FrankChen021 commented on PR #20236: URL: https://github.com/apache/druid/pull/20236#issuecomment-5646494509
@kfaraz I investigated both CVEs against Druid and the zstd-jni callers bundled in the distribution. Although `zstd-jni:1.5.7-11` is within the affected version ranges, both findings require use of specific low-level APIs: - CVE-2026-87823 requires attacker-controlled negative or overflowing offsets/sizes passed to `decompressedDirectByteBufferSize`, `getDirectByteBufferFrameContentSize`, or `findDirectByteBufferFrameCompressedSize`. - CVE-2026-87795 requires attacker-controlled offset/length values passed to `ZstdDictCompress(byte[], offset, length, level)`. I found no such reachable calls in Druid. I also inspected the zstd call paths in Parquet 1.18.0/1.18.1, Kafka clients, Avro, ORC, RabbitMQ Stream, Commons Compress, HttpClient 5, and Netty/gRPC. They use the stream APIs, compression/decompression contexts, or ordinary static compression methods. None constructs the vulnerable `ZstdDictCompress` object or exposes the vulnerable raw frame-size methods with attacker-controlled offsets. Netty calls the safe `getFrameContentSize(ByteBuffer)` wrapper, which derives its position and size from valid `ByteBuffer` state. Therefore, the vulnerable methods are present in the dependency, which is why Dependency-Check reports them, but I did not find an application-level path that makes either CVE exploitable in Druid. I think suppressing these two CVEs with this reachability rationale is reasonable. Upgrading zstd-jni can still be considered separately, but these CVEs alone do not appear to justify accepting the documented legacy `.zst` compatibility break. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
