CVE-2026-87795
- Source
- https://cve.org/CVERecord?id=CVE-2026-87795
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-87795.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2026-87795
- Aliases
-
- GHSA-ff36-7w3w-g8rm
- Downstream
CLEANSTART (5)
DEBIAN (1)
UBUNTU (1)
- Published
- 2026-09-09T10:07:28Z
- Modified
- 2026-10-15T07:34:12Z
- Severity
-
- 8.8 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- zstd-jni 1.2.0 through 1.5.7-13 Out-of-Bounds Read via ZstdDictCompress
- Details
-
zstd-jni versions before 1.5.7-14 fail to validate offset and length parameters in the ZstdDictCompress constructor, allowing out-of-bounds memory reads. Attackers can supply untrusted offset or length values to read native heap memory into the compression dictionary, typically causing JVM crashes.
- Database specific
{ "cna_assigner": "VulnCheck", "cwe_ids": [ "CWE-125" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/87xxx/CVE-2026-87795.json" }- References
-
- https://repo1.maven.org/maven2/com/github/luben/zstd-jni/
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/87xxx/CVE-2026-87795.json
- https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14
- https://github.com/luben/zstd-jni/security/advisories/GHSA-ff36-7w3w-g8rm
- https://nvd.nist.gov/vuln/detail/CVE-2026-87795
- https://www.vulncheck.com/advisories/zstd-jni-1.2.0-through-1.5.7-13-out-of-bounds-read-via-zstddictcompress
- https://github.com/luben/zstd-jni/commit/0d64de4dee6606ff506be36c7f2e714ad0c80fdb
- https://github.com/luben/zstd-jni/commit/1c4e5a6c3ce8458095225d987d669e6a0937734a
- https://github.com/luben/zstd-jni
- https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/ZstdDictCompress.java
- https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/native/jni_fast_zstd.c
Affected packages
Git / github.com/luben/zstd-jni
Affected ranges
- Type
- GIT
- Repo
- https://github.com/luben/zstd-jni
- Events
- Database specific
-
Show details
{ "extracted_events": [ { "range": [ { "introduced": "1.2.0" }, { "fixed": "1.5.7-14" } ], "source": "AFFECTED_FIELD", "strategy": "StandardRange" }, { "range": [ { "fixed": "0d64de4dee6606ff506be36c7f2e714ad0c80fdb" } ], "source": "REFERENCES_COMMIT" }, { "range": [ { "fixed": "1c4e5a6c3ce8458095225d987d669e6a0937734a" } ], "source": "REFERENCES_COMMIT" }, { "original_tag": "v1.5.7-14", "range": [ { "fixed": "3216860eea289fbbae0b191c0a4fd8b72dad949c" } ], "source": "REFERENCES_TAG" } ] }
Database specific
source
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-87795.json"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"function_hash": "296315882562009165331251339308188686350",
"length": 950
},
"id": "CVE-2026-87795-09b5be6f",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/luben/zstd-jni/commit/1c4e5a6c3ce8458095225d987d669e6a0937734a",
"target": {
"file": "src/main/native/jni_outputstream_zstd.c",
"function": "Java_com_github_luben_zstd_ZstdOutputStream_compressStream"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "71497639941025998658137149744842583845",
"length": 519
},
"id": "CVE-2026-87795-15b33acd",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/luben/zstd-jni/commit/1c4e5a6c3ce8458095225d987d669e6a0937734a",
"target": {
"file": "src/main/native/jni_fast_zstd.c",
"function": "Java_com_github_luben_zstd_ZstdDictDecompress_init"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "191119023894538054696776443774005661461",
"length": 753
},
"id": "CVE-2026-87795-196303e8",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/luben/zstd-jni/commit/1c4e5a6c3ce8458095225d987d669e6a0937734a",
"target": {
"file": "src/main/native/jni_zstd.c",
"function": "Java_com_github_luben_zstd_Zstd_compress"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"186002527345049128151235259683797400754",
"319922103440569431767703440610165512946",
"222633343654351234960097707977500373820",
"290728846606620613009383116587856420582"
],
"threshold": 0.9
},
"id": "CVE-2026-87795-1fc1c924",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/luben/zstd-jni/commit/1c4e5a6c3ce8458095225d987d669e6a0937734a",
"target": {
"file": "src/main/native/jni_inputstream_zstd.c"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "115474370568863010193452150694506108978",
