":"https://github.com/luben/zstd-jni/commit/0d64de4dee6606ff506be36c7f2e714ad0c80fdb","target":{"function":"ZstdDictCompress","file":"src/main/java/com/github/luben/zstd/ZstdDictCompress.java"},"deprecated":false,"digest":{"function_hash":"72354477436676593227711636285898239328","length":325},"id":"CVE-2026-87795-9be92052","signature_type":"Function","signature_version":"v1"},{"id":"CVE-2026-87795-9e57408d","signature_type":"Function","signature_version":"v1","source":"https://github.com/luben/zstd-jni/commit/1c4e5a6c3ce8458095225d987d669e6a0937734a","target":{"file":"src/main/native/jni_fast_zstd.c","function":"Java_com_github_luben_zstd_ZstdDictCompress_free"},"deprecated":false,"digest":{"function_hash":"175423890559638190565646337567703933767","length":140}},{"signature_version":"v1","source":"https://github.com/luben/zstd-jni/commit/1c4e5a6c3ce8458095225d987d669e6a0937734a","target":{"file":"src/main/native/jni_zstd.c"},"deprecated":false,"digest":{"line_hashes":["116976461811903607430998365075382717575","313681511128899131689268624912566136771","217705382167214327767839618195528369627","297403219582402751735192620273727452975","335457145955288430589273335999281454862","240029857680528361945114478257299686477","71669525051567280874018940726246594163","6675206633547017461180722110572118099","210944043807628198682928448828183095993","42632032711796768444505686851817609940","251703100684406962862071854734148291199","121935346225923941217103679168894917173","229586961563281143909831938597622397516","326248441147695637996047234243092692629","312537571265098521794464133776028772008","102927490079795926456378933586615359741","257689247555060447539124305114464787355","206469275387670000555239321529664238867","183160364137402496102668854186930180130","297403219582402751735192620273727452975","163798239630505027702400427505543661545","297223984245613703809190355810884170254","84366656479003340991204065155689716094","232349163258828099183660733778737207028"],"threshold":0.9},"id":"CVE-2026-87795-a91041f3","signature_type":"Line"},{"deprecated":false,"digest":{"function_hash":"105800829512131482195498177974519433971","length":274},"id":"CVE-2026-87795-a9d0e42d","signature_type":"Function","signature_version":"v1","source":"https://github.com/luben/zstd-jni/commit/0d64de4dee6606ff506be36c7f2e714ad0c80fdb","target":{"file":"src/main/java/com/github/luben/zstd/ZstdOutputStreamNoFinalizer.java","function":"setChecksum"}},{"id":"CVE-2026-87795-aa914665","signature_type":"Line","signature_version":"v1","source":"https://github.com/luben/zstd-jni/commit/1c4e5a6c3ce8458095225d987d669e6a0937734a","target":{"file":"src/main/java/com/github/luben/zstd/Zstd.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["201366182353558056488000566067237426236","36480035204599032194628721311791351285","312124001718745083120356916784249005670","99780221719462447815135034385444444","286221289557449426545661351705227344018","97983870704024239867576951250055790229","156568392851454964217365400022756082683","306937201931238327928737545791490009257","327112235407821120842374745191463630192","170033596394913693538876526439397728456","142097379228959265748778334819297429112","295276839208924402686405598871306822959","251249266968162245861784521001172989287","241070654269796589982758359038590215033","286821066799945043629225067116006170296","339965227871784775543004185356136240147","118570308561843373108228082171923417811","175106352793345839270879455681187598023","293513629768404396491113242064581773829","104359942801057276613656597895499749192","5225041859162657494383019263637254818","197847488171023949417013572818465251033","280610110869059108601028214040766133962","120356133223251718781423536145249078689","31008190977042906759256787876301999081","232589857809859529036908045151249863138","216311185552231884246704897207004612636","312999941833393898966213728538818332041","118570308561843373108228082171923417811","140433924903305890320256119449924135225","169679633026739648259231336430744705413","227677242619339658995513795614457109721","302644364130521659126252981569380710637","51689863444396762078324742504309416656","86945223657587747019080904892984619698","185973721457740694360444281778079738924","73083109616305477