{"id":"CVE-2026-87825","summary":"zstd-jni 1.3.8-4 through 1.5.7-13 Use-After-Free of Compression and Decompression Dictionaries","details":"zstd-jni before 1.5.7-14 contains a use-after-free vulnerability where streams and contexts hold a dictionary's shared lock only during the load call, allowing the dictionary to be closed while still referenced. Attackers can close a dictionary after associating it with a stream or context, causing subsequent read or write operations to access freed native memory, resulting in silent data corruption or JVM crashes.","aliases":["GHSA-947w-pxjj-c7m9"],"modified":"2026-10-28T11:19:08.573995475Z","published":"2026-09-09T14:32:44.795Z","related":["SUSE-SU-2026:23858-1","SUSE-SU-2026:23868-1","openSUSE-SU-2026:11769-1","openSUSE-SU-2026:21902-1"],"database_specific":{"cna_assigner":"VulnCheck","cwe_ids":["CWE-416"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/87xxx/CVE-2026-87825.json"},"references":[{"type":"WEB","url":"https://repo1.maven.org/maven2/com/github/luben/zstd-jni/"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/87xxx/CVE-2026-87825.json"},{"type":"ADVISORY","url":"https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14"},{"type":"ADVISORY","url":"https://github.com/luben/zstd-jni/security/advisories/GHSA-947w-pxjj-c7m9"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87825"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/zstd-jni-1.3.8-4-through-1.5.7-13-use-after-free-of-compression-and-decompression-dictionaries"},{"type":"FIX","url":"https://github.com/luben/zstd-jni/commit/0827ed02551bbd8d6f8e4bbff99d83bf50f91938"},{"type":"FIX","url":"https://github.com/luben/zstd-jni/commit/393d7311766abbc285b149302c0fe1f94b16d555"},{"type":"FIX","url":"https://github.com/luben/zstd-jni/commit/a560131d7834598afd9cea6b7c107bc88e915936"},{"type":"PACKAGE","url":"https://github.com/luben/zstd-jni"},{"type":"ARTICLE","url":"https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/BaseZstdBufferDecompressingStreamNoFinalizer.java"},{"type":"ARTICLE","url":"https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/ZstdInputStreamNoFinalizer.java"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/luben/zstd-jni","events":[{"introduced":"0830536d204f2944f4a124517aec80b5e5dc2647"},{"fixed":"3216860eea289fbbae0b191c0a4fd8b72dad949c"},{"fixed":"393d7311766abbc285b149302c0fe1f94b16d555"},{"fixed":"a560131d7834598afd9cea6b7c107bc88e915936"},{"fixed":"0827ed02551bbd8d6f8e4bbff99d83bf50f91938"}],"database_specific":{"extracted_events":[{"source":"AFFECTED_FIELD","strategy":"StandardRange","range":[{"introduced":"1.3.8-4"},{"fixed":"1.5.7-14"}]},{"range":[{"fixed":"393d7311766abbc285b149302c0fe1f94b16d555"}],"source":"REFERENCES_COMMIT"},{"range":[{"fixed":"a560131d7834598afd9cea6b7c107bc88e915936"}],"source":"REFERENCES_COMMIT"},{"original_tag":"v1.5.7-14","range":[{"fixed":"3216860eea289fbbae0b191c0a4fd8b72dad949c"}],"source":"REFERENCES_TAG"},{"range":[{"fixed":"0827ed02551bbd8d6f8e4bbff99d83bf50f91938"}],"source":"REFERENCES_COMMIT"}]}}],"versions":["v1.5.7-13","v1.5.7-12","v1.5.7-11","v1.5.7-9","v1.5.7-8","v1.5.7-7","v1.5.7-6","v1.5.7-5","v1.5.7-4","v1.5.7-3","v1.5.7-2","v1.5.7-1","v1.5.6-10","v1.5.6-9","v1.5.6-8","v1.5.6-7","v1.5.6-6","v1.5.6-5","v1.5.6-4","v1.5.6-3","v1.5.6-2","v1.5.6-1","v1.5.5-11","v1.5.5-10","v1.5.5-9","b1.5.5-9","v1.5.5-8","v1.5.5-7","v1.5.5-6","v.1.5.5-5","v1.5.5-3","v1.5.5-2","v1.5.5-1","v1.5.4-2","v1.5.4-1","c1.5.2-5","v1.5.2-3","v1.5.2-2","v1.5.2-1","v1.5.1-1","v1.5.0-5","v1.5.0-4","v1.5.0-3","v1.5.0-2","v1.5.0-1","v1.4.9-5","v1.4.9-4","v1.4.9-3","v1.4.9-2","v1.4.9-1","v1.4.8-7","v1.4.8-6","v1.4.8-5","v1.4.8-4","v1.4.8-3","v1.4.8-2","v1.4.8-1","v1.4.7-3","v1.4.7