"length": 1086
},
"id": "CVE-2026-87795-21a74a95",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/luben/zstd-jni/commit/1c4e5a6c3ce8458095225d987d669e6a0937734a",
"target": {
"file": "src/main/native/jni_zstd.c",
"function": "Java_com_github_luben_zstd_Zstd_compressDirectByteBufferUsingDict"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "41687338444759206792472060370730912692",
"length": 959
},
"id": "CVE-2026-87795-22745de2",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/luben/zstd-jni/commit/1c4e5a6c3ce8458095225d987d669e6a0937734a",
"target": {
"file": "src/main/native/jni_fast_zstd.c",
"function": "Java_com_github_luben_zstd_Zstd_decompressDirectByteBufferFastDict"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"201810319311124399417167457672172620398",
"213155021943450682333257950915568057852",
"249501662347910373591583543620377532170",
"12015060395273793941819758175352646613",
"5824882579712405223075259412242113625",
"115140588722495800669216504450934842068",
"284774046003259245044807345099075044165",
"225327541096028837129032752269354596086",
"73504959713592999854188999286563421747",
"109549835627156227154966826578649081726",
"43918235204133421459147386494031181300",
"293949540968280903538352693917672011553",
"108587633537507210242609878158511307392",
"108587633537507210242609878158511307392",
"108587633537507210242609878158511307392"
],
"threshold": 0.9
},
"id": "CVE-2026-87795-2c08903d",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/luben/zstd-jni/commit/0d64de4dee6606ff506be36c7f2e714ad0c80fdb",
"target": {
"file": "src/main/java/com/github/luben/zstd/AutoCloseBase.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "226423536518056106590664531795542574583",
"length": 183
},
"id": "CVE-2026-87795-30bc9ed5",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/luben/zstd-jni/commit/1c4e5a6c3ce8458095225d987d669e6a0937734a",
"target": {
"file": "src/main/native/jni_fast_zstd.c",
"function": "getNativePtr"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "153566990477443048128913891168655575752",
"length": 1425
},
"id": "CVE-2026-87795-3643a3c1",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/luben/zstd-jni/commit/1c4e5a6c3ce8458095225d987d669e6a0937734a",
"target": {
"file": "src/main/native/jni_fast_zstd.c",
"function": "Java_com_github_luben_zstd_Zstd_compressFastDict"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "114112441423332760535720991188023965463",
"length": 249
},
"id": "CVE-2026-87795-3e6f8d73",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/luben/zstd-jni/commit/0d64de4dee6606ff506be36c7f2e714ad0c80fdb",
"target": {
"file": "src/main/java/com/github/luben/zstd/AutoCloseBase.java",
"function": "close"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "153566990477443048128913891168655575752",
"length": 1425
},
"id": "CVE-2026-87795-3fdd8c80",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/luben/zstd-jni/commit/1c4e5a6c3ce8458095225d987d669e6a0937734a",
"target": {
"file": "src/main/native/jni_fast_zstd.c",
"function": "Java_com_github_luben_zstd_Zstd_decompressFastDict"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "175423890559638190565646337567703933767",
"length": 140
},
"id": "CVE-2026-87795-41883fb0",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/luben/zstd-jni/commit/1c4e5a6c3ce8458095225d987d669e6a0937734a",
"target": {
"file": "src/main/native/jni_fast_zstd.c",
"function": "Java_com_github_luben_zstd_ZstdDictDecompress_free"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "319696483832917712384682231278816072707",
"length": 525
},
"id": "CVE-2026-87795-44dbbae1",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/luben/zstd-jni/commit/3216860eea289fbbae0b191c0a4fd8b72dad949c",
"target": {
"file": "src/main/native/jni_zstd.c",
"function": "Java_com_github_luben_zstd_Zstd_getDirectByteBufferFrameContentSize"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "247644100059670334548379215931535463138",
"length": 380
},
"id": "CVE-2026-87795-4757ae1c",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/luben/zstd-jni/commit/1c4e5a6c3ce8458095225d987d669e6a0937734a",
"target": {
"file": "src/main/java/com/github/luben/zstd/ZstdDictDecompress.java",