046090567588259127071","236078199405801472069241784333293704227","191778437131401568095737106535928754264","60165936076616335516167802972541972198","89466367792777145716964570696585129052","164896737857607924773432001764733323393","17567797441260609990869153726843193951"]}},{"id":"CVE-2026-87795-accc62f3","signature_type":"Line","signature_version":"v1","source":"https://github.com/luben/zstd-jni/commit/1c4e5a6c3ce8458095225d987d669e6a0937734a","target":{"file":"src/main/native/jni_fast_zstd.c"},"deprecated":false,"digest":{"line_hashes":["210202392254235694338471206893952331525","30183355241534264033332605365618763220","166224356264947270007956409304941106314","82388877102774293759933070731646996392","279941042823352966066464110815693417709","25512023304922359181790158375730790045","108780149792627234596704417971786583082","275538413068739931108736099752177016645","259247925786425571904835539179581133866","12423727087580445944454320534677056416","72251643784482325722958444290911098377","128795797007769318930661942496016859597","335673394951671737147141671511034420911","328095183226514668855598417210463283585","97278332827455926971052092341095347366","285681889620460311352869491369294902441","25281577965445799825414257842102522333","327935758029927329709293755154763440864","316355507121291998396041938016285675227","253062426147908464922991305064747770562","137980628614361789052983400214107551109","250576828246850910985108878873933079441","181062278454418017729499368052219230437","101138394921750318663297775501126068377","85791983112003700923938092795936822855","175860268584181795901576425793879260936","270198690929591556356322774281537448788","23653913460319501777277628891663995870","331417881854293232069444348988956198129","132759218497826090720983096788490768831","209491382342886433468754675551848871188","289311491747289170845138973384006376658","81259676657736321308710242052062617569","175671354245494677328236457967105369772","270432078687221736509781824043461998553","106953654265758375374196057895225911968","327935758029927329709293755154763440864","316355507121291998396041938016285675227","74155201234433357136225602457160469374","238242328650031290588119955332431150085","136409029573517842864405442304546717598","310040720357587588894518937213924193440","106641408035503561223533994291477564820","182137233916011192538589930421909775956","327367609523371966717230441207030917849","241403176429493907642108197187716378704","33045810491925822009602414139390482137","311654960323527032262320250023315582662","150608257998328228564864601288682338462","186045044776452108343409140362353138946","204610779114688577752448458745113905050","336238982324609254995559182574873649586","217837731514403065348927758321665885287","37963000637022445311825316389044835819","53255632671275642095645218720190260909","240054776773932950708877202710108592349","236335069587533333528213592042599578716","198510311443580414390129450884838513448","322496335121352775300212727818141604520","176640286988749595510406550201944450275","173530271353649768757707821000412527983","44610298216722952592950130753833741710","322496335121352775300212727818141604520","176640286988749595510406550201944450275","19867572152750456764413218889692673245","97539010716698687422656752051019635545","53663966980560855842723054943480518764","154955995525398012161324042472237711948","246180669438811387297022392582973688046","85602760070498587357018694381545366572","25236968364497400075032184238331242613","37963000637022445311825316389044835819","53255632671275642095645218720190260909","240054776773932950708877202710108592349"],"threshold":0.9}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/luben/zstd-jni/commit/1c4e5a6c3ce8458095225d987d669e6a0937734a","target":{"file":"src/main/java/com/github/luben/zstd/Zstd.java","function":"compress"},"deprecated":false,"digest":{"function_hash":"89660608847644973908890135270644039795","length":66},"id":"CVE-2026-87795-b4437cd6"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/luben/zstd-jni/commit/1c4e5a6c3ce8458095225d987d669e6a0937734a","target":{"function":"Java_com_github_luben_zstd_ZstdInputStream_decompressStream","file":"src/main/native/jni_inputstream_zstd.c"},"deprecated":false,"digest