CVE-2026-87877

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-87877
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-87877.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-87877
Aliases
  • GHSA-2jw3-mg7f-vw4q
Downstream
CLEANSTART (6)
DEBIAN (1)
openSUSE (1)
SUSE (2)
UBUNTU (1)
Related
openSUSE (1)
SUSE (2)
Published
2026-09-09T14:32:45Z
Modified
2026-10-21T11:19:17Z
Severity
  • 7.0 (High) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
zstd-jni 1.3.8-4 through 1.5.7-13 Use-After-Free via Setters Called After close()
Details

zstd-jni versions before 1.5.7-14 fail to validate closed state in setDict, setLongMax, setLevel and setRefMultipleDDicts methods of stream classes. Attackers can call these methods on closed streams to write through freed native pointers, corrupting unrelated objects or crashing the JVM.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-416"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/87xxx/CVE-2026-87877.json"
}
References

Affected packages

Git / github.com/luben/zstd-jni

Affected ranges

Type
GIT
Repo
https://github.com/luben/zstd-jni
Events
Introduced
0830536d204f2944f4a124517aec80b5e5dc2647
Fixed
3216860eea289fbbae0b191c0a4fd8b72dad949c
Fixed
f38f9a1563113d96d0fc38baee543f7457dd8a8e
Fixed
393d7311766abbc285b149302c0fe1f94b16d555
Fixed
0827ed02551bbd8d6f8e4bbff99d83bf50f91938
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "1.3.8-4"
                },
                {
                    "fixed":  "1.5.7-14"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        },
        {
            "range":  [
                {
                    "fixed":  "f38f9a1563113d96d0fc38baee543f7457dd8a8e"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "range":  [
                {
                    "fixed":  "393d7311766abbc285b149302c0fe1f94b16d555"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "original_tag":  "v1.5.7-14",
            "range":  [
                {
                    "fixed":  "3216860eea289fbbae0b191c0a4fd8b72dad949c"
                }
            ],
            "source":  "REFERENCES_TAG"
        },
        {
            "range":  [
                {
                    "fixed":  "0827ed02551bbd8d6f8e4bbff99d83bf50f91938"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

