CyberRota Analysis
AI-GeneratedThe vulnerability in zstd-jni versions prior to 1.5.7-14 allows attackers to manipulate offset and length parameters in the ZstdDictCompress constructor, leading to out-of-bounds memory reads and potential JVM crashes. This poses a significant risk to applications relying on this library, particularly those handling untrusted input. Organizations utilizing affected versions should prioritize patching to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
zstd-jni versions before 1.5.7-14 fail to validate offset and length parameters in the ZstdDictCompress constructor, allowing out-of-bounds memory reads. Attackers can supply untrusted offset or length values to read native heap memory into the compression dictionary, typically causing JVM crashes.