":{"function_hash":"208058700514564190179005821942172458955","length":1245},"id":"CVE-2026-87795-c191132f"},{"digest":{"line_hashes":["76634499848722836972167157988447942390","60477330828820703664649133894845126063","209982705364140075873261171031666453574","250818059982176309654130449735599578177","74991185452242401027281778908747524748","176042953361110786164980661100003695557","263525429665522269555606705821481199670","20633577328658672793529113780313234668","100970983125725289565116434623667382823","254881659229508131082102148066833751787","5477471141322320865474338174724741092","27251147454671349464288620430022784104","167513408727805357198078732117860285263","194237593440563674157045992831082482387","254972967423905411435788671780616156372","109926745306025645435388176701691854689","80206419506447357949696485762430598209","263072302765808324094343215189721917505","80801707689360301734219395697541525320","43140177542797220907727004578533348154","193316175214154703878965331838607812463","303039214346202667766871263417928258214"],"threshold":0.9},"id":"CVE-2026-87795-c31597b8","signature_type":"Line","signature_version":"v1","source":"https://github.com/luben/zstd-jni/commit/1c4e5a6c3ce8458095225d987d669e6a0937734a","target":{"file":"src/main/java/com/github/luben/zstd/ZstdDictCompress.java"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["242983979289756636978174893894911169283","157823411836278810979700492519583258858","47982388172284482667079231190836641912","142002538935986523140505977783435642687","70654406038950244899492554068964697791","256841266079176367404669460587415964017","136130365917502750732790875301653462261","307914870517560413069750160813139035083","70654406038950244899492554068964697791","256841266079176367404669460587415964017","136130365917502750732790875301653462261","307914870517560413069750160813139035083"],"threshold":0.9},"id":"CVE-2026-87795-cf1cd55a","signature_type":"Line","signature_version":"v1","source":"https://github.com/luben/zstd-jni/commit/3216860eea289fbbae0b191c0a4fd8b72dad949c","target":{"file":"src/main/native/jni_zstd.c"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/luben/zstd-jni/commit/3216860eea289fbbae0b191c0a4fd8b72dad949c","target":{"file":"src/main/native/jni_zstd.c","function":"Java_com_github_luben_zstd_Zstd_findDirectByteBufferFrameCompressedSize"},"deprecated":false,"digest":{"length":503,"function_hash":"6130561471615133004258603361745015963"},"id":"CVE-2026-87795-e402cad3"},{"target":{"function":"Java_com_github_luben_zstd_Zstd_decompressedDirectByteBufferSize","file":"src/main/native/jni_zstd.c"},"deprecated":false,"digest":{"length":552,"function_hash":"243452810049814927721413726162029308560"},"id":"CVE-2026-87795-e43e017d","signature_type":"Function","signature_version":"v1","source":"https://github.com/luben/zstd-jni/commit/3216860eea289fbbae0b191c0a4fd8b72dad949c"},{"deprecated":false,"digest":{"length":256,"function_hash":"177971834334608659953571967859922135406"},"id":"CVE-2026-87795-e82f1434","signature_type":"Function","signature_version":"v1","source":"https://github.com/luben/zstd-jni/commit/1c4e5a6c3ce8458095225d987d669e6a0937734a","target":{"file":"src/main/native/jni_fast_zstd.c","function":"nativePtrField"}},{"source":"https://github.com/luben/zstd-jni/commit/1c4e5a6c3ce8458095225d987d669e6a0937734a","target":{"file":"src/main/native/jni_zstd.c","function":"Java_com_github_luben_zstd_Zstd_decompress"},"deprecated":false,"digest":{"function_hash":"19126674362734465130194688717362973502","length":721},"id":"CVE-2026-87795-ef068304","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/luben/zstd-jni/commit/0d64de4dee6606ff506be36c7f2e714ad0c80fdb","target":{"file":"src/main/java/com/github/luben/zstd/ZstdDictDecompress.java"},"deprecated":false,"digest":{"line_hashes":["68769222384474365059191319965559932433","140121056111128503309501068281881475905","113341820460396869349427415608453281426","208085089848693706084898394021207897224","288036046889534243479473518555746302855","311497263012537383015586318606982173589"],"threshold":0.9},"id":"CVE-2026-87795-f1acf50d","signature_type":"Line"}],"vanir_signatures_modified":"2026-10-28T11:19:07Z"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N"}]}