{"id":"CVE-2026-90852","summary":"luben zstd-jni Dictionary Sharing ZstdCompressCtx.java ZstdCompressCtx.loadDict use after free","details":"A vulnerability has been found in luben zstd-jni up to 1.5.7-13. This vulnerability affects the function ZstdCompressCtx.loadDict of the file ZstdCompressCtx.java of the component Dictionary Sharing. Such manipulation leads to use after free. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.5.7-14 is able to resolve this issue. The name of the patch is a560131d7834598afd9cea6b7c107bc88e915936. The affected component should be upgraded. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.","modified":"2026-09-16T08:17:51.741298Z","published":"2026-09-15T02:15:10.581Z","database_specific":{"cna_assigner":"VulDB","cwe_ids":["CWE-119","CWE-416"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90852.json"},"references":[{"type":"WEB","url":"https://github.com/luben/zstd-jni/"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90852.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90852"},{"type":"ADVISORY","url":"https://vuldb.com/cve/CVE-2026-90852"},{"type":"ADVISORY","url":"https://vuldb.com/submit/927022"},{"type":"ADVISORY","url":"https://vuldb.com/vuln/403407"},{"type":"REPORT","url":"https://github.com/luben/zstd-jni/issues/404"},{"type":"REPORT","url":"https://vuldb.com/vuln/403407/cti"},{"type":"FIX","url":"https://github.com/luben/zstd-jni/commit/a560131d7834598afd9cea6b7c107bc88e915936"},{"type":"FIX","url":"https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/luben/zstd-jni","events":[{"introduced":"ff385b2f3c6a6911d993871faa077b1e89472509"},{"fixed":"a560131d7834598afd9cea6b7c107bc88e915936"},{"fixed":"3216860eea289fbbae0b191c0a4fd8b72dad949c"}],"database_specific":{"extracted_events":[{"introduced":"1.5.7-13"},{"last_affected":"1.5.7-13"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["1.5.7-13","v1.5.7-13"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90852.json","vanir_signatures_modified":"2026-09-16T08:17:51Z","vanir_signatures":[{"signature_version":"v1","source":"https://github.com/luben/zstd-jni/commit/a560131d7834598afd9cea6b7c107bc88e915936","target":{"file":"src/main/java/com/github/luben/zstd/AutoCloseBase.java","function":"close"},"deprecated":false,"digest":{"function_hash":"190147110216752547001541311880895833985","length":251},"id":"CVE-2026-90852-003414d9","signature_type":"Function"},{"deprecated":false,"digest":{"line_hashes":["161442349170517410975110200001437080366","34066592231648300388012511974350997280","149878935130217235484992852517420170442","14489918499017478692436695058216837599","102529647872444511022977464566886577860","204173721983341373199023463655430218400","71750960482462487845070512801316410737","73994977889459442019726037972305165724","166439450379177523341797433072885033922","2321744072256897609445875126644834418","274684629168077416965930330418719862976","167598862179787924031126411196899973284","165143370215310043683527592902238379606","250507336186916882454769835270231595569","115722371557252704448826442811121030868","325336442386345097317127578185425001982","304029479862755887940608523547194834319"],"threshold":0.9},"id":"CVE-2026-90852-2ec8a5d3","signature_type":"Line","signature_version":"v1","source":"https://github.com/luben/zstd-jni/commit/a560131d7834598afd9cea6b7c107bc88e915936","target":{"file":"src/main/java/com/github/luben/zstd/ZstdCompressCtx.java"}},{"deprecated":false,"digest":{"function_hash":"328157868163181307328445428323764355688","length":250},"id":"CVE-2026-90852-306bb948","signature_type":"Function","signature_version":"v1","source":"https://github.com/luben/zstd-jni/commit/a560131d7834598afd9cea6b7c107bc88e915936","target":{"file":"src/main/java/com/github/luben/zstd/ZstdDecompressCtx.java","function":"loadDict"}},{"id":"CVE-2026-90852-44dbbae1","signature_type":"Function","signature_version":"v1","source":"https://github.com/luben/zstd-jni/commit/3216860eea289fbbae0b191c0a4fd8b72dad949c","target":{"file":"src/main/native/jni_zstd.c","function":"Java_com_github_luben_zstd_Zstd_getDirectByteBufferFrameContentSize"},"deprecated":false,"digest":{"function_hash":"319696483832917712384682231278816072707","length":525}},{"signature_version":"v1","source":"https://github.com/luben/zstd-jni/commit/a560131d7834598afd9cea6b7c107bc88e915936","target":{"file":"src/main/java/com/github/luben/zstd/ZstdDecompressCtx.java","function":"loadDict"},"deprecated":false,"digest":{"function_hash":"198858719754160435256025354825199669103","length":358},"id":"CVE-2026-90852-6ed17a86","signature_type":"Function"},{"source":"https://github.com/luben/zstd-jni/commit/a560131d7834598afd9cea6b7c107bc88e915936","target":{"file":"src/main/java/com/github/luben/zstd/AutoCloseBase.java"},"deprecated":false,"digest":{"line_hashes":["325848314404767575448177659153994759371","308164802813736960358326615538514376149","336800683607140354884145845853333536410","136862124148506201364395468491931013019","156010357011589465839511529595621431277","90721868715716227756565022619962552461","231906223912055913280100289763112445042"],"threshold":0.9},"id":"CVE-2026-90852-a17b71a7","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"105418031180568436561605237360893120005","length":248},"id":"CVE-2026-90852-b0d3efbc","signature_type":"Function","signature_version":"v1","source":"https://github.com/luben/zstd-jni/commit/a560131d7834598afd9cea6b7c107bc88e915936","target":{"file":"src/main/java/com/github/luben/zstd/ZstdCompressCtx.java","function":"loadDict"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/luben/zstd-jni/commit/a560131d7834598afd9cea6b7c107bc88e915936","target":{"file":"src/main/java/com/github/luben/zstd/ZstdCompressCtx.java","function":"reset"},"deprecated":false,"digest":{"function_hash":"317819965980214417522013486171429917251","length":188},"id":"CVE-2026-90852-bbbff220"},{"deprecated":false,"digest":{"function_hash":"224169055303276845043143090851841994253","length":356},"id":"CVE-2026-90852-bf00cc62","signature_type":"Function","signature_version":"v1","source":"https://github.com/luben/zstd-jni/commit/a560131d7834598afd9cea6b7c107bc88e915936","target":{"file":"src/main/java/com/github/luben/zstd/ZstdCompressCtx.java","function":"loadDict"}},{"source":"https://github.com/luben/zstd-jni/commit/3216860eea289fbbae0b191c0a4fd8b72dad949c","target":{"file":"src/main/native/jni_zstd.c"},"deprecated":false,"digest":{"line_hashes":["242983979289756636978174893894911169283","157823411836278810979700492519583258858","47982388172284482667079231190836641912","142002538935986523140505977783435642687","70654406038950244899492554068964697791","256841266079176367404669460587415964017","136130365917502750732790875301653462261","307914870517560413069750160813139035083","70654406038950244899492554068964697791","256841266079176367404669460587415964017","136130365917502750732790875301653462261","307914870517560413069750160813139035083"],"threshold":0.9},"id":"CVE-2026-90852-cf1cd55a","signature_type":"Line","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/luben/zstd-jni/commit/a560131d7834598afd9cea6b7c107bc88e915936","target":{"file":"src/main/java/com/github/luben/zstd/ZstdDecompressCtx.java"},"deprecated":false,"digest":{"line_hashes":["102179456491904215421698423585885015796","32335867105913514308747802087599078895","139953312440772806941413198688371476165","255039249674977730051025106979345647165","2370970884887731348856709940058136513","204173721983341373199023463655430218400","71750960482462487845070512801316410737","73994977889459442019726037972305165724","166439450379177523341797433072885033922","36214007193820069521236162943145989645","163277444106301793367642982818369474375","144585875173241693785061221670898125417","160596219251967169029481648813620531699","250507336186916882454769835270231595569","115722371557252704448826442811121030868","325336442386345097317127578185425001982","304029479862755887940608523547194834319"],"threshold":0.9},"id":"CVE-2026-90852-dced2015","signature_type":"Line"},{"deprecated":false,"digest":{"length":503,"function_hash":"6130561471615133004258603361745015963"},"id":"CVE-2026-90852-e402cad3","signature_type":"Function","signature_version":"v1","source":"https://github.com/luben/zstd-jni/commit/3216860eea289fbbae0b191c0a4fd8b72dad949c","target":{"function":"Java_com_github_luben_zstd_Zstd_findDirectByteBufferFrameCompressedSize","file":"src/main/native/jni_zstd.c"}},{"id":"CVE-2026-90852-e43e017d","signature_type":"Function","signature_version":"v1","source":"https://github.com/luben/zstd-jni/commit/3216860eea289fbbae0b191c0a4fd8b72dad949c","target":{"file":"src/main/native/jni_zstd.c","function":"Java_com_github_luben_zstd_Zstd_decompressedDirectByteBufferSize"},"deprecated":false,"digest":{"function_hash":"243452810049814927721413726162029308560","length":552}},{"deprecated":false,"digest":{"function_hash":"317819965980214417522013486171429917251","length":188},"id":"CVE-2026-90852-f27ede27","signature_type":"Function","signature_version":"v1","source":"https://github.com/luben/zstd-jni/commit/a560131d7834598afd9cea6b7c107bc88e915936","target":{"file":"src/main/java/com/github/luben/zstd/ZstdDecompressCtx.java","function":"reset"}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}]}