-2","v1.4.7-1","v1.4.5-12","v1.4.5-11","v1.4.5-10","v1.4.5-9","v1.4.5-8","v1.4.5-7","v1.4.5-6","v1.4.5-4","v1.4.5-3","v1.4.5-2","v1.4.5-1","v1.4.4-11","v1.4.4-10","v1.4.4-9","v1.4.4-8","v1.4.4-7","v1.4.4-5","1.4.4-4","v1.4.4-3","v1.4.4-2","v1.4.3-1","v1.4.2-1","v1.4.1-1","v1.4.0-1","v.1.3.8-9","v1.3.8-8","v1.3.8-7","v1.3.8-6","v1.3.8-5","v1.3.8-4"],"database_specific":{"vanir_signatures_modified":"2026-10-28T11:19:08Z","source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-87825.json","vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://github.com/luben/zstd-jni/commit/a560131d7834598afd9cea6b7c107bc88e915936","target":{"file":"src/main/java/com/github/luben/zstd/AutoCloseBase.java","function":"close"},"deprecated":false,"digest":{"length":251,"function_hash":"190147110216752547001541311880895833985"},"id":"CVE-2026-87825-003414d9"},{"source":"https://github.com/luben/zstd-jni/commit/393d7311766abbc285b149302c0fe1f94b16d555","target":{"file":"src/main/java/com/github/luben/zstd/ZstdOutputStreamNoFinalizer.java","function":"setDict"},"deprecated":false,"digest":{"function_hash":"90768234226486204126310672057480896256","length":306},"id":"CVE-2026-87825-0b7acbf1","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"274181490123766162426083993247419205519","length":208},"id":"CVE-2026-87825-2d1ef32d","signature_type":"Function","signature_version":"v1","source":"https://github.com/luben/zstd-jni/commit/0827ed02551bbd8d6f8e4bbff99d83bf50f91938","target":{"function":"setDict","file":"src/main/java/com/github/luben/zstd/ZstdInputStream.java"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/luben/zstd-jni/commit/393d7311766abbc285b149302c0fe1f94b16d555","target":{"file":"src/main/java/com/github/luben/zstd/ZstdOutputStreamNoFinalizer.java","function":"close"},"deprecated":false,"digest":{"function_hash":"177890619529594044692716417677243851675","length":589},"id":"CVE-2026-87825-2d2be32d"},{"target":{"file":"src/main/java/com/github/luben/zstd/ZstdCompressCtx.java"},"deprecated":false,"digest":{"line_hashes":["161442349170517410975110200001437080366","34066592231648300388012511974350997280","149878935130217235484992852517420170442","14489918499017478692436695058216837599","102529647872444511022977464566886577860","204173721983341373199023463655430218400","71750960482462487845070512801316410737","73994977889459442019726037972305165724","166439450379177523341797433072885033922","2321744072256897609445875126644834418","274684629168077416965930330418719862976","167598862179787924031126411196899973284","165143370215310043683527592902238379606","250507336186916882454769835270231595569","115722371557252704448826442811121030868","325336442386345097317127578185425001982","304029479862755887940608523547194834319"],"threshold":0.9},"id":"CVE-2026-87825-2ec8a5d3","signature_type":"Line","signature_version":"v1","source":"https://github.com/luben/zstd-jni/commit/a560131d7834598afd9cea6b7c107bc88e915936"},{"signature_version":"v1","source":"https://github.com/luben/zstd-jni/commit/a560131d7834598afd9cea6b7c107bc88e915936","target":{"file":"src/main/java/com/github/luben/zstd/ZstdDecompressCtx.java","function":"loadDict"},"deprecated":false,"digest":{"function_hash":"328157868163181307328445428323764355688","length":250},"id":"CVE-2026-87825-306bb948","signature_type":"Function"},{"id":"CVE-2026-87825-44dbbae1","signature_type":"Function","signature_version":"v1","source":"https://github.com/luben/zstd-jni/commit/3216860eea289fbbae0b191c0a4fd8b72dad949c","target":{"file":"src/main/native/jni_zstd.c","function":"Java_com_github_luben_zstd_Zstd_getDirectByteBufferFrameContentSize"},"deprecated":false,"digest":{"function_hash":"319696483832917712384682231