{"id":"CVE-2026-87877","summary":"zstd-jni 1.3.8-4 through 1.5.7-13 Use-After-Free via Setters Called After close()","details":"zstd-jni versions before 1.5.7-14 fail to validate closed state in setDict, setLongMax, setLevel and setRefMultipleDDicts methods of stream classes. Attackers can call these methods on closed streams to write through freed native pointers, corrupting unrelated objects or crashing the JVM.","aliases":["GHSA-2jw3-mg7f-vw4q"],"modified":"2026-10-28T11:00:51.576430919Z","published":"2026-09-09T14:32:45.512Z","related":["SUSE-SU-2026:23858-1","SUSE-SU-2026:23868-1","openSUSE-SU-2026:21902-1"],"database_specific":{"cwe_ids":["CWE-416"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/87xxx/CVE-2026-87877.json","cna_assigner":"VulnCheck"},"references":[{"type":"WEB","url":"https://repo1.maven.org/maven2/com/github/luben/zstd-jni/"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/87xxx/CVE-2026-87877.json"},{"type":"ADVISORY","url":"https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14"},{"type":"ADVISORY","url":"https://github.com/luben/zstd-jni/security/advisories/GHSA-2jw3-mg7f-vw4q"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87877"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/zstd-jni-1.3.8-4-through-1.5.7-13-use-after-free-via-setters-called-after-close"},{"type":"FIX","url":"https://github.com/luben/zstd-jni/commit/0827ed02551bbd8d6f8e4bbff99d83bf50f91938"},{"type":"FIX","url":"https://github.com/luben/zstd-jni/commit/393d7311766abbc285b149302c0fe1f94b16d555"},{"type":"FIX","url":"https://github.com/luben/zstd-jni/commit/f38f9a1563113d96d0fc38baee543f7457dd8a8e"},{"type":"PACKAGE","url":"https://github.com/luben/zstd-jni"},{"type":"ARTICLE","url":"https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/BaseZstdBufferDecompressingStreamNoFinalizer.java"},{"type":"ARTICLE","url":"https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/ZstdInputStreamNoFinalizer.java"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/luben/zstd-jni","events":[{"introduced":"0830536d204f2944f4a124517aec80b5e5dc2647"},{"fixed":"3216860eea289fbbae0b191c0a4fd8b72dad949c"},{"fixed":"f38f9a1563113d96d0fc38baee543f7457dd8a8e"},{"fixed":"393d7311766abbc285b149302c0fe1f94b16d555"},{"fixed":"0827ed02551bbd8d6f8e4bbff99d83bf50f91938"}],"database_specific":{"extracted_events":[{"source":"AFFECTED_FIELD","strategy":"StandardRange","range":[{"introduced":"1.3.8-4"},{"fixed":"1.5.7-14"}]},{"range":[{"fixed":"f38f9a1563113d96d0fc38baee543f7457dd8a8e"}],"source":"REFERENCES_COMMIT"},{"range":[{"fixed":"393d7311766abbc285b149302c0fe1f94b16d555"}],"source":"REFERENCES_COMMIT"},{"range":[{"fixed":"3216860eea289fbbae0b191c0a4fd8b72dad949c"}],"source":"REFERENCES_TAG","original_tag":"v1.5.7-14"},{"range":[{"fixed":"0827ed02551bbd8d6f8e4bbff99d83bf50f91938"}],"source":"REFERENCES_COMMIT"}]}}],"versions":["v1.5.7-13","v1.5.7-12","v1.5.7-11","v1.5.7-9","v1.5.7-8","v1.5.7-7","v1.5.7-6","v1.5.7-5","v1.5.7-4","v1.5.7-3","v1.5.7-2","v1.5.7-1","v1.5.6-10","v1.5.6-9","v1.5.6-8","v1.5.6-7","v1.5.6-6","v1.5.6-5","v1.5.6-4","v1.5.6-3","v1.5.6-2","v1.5.6-1","v1.5.5-11","v1.5.5-10","v1.5.5-9","b1.5.5-9","v1.5.5-8","v1.5.5-7","v1.5.5-6","v.1.5.5-5","v1.5.5-3","v1.5.5-2","v1.5.5-1","v1.5.4-2","v1.5.4-1","c1.5.2-5","v1.5.2-3","v1.5.2-2","v1.5.2-1","v1.5.1-1","v1.5.0-5","v1.5.0-4","v1.5.0-3","v1.5.0-2","v1.5.0-1","v1.4.9-5","v1.4.9-4","v1.4.9-3","v1.4.9-2","v1.4.9-1","v1.4.8-7","v1.4.8-6","v1.4.8-5","v1.4.8-4","v1.4.8-3","v1.4.8-2","v1.4.8-1","v1.4.7-3","v1.4.7-2","v1.4.7-1","v1.4.5-12","v1.4.5-11","v1.4.5-10","v1.4.5-9","v1.4.5-8","v1.4.5-7","v1.4.5-6","v1.4.5-4","v1.4.5-3","v1.4.5-2","v1.4.5-1","v1.4.4-11","v1.4.4-10","v1.4.4-9","v1.4.4-8","v1.4.4-7","v1.4.4-5","1.4.4-4","v1.4.4-3","v1.4.4-2","v1.4.3-1","v1.4.2-1","v1.4.1-1","v1.4.0-1","v.1.3.8-9","v1.3.8-8","v1.3.8-7","v1.3.8-6","v1.3.8-5","v1.3.8-4"],"database_specific":{"vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://github.com/luben/zstd-jni/commit/f38f9a1563113d96d0fc38baee543f7457dd8a8e","target":{"file":"src/main/java/com/github/luben/zstd/BaseZstdBufferDecompressingStreamNoFinalizer.