What’s Vulnerable › Vulnerabilities

CVE-2026-87877: zstd-jni 1.3.8-4 through 1.5.7-13 Use-After-Free via Setters Called After close()

• Severity: high (CVSS 7.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-09 · updated 2026-09-09
• Weakness: CWE-416

Description

zstd-jni versions before 1.5.7-14 fail to validate closed state in setDict, setLongMax, setLevel and setRefMultipleDDicts methods of stream classes. Attackers can call these methods on closed streams to write through freed native pointers, corrupting unrelated objects or crashing the JVM.

Affected products

• luben zstd-jni: from 1.3.8-4 before 1.5.7-14 — fixed in 1.5.7-14

How to fix

Upgrade to a fixed version: luben zstd-jni 1.5.7-14. Check the vendor advisory for mitigations.

References

• https://github.com/luben/zstd-jni
• https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/BaseZstdBufferDecompressingStreamNoFinalizer.java
• https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/ZstdInputStreamNoFinalizer.java
• https://github.com/luben/zstd-jni/commit/0827ed02551bbd8d6f8e4bbff99d83bf50f91938
• https://github.com/luben/zstd-jni/commit/393d7311766abbc285b149302c0fe1f94b16d555
• https://github.com/luben/zstd-jni/commit/f38f9a1563113d96d0fc38baee543f7457dd8a8e
• https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14
• https://github.com/luben/zstd-jni/security/advisories/GHSA-2jw3-mg7f-vw4q
• https://www.vulncheck.com/advisories/zstd-jni-1.3.8-4-through-1.5.7-13-use-after-free-via-setters-called-after-close
• https://github.com/luben/zstd-jni/security/advisories/GHSA-2jw3-mg7f-vw4q

Get alerted when CVE-2026-87877 or the next vulnerability affects your stack