zstd-jni-java - Debian Package Tracker

general

source: zstd-jni-java (main)
version: 1.5.2-5+ds-8
maintainer: Debian Java Maintainers (archive) (DMD)
uploaders: Olek Wojnar [DMD]
arch: all any
std-ver: 4.7.2
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

oldstable: 1.5.2-5+ds-3
stable: 1.5.2-5+ds-7
testing: 1.5.2-5+ds-8
unstable: 1.5.2-5+ds-8
exp: 1.5.4-2+ds-3~exp4

versioned links

1.5.2-5+ds-3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.5.2-5+ds-7: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.5.2-5+ds-8: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.5.4-2+ds-3~exp4: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

libzstd-jni-java
libzstd-jni1

action needed

Marked for autoremoval on 25 October: #1147397 high

Version 1.5.2-5+ds-8 of zstd-jni-java is marked for autoremoval from testing on Sun 25 Oct 2026. It is affected by #1147397. The removal of zstd-jni-java will also cause the removal of (transitive) reverse dependencies: apache-jena, bazel-bootstrap, bazel-java-tools, bazel-stardoc, bidi-clojure, clout-clojure, comidi-clojure, compojure-clojure, httpcomponents-client5, libodfdom-java, libowasp-antisamy-java, librdfa-java, libthrift-java, ring-anti-forgery-clojure, ring-defaults-clojure, ring-headers-clojure, ring-mock-clojure, ring-ssl-clojure. You should try to prevent the removal by fixing these RC bugs.

Created: 2026-09-18 Last update: 2026-09-21 22:03

A new upstream version is available: 1.5.7-16 high

A new upstream version 1.5.7-16 is available, you should consider packaging it.

Created: 2026-03-15 Last update: 2026-09-21 20:01

9 security issues in sid high

There are 9 open security issues in sid.

9 important issues:

CVE-2026-87795: zstd-jni versions before 1.5.7-14 fail to validate offset and length parameters in the ZstdDictCompress constructor, allowing out-of-bounds memory reads. Attackers can supply untrusted offset or length values to read native heap memory into the compression dictionary, typically causing JVM crashes.
CVE-2026-87823: zstd-jni before 1.5.7-14 performs 32-bit signed bounds checks on three direct-ByteBuffer frame-size native methods, allowing out-of-bounds memory reads via negative or overflowing offsets. Attackers can supply negative offset values near Integer.MIN_VALUE to read unmapped memory, causing JVM termination or extracting arbitrary frame size data from unintended memory locations.
CVE-2026-87824: zstd-jni before 1.5.7-14 fails to validate the samples buffer capacity in Zstd.trainFromBufferDirect, allowing attackers to read past buffer boundaries by supplying oversized per-sample lengths. Attackers can trigger out-of-bounds memory access by providing crafted sample length arrays that cause the native implementation to walk past the buffer allocation, resulting in JVM termination.
CVE-2026-87825: zstd-jni before 1.5.7-14 contains a use-after-free vulnerability where streams and contexts hold a dictionary's shared lock only during the load call, allowing the dictionary to be closed while still referenced. Attackers can close a dictionary after associating it with a stream or context, causing subsequent read or write operations to access freed native memory, resulting in silent data corruption or JVM crashes.
CVE-2026-87877: zstd-jni versions before 1.5.7-14 fail to validate closed state in setDict, setLongMax, setLevel and setRefMultipleDDicts methods of stream classes. Attackers can call these methods on closed streams to write through freed native pointers, corrupting unrelated objects or crashing the JVM.
CVE-2026-89045: zstd-jni versions 1.4.8-4 through 1.5.7-13 fail to validate negative length parameters in ZstdInputStreamNoFinalizer.read(), allowing attackers to trigger infinite loops. Attackers can pass negative length values to cause the read method to spin indefinitely while holding the stream monitor, blocking all other threads from accessing the stream.
CVE-2026-89046: zstd-jni versions 1.5.5-6 through 1.5.7-13 contain an out-of-bounds read vulnerability in Zstd.getFrameContentSize that fails to validate negative srcPosition arguments. Attackers can supply negative offset values that bypass bounds checks and reach the native frame-header parser, causing out-of-bounds memory reads that lead to information disclosure or JVM crashes.
CVE-2026-90560: zstd-jni versions 1.2.0 through 1.5.7-13 contain an out-of-bounds read vulnerability in the ZstdDictDecompress constructor because offset and length arguments are never validated against the dictionary array bounds. Attackers can supply arbitrary offset or length values to read memory past the end of the supplied array, potentially causing JVM termination.
CVE-2026-90852: A vulnerability has been found in luben zstd-jni up to 1.5.7-13. This vulnerability affects the function ZstdCompressCtx.loadDict of the file ZstdCompressCtx.java of the component Dictionary Sharing. Such manipulation leads to use after free. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.5.7-14 is able to resolve this issue. The name of the patch is a560131d7834598afd9cea6b7c107bc88e915936. The affected component should be upgraded. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Created: 2026-09-09 Last update: 2026-09-19 21:00