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["229310732171514125746685315061535664413","286353657816325088407530745397575314578","164506986080347496315592170955878782343","119302752608786672787026851670426823100","271863858728292820622126111686122263222","182939225570076337882444348671113774528","129060289602129467709736060871491252812","101915134061936249999590926731327880017","200744780348578148085731355848790644596","185467643525929841811945989080328999095","207893907684602458737068332815398486988","280154477253590089504272518232063159293","68344478199792028021440815642485050582","80253867799444846590163368947816935652","55194875252482706229447110809854148337","170973370839161415647646685077604299623","91666776320918888683922113952274442422","293663691537715390396914670344614400556","234521850147960991270701270724767265972","163933207376533055490625210928046713726","107750178626091304709744943969000628895","262624005589318358869617576638383262245","243454012210171353450878091271375056219","83224745714455141354983196042337476570","184955146790780920561344166656994733723","68120552945343800117397848230652589973","42180750968332415812451287695930616047","338331387314282135898399962808855750969","3787471408146339307842850575818737910","254433155285637658849512363931544223336","320967664445893681846594869740199033952","123269859128965741517118232951441794151","137415353793312983625164005279888965925","62252269052365329939837429167832515273"]},"id":"CVE-2026-87877-081dd4e6"},{"source":"https://github.com/luben/zstd-jni/commit/393d7311766abbc285b149302c0fe1f94b16d555","target":{"file":"src/main/java/com/github/luben/zstd/ZstdOutputStreamNoFinalizer.java","function":"setDict"},"deprecated":false,"digest":{"function_hash":"90768234226486204126310672057480896256","length":306},"id":"CVE-2026-87877-0b7acbf1","signature_type":"Function","signature_version":"v1"},{"id":"CVE-2026-87877-2d1ef32d","signature_type":"Function","signature_version":"v1","source":"https://github.com/luben/zstd-jni/commit/0827ed02551bbd8d6f8e4bbff99d83bf50f91938","target":{"file":"src/main/java/com/github/luben/zstd/ZstdInputStream.java","function":"setDict"},"deprecated":false,"digest":{"function_hash":"274181490123766162426083993247419205519","length":208}},{"signature_version":"v1","source":"https://github.com/luben/zstd-jni/commit/393d7311766abbc285b149302c0fe1f94b16d555","target":{"file":"src/main/java/com/github/luben/zstd/ZstdOutputStreamNoFinalizer.java","function":"close"},"deprecated":false,"digest":{"function_hash":"177890619529594044692716417677243851675","length":589},"id":"CVE-2026-87877-2d2be32d","signature_type":"Function"},{"target":{"file":"src/main/java/com/github/luben/zstd/BaseZstdBufferDecompressingStreamNoFinalizer.java","function":"close"},"deprecated":false,"digest":{"function_hash":"258296661769363088332534342921921506081","length":116},"id":"CVE-2026-87877-38f147be","signature_type":"Function","signature_version":"v1","source":"https://github.com/luben/zstd-jni/commit/f38f9a1563113d96d0fc38baee543f7457dd8a8e"},{"digest":{"length":525,"function_hash":"319696483832917712384682231278816072707"},"id":"CVE-2026-87877-44dbbae1","signature_type":"Function","signature_version":"v1","source":"https://github.com/luben/zstd-jni/commit/3216860eea289fbbae0b191c0a4fd8b72dad949c","target":{"file":"src/main/native/jni_zstd.c","function":"Java_com_github_luben_zstd_Zstd_getDirectByteBufferFrameContentSize"},"deprecated":false},{"target":{"file":"src/main/java/com/github/luben/zstd/ZstdInputStreamNoFinalizer.