Vulnerability-Lookup

GHSA-MWQ5-V3W5-QR6V

Vulnerability from github – Published: 2026-09-09 15:35 – Updated: 2026-09-09 15:35

Details

zstd-jni versions before 1.5.7-14 fail to validate closed state in setDict, setLongMax, setLevel and setRefMultipleDDicts methods of stream classes. Attackers can call these methods on closed streams to write through freed native pointers, corrupting unrelated objects or crashing the JVM.

Severity

7.7 (High)


                  
                    CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

7.0 (High)


                  
                    CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-87877"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-09T15:17:28Z",
    "severity": "HIGH"
  },
  "details": "zstd-jni versions before 1.5.7-14 fail to validate closed state in setDict, setLongMax, setLevel and setRefMultipleDDicts methods of stream classes. Attackers can call these methods on closed streams to write through freed native pointers, corrupting unrelated objects or crashing the JVM.",
  "id": "GHSA-mwq5-v3w5-qr6v",
  "modified": "2026-09-09T15:35:16Z",
  "published": "2026-09-09T15:35:16Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/luben/zstd-jni/security/advisories/GHSA-2jw3-mg7f-vw4q"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87877"
    },
    {
      "type": "WEB",
      "url": "https://github.com/luben/zstd-jni/commit/0827ed02551bbd8d6f8e4bbff99d83bf50f91938"
    },
    {
      "type": "WEB",
      "url": "https://github.com/luben/zstd-jni/commit/393d7311766abbc285b149302c0fe1f94b16d555"
    },
    {
      "type": "WEB",
      "url": "https://github.com/luben/zstd-jni/commit/f38f9a1563113d96d0fc38baee543f7457dd8a8e"
    },
    {
      "type": "WEB",
      "url": "https://github.com/luben/zstd-jni"
    },
    {
      "type": "WEB",
      "url": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/BaseZstdBufferDecompressingStreamNoFinalizer.java"
    },
    {
      "type": "WEB",
      "url": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/ZstdInputStreamNoFinalizer.java"
    },
    {
      "type": "WEB",
      "url": "https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/zstd-jni-1.3.8-4-through-1.5.7-13-use-after-free-via-setters-called-after-close"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

CVE-2026-87877 (GCVE-0-2026-87877)

Vulnerability from cvelistv5 – Published: 2026-09-09 14:32 – Updated: 2026-09-09 15:57

Title

zstd-jni 1.3.8-4 through 1.5.7-13 Use-After-Free via Setters Called After close()

Summary

Severity

7 (High)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

7.7 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-09 15:57 UTC

CWE

CWE-416 - Use After Free

Assigner

VulnCheck mitre root

References

9 references

URL	Tags
https://github.com/luben/zstd-jni/security/adviso…	vendor-advisory
https://github.com/luben/zstd-jni/commit/f38f9a15…	patch
https://github.com/luben/zstd-jni/commit/393d7311…	patch
https://github.com/luben/zstd-jni/blob/v1.5.7-13/…	technical-description
https://github.com/luben/zstd-jni/blob/v1.5.7-13/…	technical-description
https://github.com/luben/zstd-jni/releases/tag/v1…	release-notes
https://github.com/luben/zstd-jni/commit/0827ed02…	technical-descriptionpatch
https://github.com/luben/zstd-jni	product
https://www.vulncheck.com/advisories/zstd-jni-1.3…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
luben	zstd-jni	Affected: 1.3.8-4 , < 1.5.7-14 (custom)

Date Public

2026-08-19 00:00

Credits

Yu Bao, PayPal Cyber Security Team

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-87877",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-09T15:57:38.917828Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-09T15:57:53.652Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/luben/zstd-jni/security/advisories/GHSA-2jw3-mg7f-vw4q"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo1.maven.org/maven2/com/github/luben/zstd-jni/",
          "defaultStatus": "unaffected",
          "packageURL": "pkg:maven/com.github.luben/zstd-jni",
          "product": "zstd-jni",
          "repo": "https://github.com/luben/zstd-jni",
          "vendor": "luben",
          "versions": [
            {
              "lessThan": "1.5.7-14",
              "status": "affected",
              "version": "1.3.8-4",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Yu Bao, PayPal Cyber Security Team"
        }
      ],
      "datePublic": "2026-08-19T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "zstd-jni versions before 1.5.7-14 fail to validate closed state in setDict, setLongMax, setLevel and setRefMultipleDDicts methods of stream classes. Attackers can call these methods on closed streams to write through freed native pointers, corrupting unrelated objects or crashing the JVM."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-416",
              "description": "Use After Free",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T14:32:45.512Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-2jw3-mg7f-vw4q)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/luben/zstd-jni/security/advisories/GHSA-2jw3-mg7f-vw4q"
        },
        {
          "name": "Fix commit: closed-state guards on BaseZstdBufferDecompressingStreamNoFinalizer",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/luben/zstd-jni/commit/f38f9a1563113d96d0fc38baee543f7457dd8a8e"
        },
        {
          "name": "Fix commit: closed-state guards on the input and output stream setters",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/luben/zstd-jni/commit/393d7311766abbc285b149302c0fe1f94b16d555"
        },
        {
          "name": "Setters without the closed-state guard that readInternal already has, at v1.5.7-13",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/BaseZstdBufferDecompressingStreamNoFinalizer.java"
        },
        {
          "name": "final stream handle retained after close at v1.5.7-13",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/ZstdInputStreamNoFinalizer.java"
        },
        {
          "name": "zstd-jni v1.5.7-14 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14"
        },
        {
          "name": "Commit that made setDict write through the retained native stream handle (first released in 1.3.8-4)",
          "tags": [
            "technical-description",
            "patch"
          ],
          "url": "https://github.com/luben/zstd-jni/commit/0827ed02551bbd8d6f8e4bbff99d83bf50f91938"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/luben/zstd-jni"
        },
        {
          "name": "VulnCheck Advisory: zstd-jni 1.3.8-4 through 1.5.7-13 Use-After-Free via Setters Called After close()",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/zstd-jni-1.3.8-4-through-1.5.7-13-use-after-free-via-setters-called-after-close"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "zstd-jni 1.3.8-4 through 1.5.7-13 Use-After-Free via Setters Called After close()",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-87877",
    "datePublished": "2026-09-09T14:32:45.512Z",
    "dateReserved": "2026-09-09T14:02:07.708Z",
    "dateUpdated": "2026-09-09T15:57:53.652Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

GHSA-MWQ5-V3W5-QR6V

CVE-2026-87877 (GCVE-0-2026-87877)

Tags

Sightings

Nomenclature