9 security issues in forky high

There are 9 open security issues in forky.

9 important issues:

CVE-2026-87795: zstd-jni versions before 1.5.7-14 fail to validate offset and length parameters in the ZstdDictCompress constructor, allowing out-of-bounds memory reads. Attackers can supply untrusted offset or length values to read native heap memory into the compression dictionary, typically causing JVM crashes.
CVE-2026-87823: zstd-jni before 1.5.7-14 performs 32-bit signed bounds checks on three direct-ByteBuffer frame-size native methods, allowing out-of-bounds memory reads via negative or overflowing offsets. Attackers can supply negative offset values near Integer.MIN_VALUE to read unmapped memory, causing JVM termination or extracting arbitrary frame size data from unintended memory locations.
CVE-2026-87824: zstd-jni before 1.5.7-14 fails to validate the samples buffer capacity in Zstd.trainFromBufferDirect, allowing attackers to read past buffer boundaries by supplying oversized per-sample lengths. Attackers can trigger out-of-bounds memory access by providing crafted sample length arrays that cause the native implementation to walk past the buffer allocation, resulting in JVM termination.
CVE-2026-87825: zstd-jni before 1.5.7-14 contains a use-after-free vulnerability where streams and contexts hold a dictionary's shared lock only during the load call, allowing the dictionary to be closed while still referenced. Attackers can close a dictionary after associating it with a stream or context, causing subsequent read or write operations to access freed native memory, resulting in silent data corruption or JVM crashes.
CVE-2026-87877: zstd-jni versions before 1.5.7-14 fail to validate closed state in setDict, setLongMax, setLevel and setRefMultipleDDicts methods of stream classes. Attackers can call these methods on closed streams to write through freed native pointers, corrupting unrelated objects or crashing the JVM.
CVE-2026-89045: zstd-jni versions 1.4.8-4 through 1.5.7-13 fail to validate negative length parameters in ZstdInputStreamNoFinalizer.read(), allowing attackers to trigger infinite loops. Attackers can pass negative length values to cause the read method to spin indefinitely while holding the stream monitor, blocking all other threads from accessing the stream.
CVE-2026-89046: zstd-jni versions 1.5.5-6 through 1.5.7-13 contain an out-of-bounds read vulnerability in Zstd.getFrameContentSize that fails to validate negative srcPosition arguments. Attackers can supply negative offset values that bypass bounds checks and reach the native frame-header parser, causing out-of-bounds memory reads that lead to information disclosure or JVM crashes.
CVE-2026-90560: zstd-jni versions 1.2.0 through 1.5.7-13 contain an out-of-bounds read vulnerability in the ZstdDictDecompress constructor because offset and length arguments are never validated against the dictionary array bounds. Attackers can supply arbitrary offset or length values to read memory past the end of the supplied array, potentially causing JVM termination.
CVE-2026-90852: A vulnerability has been found in luben zstd-jni up to 1.5.7-13. This vulnerability affects the function ZstdCompressCtx.loadDict of the file ZstdCompressCtx.java of the component Dictionary Sharing. Such manipulation leads to use after free. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.5.7-14 is able to resolve this issue. The name of the patch is a560131d7834598afd9cea6b7c107bc88e915936. The affected component should be upgraded. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Created: 2026-09-09 Last update: 2026-09-19 21:00