"function": "ZstdDictDecompress"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"305530341027247939358400165124499723689",
"244996029970187939260398610334567386343",
"83074194632860063153977426928287926038",
"1824068004868923671590702292323561082"
],
"threshold": 0.9
},
"id": "CVE-2026-87795-4858ef69",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/luben/zstd-jni/commit/0d64de4dee6606ff506be36c7f2e714ad0c80fdb",
"target": {
"file": "src/main/java/com/github/luben/zstd/ZstdOutputStreamNoFinalizer.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"145182736731800199294731629379638576401",
"291199900614424117501687203227948526592",
"234358335394572632422390615714576821656",
"289803637352121333259783497204254429370",
"259614403475019828389477577151434630317",
"318514952241952197391524385356615711798",
"263525429665522269555606705821481199670",
"20633577328658672793529113780313234668",
"100970983125725289565116434623667382823",
"254881659229508131082102148066833751787",
"5477471141322320865474338174724741092",
"27251147454671349464288620430022784104",
"257390482910052339473565723909528783212",
"68302914386215423308653007862247144422",
"229818690731547839478650062349880959263",
"97145874951526987300865484898173688754",
"80206419506447357949696485762430598209",
"78534491327879445452623266821950975146",
"150347044840610552402392042684475650950",
"307474618291127958505658554126852976207",
"265409269743780217452624748011156767875",
"303039214346202667766871263417928258214"
],
"threshold": 0.9
},
"id": "CVE-2026-87795-5078ba53",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/luben/zstd-jni/commit/1c4e5a6c3ce8458095225d987d669e6a0937734a",
"target": {
"file": "src/main/java/com/github/luben/zstd/ZstdDictDecompress.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"124707531680094268477657611897381176013",
"278209625644031623995998778694131632459",
"200162390163270026480228052814464056998"
],
"threshold": 0.9
},
"id": "CVE-2026-87795-6f6de634",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/luben/zstd-jni/commit/0d64de4dee6606ff506be36c7f2e714ad0c80fdb",
"target": {
"file": "src/main/java/com/github/luben/zstd/ZstdDictCompress.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "12189887396039776943823874100993380642",
"length": 402
},
"id": "CVE-2026-87795-7424d313",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/luben/zstd-jni/commit/1c4e5a6c3ce8458095225d987d669e6a0937734a",
"target": {
"file": "src/main/java/com/github/luben/zstd/ZstdDictCompress.java",
"function": "ZstdDictCompress"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"26227542207409589379836598995984946495",
"252158062018136559643587862381422343410",
"263676814350176365917181222524031649307",
"226318483840877330074328928596730994056"
],
"threshold": 0.9
},
"id": "CVE-2026-87795-8205ee9a",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/luben/zstd-jni/commit/1c4e5a6c3ce8458095225d987d669e6a0937734a",
"target": {
"file": "src/main/native/jni_outputstream_zstd.c"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "338088567365487742912273932499298370088",
"length": 541
},
"id": "CVE-2026-87795-8294815d",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/luben/zstd-jni/commit/1c4e5a6c3ce8458095225d987d669e6a0937734a",
"target": {
"file": "src/main/native/jni_fast_zstd.c",
"function": "Java_com_github_luben_zstd_ZstdDictCompress_init"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "174947492421595321449366708522111304634",
"length": 432
},
"id": "CVE-2026-87795-88643bac",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/luben/zstd-jni/commit/1c4e5a6c3ce8458095225d987d669e6a0937734a",
"target": {
"file": "src/main/native/jni_zstd.c",
"function": "Java_com_github_luben_zstd_Zstd_decompressedSize"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "41687338444759206792472060370730912692",
"length": 959
},
"id": "CVE-2026-87795-8a86f9ec",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/luben/zstd-jni/commit/1c4e5a6c3ce8458095225d987d669e6a0937734a",
"target": {
"file": "src/main/native/jni_fast_zstd.c",
"function": "Java_com_github_luben_zstd_Zstd_compressDirectByteBufferFastDict"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "72354477436676593227711636285898239328",
"length": 325
},