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["264224633442601680061681778831217784405","199182744398023258679998021686664513556","281774072224271264659833238289708813908","133304176427710129384173805349417002567","110993408741559643463488015387631588277","243084862491645028159755052325163196455","237915631022718460723497340202154061654","7565748850633265885309141182425541552","170694195750718338793879174623391645051","108995353165297911114267291243549039809","98025755611052609260852558549916351515","504869937110756436926175038712124994","115403151979830004467398658156024690043","298336324294485433890146134924036121706","184955146790780920561344166656994733723","68120552945343800117397848230652589973","133227231070318101555204829318863302857","337660356013846913362133871866251128703","190690762174774163142285382328963802661","239929959814439138672386020122940744806","125418192118942412411427988904750714371","160518533996939639021567808701370391510","28615655768215271941804668873256577067","169105887916564966513434521475896654265","293055559587077273719905026468558507567","36615860887186839760675534659195509288","306111020125137117961330872106111902587","306386994860202161732109303897369291620","25245124146335873966123015128391446668","46155471403664440156868535388851317211","139988886889336730135410868956921276390"]},"id":"CVE-2026-87877-45c3a546","signature_type":"Line","signature_version":"v1","source":"https://github.com/luben/zstd-jni/commit/393d7311766abbc285b149302c0fe1f94b16d555"},{"target":{"file":"src/main/java/com/github/luben/zstd/ZstdInputStreamNoFinalizer.java","function":"setLongMax"},"deprecated":false,"digest":{"function_hash":"271463915713822081245877430838300272161","length":180},"id":"CVE-2026-87877-4b1273cc","signature_type":"Function","signature_version":"v1","source":"https://github.com/luben/zstd-jni/commit/393d7311766abbc285b149302c0fe1f94b16d555"},{"digest":{"length":256,"function_hash":"100964816827806602550635380616494264833"},"id":"CVE-2026-87877-4c1fac9c","signature_type":"Function","signature_version":"v1","source":"https://github.com/luben/zstd-jni/commit/f38f9a1563113d96d0fc38baee543f7457dd8a8e","target":{"function":"setDict","file":"src/main/java/com/github/luben/zstd/BaseZstdBufferDecompressingStreamNoFinalizer.java"},"deprecated":false},{"source":"https://github.com/luben/zstd-jni/commit/0827ed02551bbd8d6f8e4bbff99d83bf50f91938","target":{"file":"src/main/native/jni_inputstream_zstd.c","function":"Java_com_github_luben_zstd_ZstdInputStream_initDStreamWithDict"},"deprecated":false,"digest":{"function_hash":"316115205150602137625555191023119549146","length":638},"id":"CVE-2026-87877-5195ab92","signature_type":"Function","signature_version":"v1"},{"source":"https://github.com/luben/zstd-jni/commit/0827ed02551bbd8d6f8e4bbff99d83bf50f91938","target":{"file":"src/main/native/jni_inputstream_zstd.c","function":"Java_com_github_luben_zstd_ZstdInputStream_decompressStream"},"deprecated":false,"digest":{"function_hash":"70031939536342015921477796118506824547","length":1253},"id":"CVE-2026-87877-6a7f904f","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/luben/zstd-jni/commit/0827ed02551bbd8d6f8e4bbff99d83bf50f91938","target":{"function":"Java_com_github_luben_zstd_ZstdInputStream_initDStreamWithFastDict","file":"src/main/native/jni_inputstream_zstd.c"},"deprecated":false,"digest":{"function_hash":"184412482065566415555236874295088898965","length":618},"id":"CVE-2026-87877-6ea01eaf","signature_type":"Function"},{"signature_version":"v1","source":"https://github.com/luben/zstd-jni/commit/393d7311766abbc285b149302c0fe1f94b16d555","target":{"file":"src/main/java/com/github/luben/zstd/ZstdInputStreamNoFinalizer.java","function":"setDict"},"deprecated":false,"digest":{"length":197,"function_hash":"319641253589214927682691714920742633531"},"id":"CVE-2026-87877-75843252","signature_type":"Function"},{"id":"CVE-2026-87877-7aa8d859","signature_type":"Function","signature_version":"v1","source":"https://github.com/luben/zstd-jni/commit/393d7311766abbc285b149302c0fe1f94b16d555","target":{"function":"setRefMultipleDDicts","file":"src/main/java/com/github/luben/zstd/ZstdInputStreamNoFinalizer.java"},"deprecated":false,"digest":{"length":180,"function_hash":"260759501099430209686084955000068839085"}},{"id":"CVE-2026-87877-840bf6c0","signature_type":"Line","signature_version":"v1","source":"https://github.com/luben/zstd-jni/commit/0827ed02551bbd8d6f8e4bbff99d83bf50f91938","target":