278816072707","length":525}},{"target":{"file":"src/main/java/com/github/luben/zstd/ZstdInputStreamNoFinalizer.java"},"deprecated":false,"digest":{"line_hashes":["264224633442601680061681778831217784405","199182744398023258679998021686664513556","281774072224271264659833238289708813908","133304176427710129384173805349417002567","110993408741559643463488015387631588277","243084862491645028159755052325163196455","237915631022718460723497340202154061654","7565748850633265885309141182425541552","170694195750718338793879174623391645051","108995353165297911114267291243549039809","98025755611052609260852558549916351515","504869937110756436926175038712124994","115403151979830004467398658156024690043","298336324294485433890146134924036121706","184955146790780920561344166656994733723","68120552945343800117397848230652589973","133227231070318101555204829318863302857","337660356013846913362133871866251128703","190690762174774163142285382328963802661","239929959814439138672386020122940744806","125418192118942412411427988904750714371","160518533996939639021567808701370391510","28615655768215271941804668873256577067","169105887916564966513434521475896654265","293055559587077273719905026468558507567","36615860887186839760675534659195509288","306111020125137117961330872106111902587","306386994860202161732109303897369291620","25245124146335873966123015128391446668","46155471403664440156868535388851317211","139988886889336730135410868956921276390"],"threshold":0.9},"id":"CVE-2026-87825-45c3a546","signature_type":"Line","signature_version":"v1","source":"https://github.com/luben/zstd-jni/commit/393d7311766abbc285b149302c0fe1f94b16d555"},{"source":"https://github.com/luben/zstd-jni/commit/393d7311766abbc285b149302c0fe1f94b16d555","target":{"file":"src/main/java/com/github/luben/zstd/ZstdInputStreamNoFinalizer.java","function":"setLongMax"},"deprecated":false,"digest":{"function_hash":"271463915713822081245877430838300272161","length":180},"id":"CVE-2026-87825-4b1273cc","signature_type":"Function","signature_version":"v1"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/luben/zstd-jni/commit/0827ed02551bbd8d6f8e4bbff99d83bf50f91938","target":{"file":"src/main/native/jni_inputstream_zstd.c","function":"Java_com_github_luben_zstd_ZstdInputStream_initDStreamWithDict"},"deprecated":false,"digest":{"length":638,"function_hash":"316115205150602137625555191023119549146"},"id":"CVE-2026-87825-5195ab92"},{"digest":{"function_hash":"70031939536342015921477796118506824547","length":1253},"id":"CVE-2026-87825-6a7f904f","signature_type":"Function","signature_version":"v1","source":"https://github.com/luben/zstd-jni/commit/0827ed02551bbd8d6f8e4bbff99d83bf50f91938","target":{"function":"Java_com_github_luben_zstd_ZstdInputStream_decompressStream","file":"src/main/native/jni_inputstream_zstd.c"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"184412482065566415555236874295088898965","length":618},"id":"CVE-2026-87825-6ea01eaf","signature_type":"Function","signature_version":"v1","source":"https://github.com/luben/zstd-jni/commit/0827ed02551bbd8d6f8e4bbff99d83bf50f91938","target":{"file":"src/main/native/jni_inputstream_zstd.c","function":"Java_com_github_luben_zstd_ZstdInputStream_initDStreamWithFastDict"}},{"deprecated":false,"digest":{"function_hash":"198858719754160435256025354825199669103","length":358},"id":"CVE-2026-87825-6ed17a86","signature_type":"Function","signature_version":"v1","source":"https://github.com/luben/zstd-jni/commit/a560131d7834598afd9cea6b7c107bc88e915936","target":{"file":"src/main/java/com/github/luben/zstd/ZstdDecompressCtx.java","function":"loadDict"}},{"deprecated":false,"digest":{"function_hash":"319641253589214927682691714920742633531","length