Your message dated Wed, 14 Oct 2026 11:34:51 +0000
with message-id <[email protected]>
and subject line Bug#1147397: fixed in zstd-jni-java 1.5.7-23+ds-1
has caused the Debian Bug report #1147397,
regarding zstd-jni-java: CVE-2026-87795 CVE-2026-87823 CVE-2026-87824
CVE-2026-87825 CVE-2026-87877 CVE-2026-89045 CVE-2026-89046
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1147397: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1147397
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: zstd-jni-java
Version: 1.5.2-5+ds-8
Severity: grave
Tags: security upstream
Justification: user security hole
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi,
The following vulnerabilities were published for zstd-jni-java.
CVE-2026-87795[0]:
| zstd-jni versions before 1.5.7-14 fail to validate offset and length
| parameters in the ZstdDictCompress constructor, allowing out-of-
| bounds memory reads. Attackers can supply untrusted offset or length
| values to read native heap memory into the compression dictionary,
| typically causing JVM crashes.
CVE-2026-87823[1]:
| zstd-jni before 1.5.7-14 performs 32-bit signed bounds checks on
| three direct-ByteBuffer frame-size native methods, allowing out-of-
| bounds memory reads via negative or overflowing offsets. Attackers
| can supply negative offset values near Integer.MIN_VALUE to read
| unmapped memory, causing JVM termination or extracting arbitrary
| frame size data from unintended memory locations.
CVE-2026-87824[2]:
| zstd-jni before 1.5.7-14 fails to validate the samples buffer
| capacity in Zstd.trainFromBufferDirect, allowing attackers to read
| past buffer boundaries by supplying oversized per-sample lengths.
| Attackers can trigger out-of-bounds memory access by providing
| crafted sample length arrays that cause the native implementation to
| walk past the buffer allocation, resulting in JVM termination.
CVE-2026-87825[3]:
| zstd-jni before 1.5.7-14 contains a use-after-free vulnerability
| where streams and contexts hold a dictionary's shared lock only
| during the load call, allowing the dictionary to be closed while
| still referenced. Attackers can close a dictionary after associating
| it with a stream or context, causing subsequent read or write
| operations to access freed native memory, resulting in silent data
| corruption or JVM crashes.
CVE-2026-87877[4]:
| zstd-jni versions before 1.5.7-14 fail to validate closed state in
| setDict, setLongMax, setLevel and setRefMultipleDDicts methods of
| stream classes. Attackers can call these methods on closed streams
| to write through freed native pointers, corrupting unrelated objects
| or crashing the JVM.
CVE-2026-89045[5]:
| zstd-jni versions 1.4.8-4 through 1.5.7-13 fail to validate negative
| length parameters in ZstdInputStreamNoFinalizer.read(), allowing
| attackers to trigger infinite loops. Attackers can pass negative
| length values to cause the read method to spin indefinitely while
| holding the stream monitor, blocking all other threads from
| accessing the stream.
CVE-2026-89046[6]:
| zstd-jni versions 1.5.5-6 through 1.5.7-13 contain an out-of-bounds
| read vulnerability in Zstd.getFrameContentSize that fails to
| validate negative srcPosition arguments. Attackers can supply
| negative offset values that bypass bounds checks and reach the
| native frame-header parser, causing out-of-bounds memory reads that
| lead to information disclosure or JVM crashes.
If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-87795
https://www.cve.org/CVERecord?id=CVE-2026-87795
[1] https://security-tracker.debian.org/tracker/CVE-2026-87823
https://www.cve.org/CVERecord?id=CVE-2026-87823
[2] https://security-tracker.debian.org/tracker/CVE-2026-87824
https://www.cve.org/CVERecord?id=CVE-2026-87824
[3] https://security-tracker.debian.org/tracker/CVE-2026-87825
https://www.cve.org/CVERecord?id=CVE-2026-87825
[4] https://security-tracker.debian.org/tracker/CVE-2026-87877
https://www.cve.org/CVERecord?id=CVE-2026-87877
[5] https://security-tracker.debian.org/tracker/CVE-2026-89045
https://www.cve.org/CVERecord?id=CVE-2026-89045
[6] https://security-tracker.debian.org/tracker/CVE-2026-89046
https://www.cve.org/CVERecord?id=CVE-2026-89046
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: zstd-jni-java
Source-Version: 1.5.7-23+ds-1
Done: Emmanuel Bourg <[email protected]>
We believe that the bug you reported is fixed in the latest version of
zstd-jni-java, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Emmanuel Bourg <[email protected]> (supplier of updated zstd-jni-java package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Wed, 14 Oct 2026 12:53:20 +0200
Source: zstd-jni-java
Architecture: source
Version: 1.5.7-23+ds-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Java Maintainers
<[email protected]>
Changed-By: Emmanuel Bourg <[email protected]>
Closes: 1048255 1147397 1148171 1148453
Changes:
zstd-jni-java (1.5.7-23+ds-1) unstable; urgency=medium
.