{"file":"src/main/java/com/github/luben/zstd/ZstdInputStream.java"},"deprecated":false,"digest":{"line_hashes":["170568481383276599712457261937841558850","229543292435634669739457181894341155837","239966676698473478615467680705605280924","316521954827615230962982527367976862752","1782777112137163608098832151228703416","243687218256308099706182769162129602069","44473907197886718980651122616738430939","241452303386160364363085439520057276328","96308644468620632196205640924730988480","155845712179438385424340464648960743913","324883013780695734428821937947235404898","220427344998461923630983096383108960916","211238486118982189469621713008742053224","509271047184189664638397160318352573","170047312953424715741489745795234910138","180774321641957468134352898629520814760","313922876077941399343504116828280967646","328398181155141763900388447936397473341","198416365217909942224304075215653827869","172425255981349427187140962028315524355","221558127467684918004295427689360276233","146373912880034541969053830603673507789","209758269282267634250865715673178967409","45163047261668331199604356187905763692","55248796628210121246910545866091397963","290426331214764887909640668559838526735","273428914716255017380188502552431397765","287169420803146240150120402543078614746","301947677362385251556904768136125505827","295139815346021582981260760862717864914","277876504218794093539124688047361793178","101324275571308629146437054480897412129","99468670568881284498727698321378921643","261886494336664274579946354810546380423","283799738403105974941231852441889443234","57233651659815631566488700084457919949","173122525313244002146162733643945812940","45401403496625663275554982797077774346","244377870961414196012990091616507215175","283823839129712826176104920861495360967","327920014761678239691607631967562931124","258785801278506633041075924500645300330","91019171903556262031744676925899459215","166532476911931918194796276115917512638","252225056680332238858977443889690407105","197187053546322423261945972282068375236"],"threshold":0.9}},{"source":"https://github.com/luben/zstd-jni/commit/0827ed02551bbd8d6f8e4bbff99d83bf50f91938","target":{"file":"src/main/java/com/github/luben/zstd/ZstdInputStream.java","function":"readInternal"},"deprecated":false,"digest":{"function_hash":"14954420267460264693101135173453685944","length":1430},"id":"CVE-2026-87877-8f0fecfd","signature_type":"Function","signature_version":"v1"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/luben/zstd-jni/commit/393d7311766abbc285b149302c0fe1f94b16d555","target":{"file":"src/main/java/com/github/luben/zstd/ZstdOutputStreamNoFinalizer.java","function":"setDict"},"deprecated":false,"digest":{"length":291,"function_hash":"107969190982614359218092147501005512093"},"id":"CVE-2026-87877-99456351"},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["178691566480125545083897481397429913705","27026733835453101681325318386225434173","20934101978140110714062890983352037764","179140947726698074228252074248609993748","89636334816656029911195590785086593846","158370242423049237151607850163621086388","151746389891425922919089302863208347394","321943947574852714368023088035248451814","255100236820680088504400827479307032463","147616016809210890368784642433687314213","128963053751841334991569586428204005292","137660504888678578059300644952571377781","302352291930140934867009889874820270045","214419353473350375573736753334796896725","286120859013870098928390477959876746483","193937137488937287396410023505088017496","137879611079704377550710311363980321724","95556320824569977235608554187261800635","157713266669716739341679683316827858601","20248207013033163068656988092585629837","97481675661896979692186818919763540292","274376054270777021191335947688032896307","268454005763589359639216224402057876766","93186406993453685997257278262263178681","336421164699667983775742936469831282665","337196388830807224904092119692708052936","185758476731149326719779797168949903637","131101032005908879786534990203064634408","301222299873870999727819752897364047682","