":197},"id":"CVE-2026-87825-75843252","signature_type":"Function","signature_version":"v1","source":"https://github.com/luben/zstd-jni/commit/393d7311766abbc285b149302c0fe1f94b16d555","target":{"file":"src/main/java/com/github/luben/zstd/ZstdInputStreamNoFinalizer.java","function":"setDict"}},{"target":{"function":"setRefMultipleDDicts","file":"src/main/java/com/github/luben/zstd/ZstdInputStreamNoFinalizer.java"},"deprecated":false,"digest":{"function_hash":"260759501099430209686084955000068839085","length":180},"id":"CVE-2026-87825-7aa8d859","signature_type":"Function","signature_version":"v1","source":"https://github.com/luben/zstd-jni/commit/393d7311766abbc285b149302c0fe1f94b16d555"},{"id":"CVE-2026-87825-840bf6c0","signature_type":"Line","signature_version":"v1","source":"https://github.com/luben/zstd-jni/commit/0827ed02551bbd8d6f8e4bbff99d83bf50f91938","target":{"file":"src/main/java/com/github/luben/zstd/ZstdInputStream.java"},"deprecated":false,"digest":{"line_hashes":["170568481383276599712457261937841558850","229543292435634669739457181894341155837","239966676698473478615467680705605280924","316521954827615230962982527367976862752","1782777112137163608098832151228703416","243687218256308099706182769162129602069","44473907197886718980651122616738430939","241452303386160364363085439520057276328","96308644468620632196205640924730988480","155845712179438385424340464648960743913","324883013780695734428821937947235404898","220427344998461923630983096383108960916","211238486118982189469621713008742053224","509271047184189664638397160318352573","170047312953424715741489745795234910138","180774321641957468134352898629520814760","313922876077941399343504116828280967646","328398181155141763900388447936397473341","198416365217909942224304075215653827869","172425255981349427187140962028315524355","221558127467684918004295427689360276233","146373912880034541969053830603673507789","209758269282267634250865715673178967409","45163047261668331199604356187905763692","55248796628210121246910545866091397963","290426331214764887909640668559838526735","273428914716255017380188502552431397765","287169420803146240150120402543078614746","301947677362385251556904768136125505827","295139815346021582981260760862717864914","277876504218794093539124688047361793178","101324275571308629146437054480897412129","99468670568881284498727698321378921643","261886494336664274579946354810546380423","283799738403105974941231852441889443234","57233651659815631566488700084457919949","173122525313244002146162733643945812940","45401403496625663275554982797077774346","244377870961414196012990091616507215175","283823839129712826176104920861495360967","327920014761678239691607631967562931124","258785801278506633041075924500645300330","91019171903556262031744676925899459215","166532476911931918194796276115917512638","252225056680332238858977443889690407105","197187053546322423261945972282068375236"],"threshold":0.9}},{"signature_version":"v1","source":"https://github.com/luben/zstd-jni/commit/0827ed02551bbd8d6f8e4bbff99d83bf50f91938","target":{"file":"src/main/java/com/github/luben/zstd/ZstdInputStream.java","function":"readInternal"},"deprecated":false,"digest":{"function_hash":"14954420267460264693101135173453685944","length":1430},"id":"CVE-2026-87825-8f0fecfd","signature_type":"Function"},{"id":"CVE-2026-87825-99456351","signature_type":"Function","signature_version":"v1","source":"https://github.com/luben/zstd-jni/commit/393d7311766abbc285b149302c0fe1f94b16d555","target":{"function":"setDict","file":"src/main/java/com/github/luben/zstd/ZstdOutputStreamNoFinalizer.java"},"deprecated":false,"digest":{"function_hash":"107969190982614359218092147501005512093","length":291}},{"id":"CVE-2026-87825-9b602d16","signature_type":"Line","signature_version":"v1","source":"https://github.com/luben/zstd-jni/commit/0827ed02551bbd8d6f8e4bbff99d83bf50f91938","target":{"file":"src/main/native/jni_inputstream_zstd.c"},"deprecated":false,"digest":{"line_hashes":["178691566480125545083897481397429913705","27026733835453101681325318386225434173","20934101978140110714062890983352037764","179140947726698074228252074248609993748","89636334816656029911195590785086593846","158370242423049237151607850163621086388","151746389891425922919089302863208347394","321943947574852714368023088035248451814","255100236820680088504400827479307032463","147616016809210890368784642433687314213","128963053751841334991569586428204005292","137660504888678578059300644952571377781","302352291930140934867009889874820270045","214419353473350375573736753334796896725","286120859013870098928390477959876746483","193937137488937287396410023505088017496","137879611079704377550710311363980321724","95556320824569977235608554187261800635","157713266669716739341679683316827858601","20248207013033163068656988092585629837","97481675661896979692186818919763540292","274376054270777021191335947688032896307","268454005763589359639216224402057876766","93186406993453685997257278262263178681","336421164699667983775742936469831282665","337196388830807224904092119692708052936","185758476731149326719779797168949903637","131101032005908879786534990203064634408","301222299873870999727819752897364047682","145775362545413186109898949107002192056","103491316954883803443801939505861065848","303524260623436864380726155674802745896","52330583718710554257385845190366448543","128963053751841334991569586428204005292","328771868482696711886931879688959971085","218991712009611854041375403707769962990","139773119057406227983270607052558271282","108206242679865708297775771039780479658"],"threshold":0.9}},{"target":{"file":"src/main/java/com/github/luben/zstd/ZstdOutputStreamNoFinalizer.java"},"deprecated":false,"digest":{"line_hashes":["74455674866543267600323183610353566425","104303472910255849574009696782222497627","125424914868468814562900959445886372296","160545172446603814756871854605618253528","282481271018160306216050242828482235492","40713340882558282911128258701333885729","280520504329013798854554905856858736514","225254474602493753919964394705260136934","336087237197818649892450586568309516894","191937646250162431147149798881614586886","99884675316341602085583605478731896591","46356239636191228421164252797994197140","117728383546245102028786931062141257421","332907289521509766774353044362251331685","149913402196823921892226963591376609411","137356514208070631661453990621757444244","241692203275808010759599086382472996411","236729460068367658912698159815895444773","17567403461232829665962412072086926009","199490092555280766509022487279932998000","58683591593303962060913105293615216808","3039807520169150701671137231814646489","310294753027526759919583350045936373997","335657711617037135027162529693383550957","230976928102971873851317510544797308782","261120791004201477057035928767954478416","234652052280607766069399070334468659768","309935255291308959642482893046965746427","320274593056442929328309558740021021134","227250235862692399237395374503236582599","226914302866278220457606174908179334529","328025982446031431156972514719456948442","277045177588055439848021572331963836012","31604907878431848040837143662393386333","164898943394301030715460811086661431216","208040746012957378269183237993613361424","332092226985985638053500727384286801683","18311215638409940417227595265372805362","124848993726531244568356616851106381416","92187924838632831764227527745790605567","101276177592573537920611283631906549