The VCS repository is not up to date, push the missing commits. high

vcswatch reports that the current version of the package is not in its VCS.
Either you need to push your commits and/or your tags, or the information about the package's VCS are out of date. A common cause of the latter issue when using the Git VCS is not specifying the correct branch when the packaging is not in the default one (remote HEAD branch), which is usually "master" but can be modified in salsa.debian.org in the project's general settings with the "Default Branch" field). Alternatively the Vcs-Git field in debian/control can contain a "-b <branch-name>" suffix to indicate what branch is used for the Debian packaging.

https://salsa.debian.org/api/v4/projects/java-team%2Fzstd-jni-java API request failed: 401 Unauthorized at /srv/qa.debian.org/data/vcswatch/vcswatch line 410.

Created: 2025-03-22 Last update: 2026-09-17 22:19

9 low-priority security issues in trixie low

There are 9 open security issues in trixie.

9 issues left for the package maintainer to handle:

CVE-2026-87795: (needs triaging) zstd-jni versions before 1.5.7-14 fail to validate offset and length parameters in the ZstdDictCompress constructor, allowing out-of-bounds memory reads. Attackers can supply untrusted offset or length values to read native heap memory into the compression dictionary, typically causing JVM crashes.
CVE-2026-87823: (needs triaging) zstd-jni before 1.5.7-14 performs 32-bit signed bounds checks on three direct-ByteBuffer frame-size native methods, allowing out-of-bounds memory reads via negative or overflowing offsets. Attackers can supply negative offset values near Integer.MIN_VALUE to read unmapped memory, causing JVM termination or extracting arbitrary frame size data from unintended memory locations.
CVE-2026-87824: (needs triaging) zstd-jni before 1.5.7-14 fails to validate the samples buffer capacity in Zstd.trainFromBufferDirect, allowing attackers to read past buffer boundaries by supplying oversized per-sample lengths. Attackers can trigger out-of-bounds memory access by providing crafted sample length arrays that cause the native implementation to walk past the buffer allocation, resulting in JVM termination.
CVE-2026-87825: (needs triaging) zstd-jni before 1.5.7-14 contains a use-after-free vulnerability where streams and contexts hold a dictionary's shared lock only during the load call, allowing the dictionary to be closed while still referenced. Attackers can close a dictionary after associating it with a stream or context, causing subsequent read or write operations to access freed native memory, resulting in silent data corruption or JVM crashes.
CVE-2026-87877: (needs triaging) zstd-jni versions before 1.5.7-14 fail to validate closed state in setDict, setLongMax, setLevel and setRefMultipleDDicts methods of stream classes. Attackers can call these methods on closed streams to write through freed native pointers, corrupting unrelated objects or crashing the JVM.
CVE-2026-89045: (needs triaging) zstd-jni versions 1.4.8-4 through 1.5.7-13 fail to validate negative length parameters in ZstdInputStreamNoFinalizer.read(), allowing attackers to trigger infinite loops. Attackers can pass negative length values to cause the read method to spin indefinitely while holding the stream monitor, blocking all other threads from accessing the stream.
CVE-2026-89046: (needs triaging) zstd-jni versions 1.5.5-6 through 1.5.7-13 contain an out-of-bounds read vulnerability in Zstd.getFrameContentSize that fails to validate negative srcPosition arguments. Attackers can supply negative offset values that bypass bounds checks and reach the native frame-header parser, causing out-of-bounds memory reads that lead to information disclosure or JVM crashes.
CVE-2026-90560: (needs triaging) zstd-jni versions 1.2.0 through 1.5.7-13 contain an out-of-bounds read vulnerability in the ZstdDictDecompress constructor because offset and length arguments are never validated against the dictionary array bounds. Attackers can supply arbitrary offset or length values to read memory past the end of the supplied array, potentially causing JVM termination.
CVE-2026-90852: (needs triaging) A vulnerability has been found in luben zstd-jni up to 1.5.7-13. This vulnerability affects the function ZstdCompressCtx.loadDict of the file ZstdCompressCtx.java of the component Dictionary Sharing. Such manipulation leads to use after free. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.5.7-14 is able to resolve this issue. The name of the patch is a560131d7834598afd9cea6b7c107bc88e915936. The affected component should be upgraded. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

You can find information about how to handle these issues in the security team's documentation.

