CVE-2026-90560: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-90560 is an out-of-bounds read vulnerability in the ZstdDictDecompress constructor of the zstd-jni library (JNI bindings for the Zstandard compression algorithm). The flaw exists because the offset and length arguments passed to the constructor are never validated against the bounds of the dictionary byte array, allowing attackers to trigger reads of memory beyond the array's end. It affects zstd-jni versions 1.2.0 through 1.5.7-13 (inclusive), with version 1.5.7-14 being the first patched release. The vulnerability was publicly disclosed on September 12, 2026, and carries a CVSS v3.1 base score of 8.2 (High) (GitHub Advisory, GitHub Issue).

The root cause is CWE-125 (Out-of-bounds Read): the ZstdDictDecompress(byte[] dict, int offset, int length) constructor at lines 49–59 of ZstdDictDecompress.java calls init(dict, offset, length) without any validation of offset or length against dict.length. The JNI function Java_com_github_luben_zstd_ZstdDictDecompress_init in jni_fast_zstd.c then computes ((char *)dict_buff) + dict_offset and passes dict_size bytes to ZSTD_createDDict, which internally calls memmove to copy the specified range — entirely without bounds checking. An attacker who can influence the offset or length parameters (e.g., via a network-facing API that constructs ZstdDictDecompress from user-supplied data) can trigger reads far beyond the allocated array, reaching unmapped memory pages and causing a SIGBUS crash, or reading adjacent heap contents if the read stays within mapped memory (GitHub Issue, Vulnerable Source).

The primary impact is denial of service: supplying a sufficiently large length value (e.g., 80,000,000 bytes against a 4-byte array) reliably causes the JVM to terminate with a SIGBUS signal when the out-of-bounds read reaches an unmapped memory page, making any service relying on the affected library unavailable. A secondary, lower-severity impact is limited memory disclosure: if the out-of-bounds read stays within mapped heap memory, adjacent heap contents (which may include sensitive data) can be silently copied into the dictionary state. This vulnerability does not enable remote code execution or integrity compromise on its own (GitHub Issue, GitHub Advisory).

A public proof-of-concept (PoC) exploit is available on GitHub, consisting of a complete, runnable Java code snippet that reliably reproduces the JVM crash (GitHub Issue). The vulnerability is network-exploitable with no authentication or user interaction required, provided the target application exposes an interface that constructs ZstdDictDecompress with attacker-controlled parameters. The EPSS score is approximately 0.0034 (low probability of near-term exploitation), and there is no evidence of in-the-wild exploitation or CISA KEV catalog inclusion at this time. NVD SSVC assessment classifies the vulnerability as automatable with a PoC exploitation status (GitHub Advisory).

1. Identify a vulnerable target: Locate a network-facing Java application that uses com.github.luben:zstd-jni versions 1.2.0 through 1.5.7-13 and exposes an interface where attacker-controlled data is passed as offset or length to the ZstdDictDecompress(byte[], int, int) constructor.
2. Craft a minimal dictionary array: Prepare a small byte array (e.g., byte[] dict = new byte[4]) to serve as the dictionary buffer.
3. Supply an oversized length parameter: Instantiate ZstdDictDecompress with an out-of-bounds length, e.g., new ZstdDictDecompress(dict, 0, 80_000_000), requesting an 80 MB read from a 4-byte array.
4. Trigger the JNI call: The constructor calls init(dict, 0, 80_000_000) without validation; the JNI function computes dict_buff + 0 and passes 80_000_000 as the size to ZSTD_createDDict.
5. Cause JVM crash or memory read: ZSTD_createDDict internally calls memmove to copy 80 MB starting from the array's base pointer, eventually reaching unmapped memory pages and triggering a SIGBUS (signal 10), which terminates the JVM. If the read stays within mapped memory, adjacent heap data is silently read into the dictionary state.
6. Achieve denial of service: The JVM process terminates, causing a complete service outage for any application hosted in that JVM (GitHub Issue).

• Logs: JVM fatal error log (hs_err_pid<PID>.log) containing SIGBUS (0xa) with a problematic frame referencing _platform_memmove or ZSTD_createDDict_advanced inside libzstd-jni; stack trace showing Java_com_github_luben_zstd_ZstdDictDecompress_init in the native frames.
• Process: Unexpected JVM process termination (crash) with exit code corresponding to SIGBUS; absence of a graceful shutdown log entry.
• File System: Presence of JVM crash dump files (hs_err_pid*.log) in the application working directory or /tmp, containing references to libzstd-jni.dylib or libzstd-jni.so and ZSTD_createDDict_advanced.
• Network: Unusual or repeated requests to application endpoints that accept dictionary-related parameters, particularly with anomalously large integer values for offset or length fields (GitHub Issue).

Upgrade com.github.luben:zstd-jni to version 1.5.7-14 or later, which adds the required bounds check (if (offset < 0 || length < 0 || offset > dict.length - length) throw new IllegalArgumentException(...)) before calling the native init() method (zstd-jni v1.5.7-14 Release, Fix Commit). As a short-term workaround where immediate patching is not possible, add application-level input validation to sanitize offset and length arguments before passing them to ZstdDictDecompress, and apply network-level access controls to restrict who can send requests to services using this library (GitHub Advisory).

A Reddit post in the r/pwnhub community highlighted the vulnerability shortly after disclosure, noting the availability of a PoC and the patch. Red Hat tracked the issue via Bugzilla (bug 2532604) and published a CVE advisory. No significant vendor statements beyond the upstream fix or notable researcher commentary beyond the original issue report have been identified (Red Hat Bugzilla).