510","45120770702661914034069784489441024563","271574723997082877010650472662369532360","52815045351248476456535127859446677830","19183470307466171212650007824213115873","41011123896315914607609544584747345833","271496040356161696355184168134177719807","323819342324308088686354313601676606579","116068075780665376085745048107411919215","212962310549434437267520000132227545208","123292615164364238921147073077726294552","293946064409153490040355912215641564531","212319137029919694061585596806814969983","128103863884348929675076993732087118886","121174977646609686955234775707204251124","263206777839316912105896955636470416970","169474696394765377379573305555595824081","241893609724057024704766270038336719111","222435154897144962146478483517005856289","159633936964226236478603839187288978792","98025755611052609260852558549916351515","32769167042404322289623550003151445846","73426124730689841056298799432364177945","302234525767176018423345985768003806461","4113670512980813352479408306603414075","300902234690768657683377193768542158047"],"threshold":0.9},"id":"CVE-2026-87825-9c0e224b","signature_type":"Line","signature_version":"v1","source":"https://github.com/luben/zstd-jni/commit/393d7311766abbc285b149302c0fe1f94b16d555"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/luben/zstd-jni/commit/a560131d7834598afd9cea6b7c107bc88e915936","target":{"file":"src/main/java/com/github/luben/zstd/AutoCloseBase.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["325848314404767575448177659153994759371","308164802813736960358326615538514376149","336800683607140354884145845853333536410","136862124148506201364395468491931013019","156010357011589465839511529595621431277","90721868715716227756565022619962552461","231906223912055913280100289763112445042"]},"id":"CVE-2026-87825-a17b71a7"},{"id":"CVE-2026-87825-a1a29e24","signature_type":"Function","signature_version":"v1","source":"https://github.com/luben/zstd-jni/commit/0827ed02551bbd8d6f8e4bbff99d83bf50f91938","target":{"function":"setDict","file":"src/main/java/com/github/luben/zstd/ZstdInputStream.java"},"deprecated":false,"digest":{"function_hash":"97082945452581887555177505813648299677","length":208}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/luben/zstd-jni/commit/0827ed02551bbd8d6f8e4bbff99d83bf50f91938","target":{"file":"src/main/java/com/github/luben/zstd/ZstdInputStream.java","function":"ZstdInputStream"},"deprecated":false,"digest":{"function_hash":"323556055200443188316258958117677726716","length":140},"id":"CVE-2026-87825-aa73e27e"},{"deprecated":false,"digest":{"function_hash":"105418031180568436561605237360893120005","length":248},"id":"CVE-2026-87825-b0d3efbc","signature_type":"Function","signature_version":"v1","source":"https://github.com/luben/zstd-jni/commit/a560131d7834598afd9cea6b7c107bc88e915936","target":{"file":"src/main/java/com/github/luben/zstd/ZstdCompressCtx.java","function":"loadDict"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/luben/zstd-jni/commit/a560131d7834598afd9cea6b7c107bc88e915936","target":{"function":"reset","file":"src/main/java/com/github/luben/zstd/ZstdCompressCtx.java"},"deprecated":false,"digest":{"function_hash":"317819965980214417522013486171429917251","length":188},"id":"CVE-2026-87825-bbbff220"},{"source":"https://github.com/luben/zstd-jni/commit/a560131d7834598afd9cea6b7c107bc88e915936","target":{"file":"src/main/java/com/github/luben/zstd/ZstdCompressCtx.java","function":"loadDict"},"deprecated":false,"digest":{"function_hash":"224169055303276845043143090851841994253","length":356},"id":"CVE-2026-87825-bf00cc62","signature_type":"Function","signature_version":"v1"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/luben/zstd-jni/commit/