Your message dated Wed, 14 Oct 2026 11:34:51 +0000
with message-id <[email protected]>
and subject line Bug#1148171: fixed in zstd-jni-java 1.5.7-23+ds-1
has caused the Debian Bug report #1148171,
regarding zstd-jni-java: CVE-2026-90852
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1148171: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1148171
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: zstd-jni-java
Version: 1.5.2-5+ds-8
Severity: important
Tags: security upstream
Forwarded: https://github.com/luben/zstd-jni/issues/404
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi,
The following vulnerability was published for zstd-jni-java.
CVE-2026-90852[0]:
| A vulnerability has been found in luben zstd-jni up to 1.5.7-13.
| This vulnerability affects the function ZstdCompressCtx.loadDict of
| the file ZstdCompressCtx.java of the component Dictionary Sharing.
| Such manipulation leads to use after free. The attack can be
| executed remotely. The exploit has been disclosed to the public and
| may be used. Upgrading to version 1.5.7-14 is able to resolve this
| issue. The name of the patch is
| a560131d7834598afd9cea6b7c107bc88e915936. The affected component
| should be upgraded. The vendor was contacted early, responded in a
| very professional manner and quickly released a fixed version of the
| affected product.
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-90852
https://www.cve.org/CVERecord?id=CVE-2026-90852
[1] https://github.com/luben/zstd-jni/issues/404
[2]
https://github.com/luben/zstd-jni/commit/a560131d7834598afd9cea6b7c107bc88e915936
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: zstd-jni-java
Source-Version: 1.5.7-23+ds-1
Done: Emmanuel Bourg <[email protected]>
We believe that the bug you reported is fixed in the latest version of
zstd-jni-java, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Emmanuel Bourg <[email protected]> (supplier of updated zstd-jni-java package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Wed, 14 Oct 2026 12:53:20 +0200
Source: zstd-jni-java
Architecture: source
Version: 1.5.7-23+ds-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Java Maintainers
<[email protected]>
Changed-By: Emmanuel Bourg <[email protected]>
Closes: 1048255 1147397 1148171 1148453
Changes:
zstd-jni-java (1.5.7-23+ds-1) unstable; urgency=medium
.
* Team upload
* Rewrote debian/watch in the version 5 format, using the GitHub API
* New upstream release
- Fixes CVE-2026-87795, CVE-2026-87823, CVE-2026-87824, CVE-2026-87825,
CVE-2026-87877, CVE-2026-89045 and CVE-2026-89046 (Closes: #1147397)
- Fixes CVE-2026-90852, a use after free in ZstdCompressCtx.loadDict
(Closes: #1148171)
- Fixes CVE-2026-90560, an out of bounds read in the ZstdDictDecompress
constructor (Closes: #1148453)
- Refreshed the patches
- New patch to use the public zstd dictionary builder API
- New build dependency on libjetbrains-annotations-java
- Updated debian/libzstd-jni1.symbols
- New lintian override for symbols-file-contains-debian-revision
- Excluded the Gradle wrapper from the upstream tarball
- Removed the exclusion of the legacy zstd sources, dropped in 1.5.7-13
* Standards-Version updated to 4.7.4
* Removed the Priority field
* Versioned the dependency on libzstd-jni1
* Removed the Rules-Requires-Root field
* Use ${maven:Depends} instead of ${maven:CompileDepends}
* Clean the CMake build directory (Closes: #1048255)
Checksums-Sha1:
08dfeeec463d226db2e3106e7d0d95dcef7285fe 2276 zstd-jni-java_1.5.7-23+ds-1.dsc
55cf826b78d834dc36d3a5620e195aee157152a7 83960
zstd-jni-java_1.5.7-23+ds.orig.tar.xz
d569cbf574eed7d48e07371197c2794f9c332814 9464
zstd-jni-java_1.5.7-23+ds-1.debian.tar.xz
54cbbe76af6933f6e94cecd2309259037867fef3 19396
zstd-jni-java_1.5.7-23+ds-1_source.buildinfo
Checksums-Sha256:
e7e4325ef11207ad2a754fc73944b909d37077c819d03a215a022c3f01ef11b8 2276
zstd-jni-java_1.5.7-23+ds-1.dsc
09f753d456e36fa11b2bff68fb9a68e5a22227a5a2cecd1f8a5e5d05619e79ba 83960
zstd-jni-java_1.5.7-23+ds.orig.tar.xz
5adde6b87c43c7d39d9fa11975a125a4681cf667cb6a04c53d58491d558cf5c3 9464
zstd-jni-java_1.5.7-23+ds-1.debian.tar.xz
df0e9e8420ae048473fcb8bf81874b8c0b960c38e46b33c154e63582b9fa9016 19396
zstd-jni-java_1.5.7-23+ds-1_source.buildinfo
Files:
a102e28ca9754c11fc3a3788a29a36ca 2276 java optional
zstd-jni-java_1.5.7-23+ds-1.dsc
ff32e2c337304acb08468e0f3d0475ba 83960 java optional
zstd-jni-java_1.5.7-23+ds.orig.tar.xz
ccd759546d3f38e9303a04e9bd6706c6 9464 java optional
zstd-jni-java_1.5.7-23+ds-1.debian.tar.xz
7c8375149d2a4fdeee03060a68324c04 19396 java optional
zstd-jni-java_1.5.7-23+ds-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQJGBAEBCgAwFiEEuM5N4hCA3PkD4WxA9RPEGeS50KwFAmrPZEsSHGVib3VyZ0Bh
cGFjaGUub3JnAAoJEPUTxBnkudCsyDcP/3IeNqjcroTdSeyJk8uq4hWDMru+tTlc
hajN0AAMTUz4Ot/oZ967vqgHt+UX8As0gbY5SkCabZrBRYqNgliTRB2lYQ9turW4
MSaGa2kUmauSPRNBTfmSKOwrG9wfotCXFwdADQjGI29mN7hgE6qmkUCYNncPVqcE
zWLSkToG8CTV9SS6bjJMTfb9EweTfz+ALFX4RSaKyIJWzz6MR19L6eFJ+p35CMMU
hufMG07pr3+rNaELlMIqaXlhSc4OVoO7rjJcxRG0eIUt5bXTU19gihir8Feksw5P
4r1F46kd5+b0FMjHX1v0hddNEmZ8nUwOpEhqfAWyrCpz3JojBizwmqMwvKwQaFLF
awFSXGmxovtO+TRWsBsOSPFJtQX0d1EW18w55wKDbEcPNjez++2OncIanNB10PsJ
0eno14750ZiGnxzrpjd+rd1cOanb94Jdm1ULVeh2iGGSLpk7/VMXsIS4X1buqzCP
AqU9GGWDekmlIZQq1dPGG91OgaYB19sXHKYZnkCBOetEmgALkZV6fStPM3EUKkPm
k22PE2K5DtTbF1oI3S65Hv62v/gFIN1CZNIq3PHbizOULfbQMref7PB8zOCGihX/
GoIKShBfoJKR1hhPXFA3sv+FybsrfnNeaWSEchqFkyBNjP1Ar25CLkkvqw151KES
6sFhPZv4M1n/
=Wd2c
-----END PGP SIGNATURE-----
pgpFGwZuRHloB.pgp
Description: PGP signature
--- End Message ---