"id": "CVE-2026-87795-9be92052",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/luben/zstd-jni/commit/0d64de4dee6606ff506be36c7f2e714ad0c80fdb",
"target": {
"file": "src/main/java/com/github/luben/zstd/ZstdDictCompress.java",
"function": "ZstdDictCompress"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "175423890559638190565646337567703933767",
"length": 140
},
"id": "CVE-2026-87795-9e57408d",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/luben/zstd-jni/commit/1c4e5a6c3ce8458095225d987d669e6a0937734a",
"target": {
"file": "src/main/native/jni_fast_zstd.c",
"function": "Java_com_github_luben_zstd_ZstdDictCompress_free"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"116976461811903607430998365075382717575",
"313681511128899131689268624912566136771",
"217705382167214327767839618195528369627",
"297403219582402751735192620273727452975",
"335457145955288430589273335999281454862",
"240029857680528361945114478257299686477",
"71669525051567280874018940726246594163",
"6675206633547017461180722110572118099",
"210944043807628198682928448828183095993",
"42632032711796768444505686851817609940",
"251703100684406962862071854734148291199",
"121935346225923941217103679168894917173",
"229586961563281143909831938597622397516",
"326248441147695637996047234243092692629",
"312537571265098521794464133776028772008",
"102927490079795926456378933586615359741",
"257689247555060447539124305114464787355",
"206469275387670000555239321529664238867",
"183160364137402496102668854186930180130",
"297403219582402751735192620273727452975",
"163798239630505027702400427505543661545",
"297223984245613703809190355810884170254",
"84366656479003340991204065155689716094",
"232349163258828099183660733778737207028"
],
"threshold": 0.9
},
"id": "CVE-2026-87795-a91041f3",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/luben/zstd-jni/commit/1c4e5a6c3ce8458095225d987d669e6a0937734a",
"target": {
"file": "src/main/native/jni_zstd.c"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "105800829512131482195498177974519433971",
"length": 274
},
"id": "CVE-2026-87795-a9d0e42d",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/luben/zstd-jni/commit/0d64de4dee6606ff506be36c7f2e714ad0c80fdb",
"target": {
"file": "src/main/java/com/github/luben/zstd/ZstdOutputStreamNoFinalizer.java",
"function": "setChecksum"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"201366182353558056488000566067237426236",
"36480035204599032194628721311791351285",
"312124001718745083120356916784249005670",
"99780221719462447815135034385444444",
"286221289557449426545661351705227344018",
"97983870704024239867576951250055790229",
"156568392851454964217365400022756082683",
"306937201931238327928737545791490009257",
"327112235407821120842374745191463630192",
"170033596394913693538876526439397728456",
"142097379228959265748778334819297429112",
"295276839208924402686405598871306822959",
"251249266968162245861784521001172989287",
"241070654269796589982758359038590215033",
"286821066799945043629225067116006170296",
"339965227871784775543004185356136240147",
"118570308561843373108228082171923417811",
"175106352793345839270879455681187598023",
"293513629768404396491113242064581773829",
"104359942801057276613656597895499749192",
"5225041859162657494383019263637254818",
"197847488171023949417013572818465251033",
"280610110869059108601028214040766133962",
"120356133223251718781423536145249078689",
"31008190977042906759256787876301999081",
"232589857809859529036908045151249863138",
"216311185552231884246704897207004612636",
"312999941833393898966213728538818332041",
"118570308561843373108228082171923417811",
"140433924903305890320256119449924135225",
"169679633026739648259231336430744705413",
"227677242619339658995513795614457109721",
"302644364130521659126252981569380710637",
"51689863444396762078324742504309416656",
"86945223657587747019080904892984619698",
"185973721457740694360444281778079738924",
"73083109616305477046090567588259127071",
"236078199405801472069241784333293704227",
"191778437131401568095737106535928754264",
"60165936076616335516167802972541972198",
"89466367792777145716964570696585129052",
"164896737857607924773432001764733323393",
"17567797441260609990869153726843193951"
],
"threshold": 0.9
},