* Team upload
* Rewrote debian/watch in the version 5 format, using the GitHub API
* New upstream release
- Fixes CVE-2026-87795, CVE-2026-87823, CVE-2026-87824, CVE-2026-87825,
CVE-2026-87877, CVE-2026-89045 and CVE-2026-89046 (Closes: #1147397)
- Fixes CVE-2026-90852, a use after free in ZstdCompressCtx.loadDict
(Closes: #1148171)
- Fixes CVE-2026-90560, an out of bounds read in the ZstdDictDecompress
constructor (Closes: #1148453)
- Refreshed the patches
- New patch to use the public zstd dictionary builder API
- New build dependency on libjetbrains-annotations-java
- Updated debian/libzstd-jni1.symbols
- New lintian override for symbols-file-contains-debian-revision
- Excluded the Gradle wrapper from the upstream tarball
- Removed the exclusion of the legacy zstd sources, dropped in 1.5.7-13
* Standards-Version updated to 4.7.4
* Removed the Priority field
* Versioned the dependency on libzstd-jni1
* Removed the Rules-Requires-Root field
* Use ${maven:Depends} instead of ${maven:CompileDepends}
* Clean the CMake build directory (Closes: #1048255)
Checksums-Sha1:
08dfeeec463d226db2e3106e7d0d95dcef7285fe 2276 zstd-jni-java_1.5.7-23+ds-1.dsc
55cf826b78d834dc36d3a5620e195aee157152a7 83960
zstd-jni-java_1.5.7-23+ds.orig.tar.xz
d569cbf574eed7d48e07371197c2794f9c332814 9464
zstd-jni-java_1.5.7-23+ds-1.debian.tar.xz
54cbbe76af6933f6e94cecd2309259037867fef3 19396
zstd-jni-java_1.5.7-23+ds-1_source.buildinfo
Checksums-Sha256:
e7e4325ef11207ad2a754fc73944b909d37077c819d03a215a022c3f01ef11b8 2276
zstd-jni-java_1.5.7-23+ds-1.dsc
09f753d456e36fa11b2bff68fb9a68e5a22227a5a2cecd1f8a5e5d05619e79ba 83960
zstd-jni-java_1.5.7-23+ds.orig.tar.xz
5adde6b87c43c7d39d9fa11975a125a4681cf667cb6a04c53d58491d558cf5c3 9464
zstd-jni-java_1.5.7-23+ds-1.debian.tar.xz
df0e9e8420ae048473fcb8bf81874b8c0b960c38e46b33c154e63582b9fa9016 19396
zstd-jni-java_1.5.7-23+ds-1_source.buildinfo
Files:
a102e28ca9754c11fc3a3788a29a36ca 2276 java optional
zstd-jni-java_1.5.7-23+ds-1.dsc
ff32e2c337304acb08468e0f3d0475ba 83960 java optional
zstd-jni-java_1.5.7-23+ds.orig.tar.xz
ccd759546d3f38e9303a04e9bd6706c6 9464 java optional
zstd-jni-java_1.5.7-23+ds-1.debian.tar.xz
7c8375149d2a4fdeee03060a68324c04 19396 java optional
zstd-jni-java_1.5.7-23+ds-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQJGBAEBCgAwFiEEuM5N4hCA3PkD4WxA9RPEGeS50KwFAmrPZEsSHGVib3VyZ0Bh
cGFjaGUub3JnAAoJEPUTxBnkudCsyDcP/3IeNqjcroTdSeyJk8uq4hWDMru+tTlc
hajN0AAMTUz4Ot/oZ967vqgHt+UX8As0gbY5SkCabZrBRYqNgliTRB2lYQ9turW4
MSaGa2kUmauSPRNBTfmSKOwrG9wfotCXFwdADQjGI29mN7hgE6qmkUCYNncPVqcE
zWLSkToG8CTV9SS6bjJMTfb9EweTfz+ALFX4RSaKyIJWzz6MR19L6eFJ+p35CMMU
hufMG07pr3+rNaELlMIqaXlhSc4OVoO7rjJcxRG0eIUt5bXTU19gihir8Feksw5P
4r1F46kd5+b0FMjHX1v0hddNEmZ8nUwOpEhqfAWyrCpz3JojBizwmqMwvKwQaFLF
awFSXGmxovtO+TRWsBsOSPFJtQX0d1EW18w55wKDbEcPNjez++2OncIanNB10PsJ
0eno14750ZiGnxzrpjd+rd1cOanb94Jdm1ULVeh2iGGSLpk7/VMXsIS4X1buqzCP
AqU9GGWDekmlIZQq1dPGG91OgaYB19sXHKYZnkCBOetEmgALkZV6fStPM3EUKkPm
k22PE2K5DtTbF1oI3S65Hv62v/gFIN1CZNIq3PHbizOULfbQMref7PB8zOCGihX/
GoIKShBfoJKR1hhPXFA3sv+FybsrfnNeaWSEchqFkyBNjP1Ar25CLkkvqw151KES
6sFhPZv4M1n/
=Wd2c
-----END PGP SIGNATURE-----
pgpn_acwh9Bk2.pgp
Description: PGP signature
--- End Message ---
