CyberRota Analysis
AI-GeneratedThe zstd-jni library prior to version 1.5.7-14 is vulnerable due to inadequate validation of buffer capacities in the Zstd.trainFromBufferDirect function, allowing attackers to exploit oversized sample lengths. This can lead to out-of-bounds memory access, potentially causing JVM termination and resulting in denial of service. Organizations utilizing this library should prioritize updating to the latest version to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
zstd-jni before 1.5.7-14 fails to validate the samples buffer capacity in Zstd.trainFromBufferDirect, allowing attackers to read past buffer boundaries by supplying oversized per-sample lengths. Attackers can trigger out-of-bounds memory access by providing crafted sample length arrays that cause the native implementation to walk past the buffer allocation, resulting in JVM termination.