CVE-2026-90560: zstd-jni Buffer Overflow Vulnerability

CVE-2026-90560 Overview

CVE-2026-90560 is an out-of-bounds read vulnerability in zstd-jni, the Java Native Interface bindings for the Zstandard compression library. Versions 1.2.0 through 1.5.7-13 fail to validate the offset and length arguments passed to the ZstdDictDecompress constructor against the bounds of the supplied dictionary byte array. An attacker who controls these parameters can read memory beyond the dictionary buffer, which can terminate the Java Virtual Machine (JVM). The flaw is tracked as CWE-125: Out-of-bounds Read.

Critical Impact

Applications passing untrusted offset or length values into ZstdDictDecompress can be forced into JVM termination, resulting in denial of service for any service depending on the affected library.

Affected Products

• zstd-jni version 1.2.0 (initial affected release)
• zstd-jni versions 1.2.1 through 1.5.7-13
• Java applications that instantiate ZstdDictDecompress with attacker-influenced offset or length values

Discovery Timeline

• 2026-09-12 - CVE-2026-90560 published to NVD
• 2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-90560

Vulnerability Analysis

The vulnerability resides in the ZstdDictDecompress(byte[] dict, int offset, int length) constructor in src/main/java/com/github/luben/zstd/ZstdDictDecompress.java. The constructor forwarded the caller-supplied offset and length directly to the native init method without checking them against dict.length. When the native decompressor read from dict + offset for length bytes, it accessed memory outside the Java array's backing region.

Because the read occurs in native code invoked through JNI, the resulting fault is not caught as a Java exception. Instead, it produces a fatal error that terminates the JVM. Any long-running server that constructs a ZstdDictDecompress from untrusted input is exposed to a reliable denial-of-service condition.

Root Cause

The root cause is missing input validation on public constructor arguments. Negative values, oversized length, or an offset that exceeds dict.length - length were all accepted. Argument validation is the responsibility of the Java wrapper because the native libzstd code trusts the region descriptor it receives from the JNI layer.

Attack Vector

Exploitation requires that an attacker influence the offset or length parameters, or the size of the dict array, passed to ZstdDictDecompress. This condition arises in services that accept compressed payloads or dictionary metadata over the network and decode them using zstd-jni. Triggering the out-of-bounds read causes an immediate JVM crash and interrupts availability of any co-hosted workloads.

     * @param length number of bytes to use from the buffer
     */
    public ZstdDictDecompress(byte @NotNull [] dict, int offset, int length) {
+       if (offset < 0 || length < 0 || offset > dict.length - length) {
+           throw new IllegalArgumentException("Invalid offset/length for dictionary buffer");
+       }

        init(dict, offset, length);

Source: GitHub Commit b74ab242. The patch adds the missing bounds check before delegating to the native init routine.

Detection Methods for CVE-2026-90560

Indicators of Compromise

• Unexpected JVM termination logs referencing libzstd-jni or com.github.luben.zstd frames in hs_err_pid*.log crash dumps
• SIGSEGV or EXCEPTION_ACCESS_VIOLATION signals originating from native stack frames inside ZstdDictDecompress
• Repeated container or service restarts correlated with inbound Zstandard-compressed payloads

Detection Strategies

• Inventory Java dependencies with software composition analysis (SCA) tooling and flag any com.github.luben:zstd-jni version between 1.2.0 and 1.5.7-13
• Search source repositories for calls to new ZstdDictDecompress(...) where offset or length originate from network-sourced data
• Correlate application crash telemetry with request logs to identify malformed dictionary inputs preceding JVM exits

Monitoring Recommendations

• Ingest JVM hotspot error logs into a central logging pipeline and alert on native crashes referencing zstd
• Track process restart counts on services that handle user-supplied compressed data and alert on abnormal spikes
• Monitor build pipelines to prevent regression to vulnerable zstd-jni releases

How to Mitigate CVE-2026-90560

Immediate Actions Required

• Upgrade zstd-jni to release v1.5.7-14 or later
• Audit application code paths that construct ZstdDictDecompress from untrusted input and add explicit bounds checks as defense in depth
• Restart affected services after upgrading to ensure the patched native library is loaded

Patch Information

The fix is applied in commit b74ab242 and shipped in release v1.5.7-14. The patch introduces argument validation that throws IllegalArgumentException when offset is negative, length is negative, or offset exceeds dict.length - length. See the upstream discussion in GitHub Issue #405 and the VulnCheck Advisory for zstd-jni.

Workarounds

• Wrap all ZstdDictDecompress construction in application-side validation that rejects out-of-range offset and length values before invoking the constructor
• Reject compressed payloads from untrusted sources until the library is upgraded
• Isolate services that decode Zstandard dictionaries into restart-tolerant containers to limit the availability impact of a triggered crash

# Maven: pin the patched release
mvn versions:use-dep-version \
    -Dincludes=com.github.luben:zstd-jni \
    -DdepVersion=1.5.7-14 \
    -DforceVersion=true

# Gradle: enforce the patched version
# dependencies { implementation("com.github.luben:zstd-jni:1.5.7-14") }