"id": "CVE-2026-87795-aa914665",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/luben/zstd-jni/commit/1c4e5a6c3ce8458095225d987d669e6a0937734a",
"target": {
"file": "src/main/java/com/github/luben/zstd/Zstd.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"210202392254235694338471206893952331525",
"30183355241534264033332605365618763220",
"166224356264947270007956409304941106314",
"82388877102774293759933070731646996392",
"279941042823352966066464110815693417709",
"25512023304922359181790158375730790045",
"108780149792627234596704417971786583082",
"275538413068739931108736099752177016645",
"259247925786425571904835539179581133866",
"12423727087580445944454320534677056416",
"72251643784482325722958444290911098377",
"128795797007769318930661942496016859597",
"335673394951671737147141671511034420911",
"328095183226514668855598417210463283585",
"97278332827455926971052092341095347366",
"285681889620460311352869491369294902441",
"25281577965445799825414257842102522333",
"327935758029927329709293755154763440864",
"316355507121291998396041938016285675227",
"253062426147908464922991305064747770562",
"137980628614361789052983400214107551109",
"250576828246850910985108878873933079441",
"181062278454418017729499368052219230437",
"101138394921750318663297775501126068377",
"85791983112003700923938092795936822855",
"175860268584181795901576425793879260936",
"270198690929591556356322774281537448788",
"23653913460319501777277628891663995870",
"331417881854293232069444348988956198129",
"132759218497826090720983096788490768831",
"209491382342886433468754675551848871188",
"289311491747289170845138973384006376658",
"81259676657736321308710242052062617569",
"175671354245494677328236457967105369772",
"270432078687221736509781824043461998553",
"106953654265758375374196057895225911968",
"327935758029927329709293755154763440864",
"316355507121291998396041938016285675227",
"74155201234433357136225602457160469374",
"238242328650031290588119955332431150085",
"136409029573517842864405442304546717598",
"310040720357587588894518937213924193440",
"106641408035503561223533994291477564820",
"182137233916011192538589930421909775956",
"327367609523371966717230441207030917849",
"241403176429493907642108197187716378704",
"33045810491925822009602414139390482137",
"311654960323527032262320250023315582662",
"150608257998328228564864601288682338462",
"186045044776452108343409140362353138946",
"204610779114688577752448458745113905050",
"336238982324609254995559182574873649586",
"217837731514403065348927758321665885287",
"37963000637022445311825316389044835819",
"53255632671275642095645218720190260909",
"240054776773932950708877202710108592349",
"236335069587533333528213592042599578716",
"198510311443580414390129450884838513448",
"322496335121352775300212727818141604520",
"176640286988749595510406550201944450275",
"173530271353649768757707821000412527983",
"44610298216722952592950130753833741710",
"322496335121352775300212727818141604520",
"176640286988749595510406550201944450275",
"19867572152750456764413218889692673245",
"97539010716698687422656752051019635545",
"53663966980560855842723054943480518764",
"154955995525398012161324042472237711948",
"246180669438811387297022392582973688046",
"85602760070498587357018694381545366572",
"25236968364497400075032184238331242613",
"37963000637022445311825316389044835819",
"53255632671275642095645218720190260909",
"240054776773932950708877202710108592349"
],
"threshold": 0.9
},
"id": "CVE-2026-87795-accc62f3",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/luben/zstd-jni/commit/1c4e5a6c3ce8458095225d987d669e6a0937734a",
"target": {
"file": "src/main/native/jni_fast_zstd.c"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "89660608847644973908890135270644039795",
"length": 66
},
"id": "CVE-2026-87795-b4437cd6",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/luben/zstd-jni/commit/1c4e5a6c3ce8458095225d987d669e6a0937734a",
"target": {
"file": "src/main/java/com/github/luben/zstd/Zstd.java",
"function": "compress"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "208058700514564190179005821942172458955",
"length": 1245
},
"id": "CVE-2026-87795-c191132f",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/luben/zstd-jni/commit/1c4e5a6c3ce8458095225d987d669e6a0937734a",
"target": {
"file": "src/main/native/jni_inputstream_zstd.c",
"function": "Java_com_github_luben_zstd_ZstdInputStream_decompressStream"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"76634499848722836972167157988447942390",
"60477330828820703664649133894845126063",
"209982705364140075873261171031666453574",
"250818059982176309654130449735599578177",
"74991185452242401027281778908747524748",
"176042953361110786164980661100003695557",
"263525429665522269555606705821481199670",
"20633577328658672793529113780313234668",
"100970983125725289565116434623667382823",
"254881659229508131082102148066833751787",
"5477471141322320865474338174724741092",
"27251147454671349464288620430022784104",
"167513408727805357198078732117860285263",
"194237593440563674157045992831082482387",
"254972967423905411435788671780616156372",
"109926745306025645435388176701691854689",
"80206419506447357949696485762430598209",
"263072302765808324094343215189721917505",
"80801707689360301734219395697541525320",
"43140177542797220907727004578533348154",
"193316175214154703878965331838607812463",
"303039214346202667766871263417928258214"
],
"threshold": 0.9
},
"id": "CVE-2026-87795-c31597b8",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/luben/zstd-jni/commit/1c4e5a6c3ce8458095225d987d669e6a0937734a",
"target": {
"file": "src/main/java/com/github/luben/zstd/ZstdDictCompress.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"242983979289756636978174893894911169283",
"157823411836278810979700492519583258858",
"47982388172284482667079231190836641912",
"142002538935986523140505977783435642687",
"70654406038950244899492554068964697791",
"256841266079176367404669460587415964017",
"136130365917502750732790875301653462261",
"307914870517560413069750160813139035083",
"70654406038950244899492554068964697791",
"256841266079176367404669460587415964017",
"136130365917502750732790875301653462261",
"307914870517560413069750160813139035083"
],
"threshold": 0.9
},
"id": "CVE-2026-87795-cf1cd55a",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/luben/zstd-jni/commit/3216860eea289fbbae0b191c0a4fd8b72dad949c",
"target": {
"file": "src/main/native/jni_zstd.c"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "6130561471615133004258603361745015963",
"length": 503
},
"id": "CVE-2026-87795-e402cad3",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/luben/zstd-jni/commit/3216860eea289fbbae0b191c0a4fd8b72dad949c",
"target": {
"file": "src/main/native/jni_zstd.c",
"function": "Java_com_github_luben_zstd_Zstd_findDirectByteBufferFrameCompressedSize"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "243452810049814927721413726162029308560",
"length": 552
},
"id": "CVE-2026-87795-e43e017d",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/luben/zstd-jni/commit/3216860eea289fbbae0b191c0a4fd8b72dad949c",
"target": {
"file": "src/main/native/jni_zstd.c",
"function": "Java_com_github_luben_zstd_Zstd_decompressedDirectByteBufferSize"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "177971834334608659953571967859922135406",
"length": 256
},
"id": "CVE-2026-87795-e82f1434",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/luben/zstd-jni/commit/1c4e5a6c3ce8458095225d987d669e6a0937734a",
"target": {
"file": "src/main/native/jni_fast_zstd.c",
"function": "nativePtrField"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "19126674362734465130194688717362973502",
"length": 721
},
"id": "CVE-2026-87795-ef068304",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/luben/zstd-jni/commit/1c4e5a6c3ce8458095225d987d669e6a0937734a",
"target": {
"file": "src/main/native/jni_zstd.c",
"function": "Java_com_github_luben_zstd_Zstd_decompress"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"68769222384474365059191319965559932433",
"140121056111128503309501068281881475905",
"113341820460396869349427415608453281426",
"208085089848693706084898394021207897224",
"288036046889534243479473518555746302855",
"311497263012537383015586318606982173589"
],
"threshold": 0.9
},
"id": "CVE-2026-87795-f1acf50d",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/luben/zstd-jni/commit/0d64de4dee6606ff506be36c7f2e714ad0c80fdb",
"target": {
"file": "src/main/java/com/github/luben/zstd/ZstdDictDecompress.java"
}
}
]
vanir_signatures_modified
"2026-10-15T07:34:12Z"