145775362545413186109898949107002192056","103491316954883803443801939505861065848","303524260623436864380726155674802745896","52330583718710554257385845190366448543","128963053751841334991569586428204005292","328771868482696711886931879688959971085","218991712009611854041375403707769962990","139773119057406227983270607052558271282","108206242679865708297775771039780479658"]},"id":"CVE-2026-87877-9b602d16","signature_type":"Line","signature_version":"v1","source":"https://github.com/luben/zstd-jni/commit/0827ed02551bbd8d6f8e4bbff99d83bf50f91938","target":{"file":"src/main/native/jni_inputstream_zstd.c"}},{"signature_version":"v1","source":"https://github.com/luben/zstd-jni/commit/393d7311766abbc285b149302c0fe1f94b16d555","target":{"file":"src/main/java/com/github/luben/zstd/ZstdOutputStreamNoFinalizer.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["74455674866543267600323183610353566425","104303472910255849574009696782222497627","125424914868468814562900959445886372296","160545172446603814756871854605618253528","282481271018160306216050242828482235492","40713340882558282911128258701333885729","280520504329013798854554905856858736514","225254474602493753919964394705260136934","336087237197818649892450586568309516894","191937646250162431147149798881614586886","99884675316341602085583605478731896591","46356239636191228421164252797994197140","117728383546245102028786931062141257421","332907289521509766774353044362251331685","149913402196823921892226963591376609411","137356514208070631661453990621757444244","241692203275808010759599086382472996411","236729460068367658912698159815895444773","17567403461232829665962412072086926009","199490092555280766509022487279932998000","58683591593303962060913105293615216808","3039807520169150701671137231814646489","310294753027526759919583350045936373997","335657711617037135027162529693383550957","230976928102971873851317510544797308782","261120791004201477057035928767954478416","234652052280607766069399070334468659768","309935255291308959642482893046965746427","320274593056442929328309558740021021134","227250235862692399237395374503236582599","226914302866278220457606174908179334529","328025982446031431156972514719456948442","277045177588055439848021572331963836012","31604907878431848040837143662393386333","164898943394301030715460811086661431216","208040746012957378269183237993613361424","332092226985985638053500727384286801683","18311215638409940417227595265372805362","124848993726531244568356616851106381416","92187924838632831764227527745790605567","101276177592573537920611283631906549510","45120770702661914034069784489441024563","271574723997082877010650472662369532360","52815045351248476456535127859446677830","19183470307466171212650007824213115873","41011123896315914607609544584747345833","271496040356161696355184168134177719807","323819342324308088686354313601676606579","116068075780665376085745048107411919215","212962310549434437267520000132227545208","123292615164364238921147073077726294552","293946064409153490040355912215641564531","212319137029919694061585596806814969983","128103863884348929675076993732087118886","121174977646609686955234775707204251124","263206777839316912105896955636470416970","169474696394765377379573305555595824081","241893609724057024704766270038336719111","222435154897144962146478483517005856289","159633936964226236478603839187288978792","98025755611052609260852558549916351515","32769167042404322289623550003151445846","73426124730689841056298799432364177945","302234525767176018423345985768003806461","4113670512980813352479408306603414075","300902234690768657683377193768542158047"]},"id":"CVE-2026-87877-9c0e224b","signature_type":"Line"},{"signature_version":"v1","source":"https://github.com/luben/zstd-jni/commit/f38f9a1563113d96d0fc38baee543f7457dd8a8e","target":{"file":"src/main/java/com/github/luben/zstd/BaseZstdBufferDecompressingStreamNoFinalizer.java","function":"hasRemaining"},"deprecated":false,"digest":{"function_hash":"96156479135770289450050622847482613871","length":123},"id":"CVE-2026-87877-a01c1937","