A vulnerability in the zstd-jni library allows unauthenticated attackers to trigger out-of-bounds memory reads, potentially leading to widespread application service denial.

This flaw is an out-of-bounds read (CWE-125) occurring in the ZstdDictCompress constructor. An unauthenticated attacker can supply malicious offset or length parameters to the library, causing it to read native heap memory into the compression dictionary.

The primary risk associated with this vulnerability is application instability and denial of service. Since the flaw causes the Java Virtual Machine (JVM) to crash when processing maliciously crafted input, it may result in significant service downtime for any application relying on this library for data compression. With a CVSS score of 8.2, this vulnerability is considered high severity due to the potential for remote exploitation without requiring authentication.

Immediate Action: Update the zstd-jni library to version 1.5.7-14 or later immediately to incorporate the necessary parameter validation logic.

Proactive Monitoring: Monitor application server logs for frequent or unexplained JVM crashes and errors originating from the zstd-jni component.

Compensating Controls: If an immediate update is not possible, implement strict input validation at the application layer to ensure that all offset and length values passed to compression functions are within expected bounds.

Public Exploit Available: Unknown

Given the potential for service disruption and the ease of triggering this flaw through crafted inputs, organizations should prioritize updating the zstd-jni library. Ensure that all downstream dependencies are identified and patched to version 1.5.7-14 to mitigate the risk of denial of service attacks.