zstd-jni 1.3.8-4 through 1.5.7-13 Use-After-Free via Setters Called After close()
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7epss 0.2%
exploitation probability
0.2%top 90% of all CVEs
observed exploitation
nono source reports it
zstd-jni versions before 1.5.7-14 fail to validate closed state in setDict, setLongMax, setLevel and setRefMultipleDDicts methods of stream classes. Attackers can call these methods on closed streams to write through freed native pointers, corrupting unrelated objects or crashing the JVM.
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
luben · zstd-jniReferences
https://github.com/luben/zstd-jnihttps://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/BaseZstdBufferDecompressingStreamNoFinalizer.javahttps://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/ZstdInputStreamNoFinalizer.javahttps://github.com/luben/zstd-jni/commit/0827ed02551bbd8d6f8e4bbff99d83bf50f91938https://github.com/luben/zstd-jni/commit/393d7311766abbc285b149302c0fe1f94b16d555https://github.com/luben/zstd-jni/commit/f38f9a1563113d96d0fc38baee543f7457dd8a8ehttps://github.com/luben/zstd-jni/releases/tag/v1.5.7-14https://github.com/luben/zstd-jni/security/advisories/GHSA-2jw3-mg7f-vw4qhttps://www.vulncheck.com/advisories/zstd-jni-1.3.8-4-through-1.5.7-13-use-after-free-via-setters-called-after-close