3216860eea289fbbae0b191c0a4fd8b72dad949c","target":{"file":"src/main/native/jni_zstd.c"},"deprecated":false,"digest":{"line_hashes":["242983979289756636978174893894911169283","157823411836278810979700492519583258858","47982388172284482667079231190836641912","142002538935986523140505977783435642687","70654406038950244899492554068964697791","256841266079176367404669460587415964017","136130365917502750732790875301653462261","307914870517560413069750160813139035083","70654406038950244899492554068964697791","256841266079176367404669460587415964017","136130365917502750732790875301653462261","307914870517560413069750160813139035083"],"threshold":0.9},"id":"CVE-2026-87825-cf1cd55a"},{"signature_version":"v1","source":"https://github.com/luben/zstd-jni/commit/a560131d7834598afd9cea6b7c107bc88e915936","target":{"file":"src/main/java/com/github/luben/zstd/ZstdDecompressCtx.java"},"deprecated":false,"digest":{"line_hashes":["102179456491904215421698423585885015796","32335867105913514308747802087599078895","139953312440772806941413198688371476165","255039249674977730051025106979345647165","2370970884887731348856709940058136513","204173721983341373199023463655430218400","71750960482462487845070512801316410737","73994977889459442019726037972305165724","166439450379177523341797433072885033922","36214007193820069521236162943145989645","163277444106301793367642982818369474375","144585875173241693785061221670898125417","160596219251967169029481648813620531699","250507336186916882454769835270231595569","115722371557252704448826442811121030868","325336442386345097317127578185425001982","304029479862755887940608523547194834319"],"threshold":0.9},"id":"CVE-2026-87825-dced2015","signature_type":"Line"},{"target":{"file":"src/main/native/jni_zstd.c","function":"Java_com_github_luben_zstd_Zstd_findDirectByteBufferFrameCompressedSize"},"deprecated":false,"digest":{"function_hash":"6130561471615133004258603361745015963","length":503},"id":"CVE-2026-87825-e402cad3","signature_type":"Function","signature_version":"v1","source":"https://github.com/luben/zstd-jni/commit/3216860eea289fbbae0b191c0a4fd8b72dad949c"},{"deprecated":false,"digest":{"length":552,"function_hash":"243452810049814927721413726162029308560"},"id":"CVE-2026-87825-e43e017d","signature_type":"Function","signature_version":"v1","source":"https://github.com/luben/zstd-jni/commit/3216860eea289fbbae0b191c0a4fd8b72dad949c","target":{"file":"src/main/native/jni_zstd.c","function":"Java_com_github_luben_zstd_Zstd_decompressedDirectByteBufferSize"}},{"digest":{"function_hash":"317819965980214417522013486171429917251","length":188},"id":"CVE-2026-87825-f27ede27","signature_type":"Function","signature_version":"v1","source":"https://github.com/luben/zstd-jni/commit/a560131d7834598afd9cea6b7c107bc88e915936","target":{"file":"src/main/java/com/github/luben/zstd/ZstdDecompressCtx.java","function":"reset"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/luben/zstd-jni/commit/393d7311766abbc285b149302c0fe1f94b16d555","target":{"function":"setDict","file":"src/main/java/com/github/luben/zstd/ZstdInputStreamNoFinalizer.java"},"deprecated":false,"digest":{"function_hash":"169309054857599887673336342145114688531","length":278},"id":"CVE-2026-87825-f5aa3ca4","signature_type":"Function"},{"signature_version":"v1","source":"https://github.com/luben/zstd-jni/commit/393d7311766abbc285b149302c0fe1f94b16d555","target":{"file":"src/main/java/com/github/luben/zstd/ZstdInputStreamNoFinalizer.java","function":"close"},"deprecated":false,"digest":{"function_hash":"233600532191171171471086635846812889960","length":172},"id":"CVE-2026-87825-f9d2726e","signature_type":"Function"}]}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N"}]}