Created: 2026-09-09 Last update: 2026-09-19 21:00

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.7.4 instead of 4.7.2).

Created: 2025-12-23 Last update: 2026-03-31 15:01

news

[rss feed]

[2026-03-17] zstd-jni-java 1.5.2-5+ds-8 MIGRATED to testing (Debian testing watch)
[2026-03-15] Accepted zstd-jni-java 1.5.2-5+ds-8 (source) into unstable (Vladimir Petko) (signed by: tony mancill)
[2025-05-15] zstd-jni-java 1.5.2-5+ds-7 MIGRATED to testing (Debian testing watch)
[2025-05-04] Accepted zstd-jni-java 1.5.2-5+ds-7 (source) into unstable (Jochen Sprickerhof)
[2025-03-24] zstd-jni-java 1.5.2-5+ds-6 MIGRATED to testing (Debian testing watch)
[2025-03-22] Accepted zstd-jni-java 1.5.2-5+ds-6 (source) into unstable (Olek Wojnar)
[2025-03-22] Accepted zstd-jni-java 1.5.4-2+ds-3~exp4 (source) into experimental (Olek Wojnar)
[2025-03-22] Accepted zstd-jni-java 1.5.4-2+ds-3~exp3 (source) into experimental (Olek Wojnar)
[2025-03-22] Accepted zstd-jni-java 1.5.4-2+ds-3~exp2 (source) into experimental (Olek Wojnar)
[2025-03-22] Accepted zstd-jni-java 1.5.2-5+ds-5 (source) into unstable (Olek Wojnar)
[2025-03-22] Accepted zstd-jni-java 1.5.2-5+ds-4 (source) into unstable (Olek Wojnar)
[2025-03-22] Accepted zstd-jni-java 1.5.4-2+ds-3~exp1 (source) into experimental (Olek Wojnar)
[2024-11-29] zstd-jni-java REMOVED from testing (Debian testing watch)
[2023-04-29] zstd-jni-java 1.5.2-5+ds-3 MIGRATED to testing (Debian testing watch)
[2023-04-08] Accepted zstd-jni-java 1.5.4-2+ds-2 (source) into experimental (Markus Koschany)
[2023-04-08] Accepted zstd-jni-java 1.5.2-5+ds-3 (source) into unstable (Markus Koschany)
[2023-03-22] Accepted zstd-jni-java 1.5.4-2+ds-1 (source) into experimental (tony mancill)
[2022-11-20] zstd-jni-java 1.5.2-5+ds-2 MIGRATED to testing (Debian testing watch)
[2022-11-13] Accepted zstd-jni-java 1.5.2-5+ds-2 (source) into unstable (Olek Wojnar)
[2022-11-12] Accepted zstd-jni-java 1.5.2-5+ds-2~exp1 (source) into experimental (Olek Wojnar)
[2022-11-12] Accepted zstd-jni-java 1.5.2-5+ds-1 (source) into unstable (Olek Wojnar)
[2022-11-11] Accepted zstd-jni-java 1.5.2-5+ds-1~exp3 (source all amd64) into experimental (Debian FTP Masters) (signed by: Olek Wojnar)

bugs [bug history graph]

all: 4
RC: 1
I&N: 2
M&W: 1
F&P: 0
patch: 0

links

homepage
lintian
buildd: logs, exp, reproducibility, cross
popcon
browse source code
other distros
security tracker
debian patches
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 1.5.2-5+ds-8