signature_type":"Function"},{"source":"https://github.com/luben/zstd-jni/commit/0827ed02551bbd8d6f8e4bbff99d83bf50f91938","target":{"function":"setDict","file":"src/main/java/com/github/luben/zstd/ZstdInputStream.java"},"deprecated":false,"digest":{"function_hash":"97082945452581887555177505813648299677","length":208},"id":"CVE-2026-87877-a1a29e24","signature_type":"Function","signature_version":"v1"},{"digest":{"function_hash":"323556055200443188316258958117677726716","length":140},"id":"CVE-2026-87877-aa73e27e","signature_type":"Function","signature_version":"v1","source":"https://github.com/luben/zstd-jni/commit/0827ed02551bbd8d6f8e4bbff99d83bf50f91938","target":{"file":"src/main/java/com/github/luben/zstd/ZstdInputStream.java","function":"ZstdInputStream"},"deprecated":false},{"source":"https://github.com/luben/zstd-jni/commit/f38f9a1563113d96d0fc38baee543f7457dd8a8e","target":{"file":"src/main/java/com/github/luben/zstd/BaseZstdBufferDecompressingStreamNoFinalizer.java","function":"setLongMax"},"deprecated":false,"digest":{"function_hash":"271463915713822081245877430838300272161","length":180},"id":"CVE-2026-87877-ad6751c0","signature_type":"Function","signature_version":"v1"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/luben/zstd-jni/commit/3216860eea289fbbae0b191c0a4fd8b72dad949c","target":{"file":"src/main/native/jni_zstd.c"},"deprecated":false,"digest":{"line_hashes":["242983979289756636978174893894911169283","157823411836278810979700492519583258858","47982388172284482667079231190836641912","142002538935986523140505977783435642687","70654406038950244899492554068964697791","256841266079176367404669460587415964017","136130365917502750732790875301653462261","307914870517560413069750160813139035083","70654406038950244899492554068964697791","256841266079176367404669460587415964017","136130365917502750732790875301653462261","307914870517560413069750160813139035083"],"threshold":0.9},"id":"CVE-2026-87877-cf1cd55a"},{"source":"https://github.com/luben/zstd-jni/commit/3216860eea289fbbae0b191c0a4fd8b72dad949c","target":{"file":"src/main/native/jni_zstd.c","function":"Java_com_github_luben_zstd_Zstd_findDirectByteBufferFrameCompressedSize"},"deprecated":false,"digest":{"function_hash":"6130561471615133004258603361745015963","length":503},"id":"CVE-2026-87877-e402cad3","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"243452810049814927721413726162029308560","length":552},"id":"CVE-2026-87877-e43e017d","signature_type":"Function","signature_version":"v1","source":"https://github.com/luben/zstd-jni/commit/3216860eea289fbbae0b191c0a4fd8b72dad949c","target":{"file":"src/main/native/jni_zstd.c","function":"Java_com_github_luben_zstd_Zstd_decompressedDirectByteBufferSize"}},{"signature_version":"v1","source":"https://github.com/luben/zstd-jni/commit/f38f9a1563113d96d0fc38baee543f7457dd8a8e","target":{"file":"src/main/java/com/github/luben/zstd/BaseZstdBufferDecompressingStreamNoFinalizer.java","function":"setDict"},"deprecated":false,"digest":{"function_hash":"319641253589214927682691714920742633531","length":197},"id":"CVE-2026-87877-e4d70bd4","signature_type":"Function"},{"deprecated":false,"digest":{"function_hash":"169309054857599887673336342145114688531","length":278},"id":"CVE-2026-87877-f5aa3ca4","signature_type":"Function","signature_version":"v1","source":"https://github.com/luben/zstd-jni/commit/393d7311766abbc285b149302c0fe1f94b16d555","target":{"file":"src/main/java/com/github/luben/zstd/ZstdInputStreamNoFinalizer.java","function":"setDict"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/luben/zstd-jni/commit/393d7311766abbc285b149302c0fe1f94b16d555","target":{"file":"src/main/java/com/github/luben/zstd/ZstdInputStreamNoFinalizer.java","function":"close"},"deprecated":false,"digest":{"length":172,"function_hash":"233600532191171171471086635846812889960"},"id":"CVE-2026-87877-f9d2726e"}],"vanir_signatures_modified":"2026-10-28T11:00:51Z","source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-87877.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N"}]}