zstd-jni versions 1.4.8-4 through 1.5.7-13 fail to validate negative length parameters in ZstdInputStreamNoFinalizer.read(), allowing attackers to tri...

原文の説明

取得元が公開している説明をそのまま載せています (多くは英語)。

zstd-jni versions 1.4.8-4 through 1.5.7-13 fail to validate negative length parameters in ZstdInputStreamNoFinalizer.read(), allowing attackers to trigger infinite loops. Attackers can pass negative length values to cause the read method to spin indefinitely while holding the stream monitor, blocking all other threads from accessing the stream.

出典: OSV.dev (Open Source Vulnerabilities) OSV

影響パッケージ

Ubuntu:24.04:LTS zstd-jni-java

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Ubuntu:26.10 zstd-jni-java

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Ubuntu:26.04:LTS zstd-jni-java

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

参照URL

report ubuntu.com
report cve.org
report github.com