1.*
1.4.4-4
b1.*
b1.5.5-9
c1.*
c1.5.2-5
v.*
v.1.3.8-9
v.1.5.5-5
v1.*
v1.3.8-4
v1.3.8-5
v1.3.8-6
v1.3.8-7
v1.3.8-8
v1.4.0-1
v1.4.1-1
v1.4.2-1
v1.4.3-1
v1.4.4-10
v1.4.4-11
v1.4.4-2
v1.4.4-3
v1.4.4-5
v1.4.4-7
v1.4.4-8
v1.4.4-9
v1.4.5-1
v1.4.5-10
v1.4.5-11
v1.4.5-12
v1.4.5-2
v1.4.5-3
v1.4.5-4
v1.4.5-6
v1.4.5-7
v1.4.5-8
v1.4.5-9
v1.4.7-1
v1.4.7-2
v1.4.7-3
v1.4.8-1
v1.4.8-2
v1.4.8-3
v1.4.8-4
v1.4.8-5
v1.4.8-6
v1.4.8-7
v1.4.9-1
v1.4.9-2
v1.4.9-3
v1.4.9-4
v1.4.9-5
v1.5.0-1
v1.5.0-2
v1.5.0-3
v1.5.0-4
v1.5.0-5
v1.5.1-1
v1.5.2-1
v1.5.2-2
v1.5.2-3
v1.5.4-1
v1.5.4-2
v1.5.5-1
v1.5.5-10
v1.5.5-11
v1.5.5-2
v1.5.5-3
v1.5.5-6
v1.5.5-7
v1.5.5-8
v1.5.5-9
v1.5.6-1
v1.5.6-10
v1.5.6-2
v1.5.6-3
v1.5.6-4
v1.5.6-5
v1.5.6-6
v1.5.6-7
v1.5.6-8
v1.5.6-9
v1.5.7-1
v1.5.7-11
v1.5.7-12
v1.5.7-13
v1.5.7-2
v1.5.7-3
v1.5.7-4
v1.5.7-5
v1.5.7-6
v1.5.7-7
v1.5.7-8
v1.5.7-9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-87877.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "229310732171514125746685315061535664413",
                "286353657816325088407530745397575314578",
                "164506986080347496315592170955878782343",
                "119302752608786672787026851670426823100",
                "271863858728292820622126111686122263222",
                "182939225570076337882444348671113774528",
                "129060289602129467709736060871491252812",
                "101915134061936249999590926731327880017",
                "200744780348578148085731355848790644596",
                "185467643525929841811945989080328999095",
                "207893907684602458737068332815398486988",
                "280154477253590089504272518232063159293",
                "68344478199792028021440815642485050582",
                "80253867799444846590163368947816935652",
                "55194875252482706229447110809854148337",
                "170973370839161415647646685077604299623",
                "91666776320918888683922113952274442422",
                "293663691537715390396914670344614400556",
                "234521850147960991270701270724767265972",
                "163933207376533055490625210928046713726",
                "107750178626091304709744943969000628895",
                "262624005589318358869617576638383262245",
                "243454012210171353450878091271375056219",
                "83224745714455141354983196042337476570",
                "184955146790780920561344166656994733723",
                "68120552945343800117397848230652589973",
                "42180750968332415812451287695930616047",
                "338331387314282135898399962808855750969",
                "3787471408146339307842850575818737910",
                "254433155285637658849512363931544223336",
                "320967664445893681846594869740199033952",
                "123269859128965741517118232951441794151",
                "137415353793312983625164005279888965925",
                "62252269052365329939837429167832515273"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-87877-081dd4e6",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/luben/zstd-jni/commit/f38f9a1563113d96d0fc38baee543f7457dd8a8e",
        "target":  {
            "file":  "src/main/java/com/github/luben/zstd/BaseZstdBufferDecompressingStreamNoFinalizer.java"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "90768234226486204126310672057480896256",
            "length":  306
        },
        "id":  "CVE-2026-87877-0b7acbf1",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/luben/zstd-jni/commit/393d7311766abbc285b149302c0fe1f94b16d555",
        "target":  {
            "file":  "src/main/java/com/github/luben/zstd/ZstdOutputStreamNoFinalizer.java",
            "function":  "setDict"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "274181490123766162426083993247419205519",
            "length":  208
        },
        "id":  "CVE-2026-87877-2d1ef32d",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/luben/zstd-jni/commit/0827ed02551bbd8d6f8e4bbff99d83bf50f91938",
        "target":  {
            "file":  "src/main/java/com/github/luben/zstd/ZstdInputStream.java",
            "function":  "setDict"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "177890619529594044692716417677243851675",
            "length":  589
        },
        "id":  "CVE-2026-87877-2d2be32d",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/luben/zstd-jni/commit/393d7311766abbc285b149302c0fe1f94b16d555",
        "target":  {
            "file":  "src/main/java/com/github/luben/zstd/ZstdOutputStreamNoFinalizer.java",
            "function":  "close"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "258296661769363088332534342921921506081",
            "length":  116
        },
        "id":  "CVE-2026-87877-38f147be",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/luben/zstd-jni/commit/f38f9a1563113d96d0fc38baee543f7457dd8a8e",
        "target":  {
            "file":  "src/main/java/com/github/luben/zstd/BaseZstdBufferDecompressingStreamNoFinalizer.java",
            "function":  "close"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "319696483832917712384682231278816072707",
            "length":  525
        },
        "id":  "CVE-2026-87877-44dbbae1",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/luben/zstd-jni/commit/3216860eea289fbbae0b191c0a4fd8b72dad949c",
        "target":  {
            "file":  "src/main/native/jni_zstd.c",
            "function":  "Java_com_github_luben_zstd_Zstd_getDirectByteBufferFrameContentSize"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "264224633442601680061681778831217784405",
                "199182744398023258679998021686664513556",
                "281774072224271264659833238289708813908",
                "133304176427710129384173805349417002567",
                "110993408741559643463488015387631588277",
                "243084862491645028159755052325163196455",
                "237915631022718460723497340202154061654",
                "7565748850633265885309141182425541552",
                "170694195750718338793879174623391645051",
                "108995353165297911114267291243549039809",
                "98025755611052609260852558549916351515",
                "504869937110756436926175038712124994",
                "115403151979830004467398658156024690043",
                "298336324294485433890146134924036121706",
                "184955146790780920561344166656994733723",
                "68120552945343800117397848230652589973",
                "133227231070318101555204829318863302857",
                "337660356013846913362133871866251128703",
                "190690762174774163142285382328963802661",
                "239929959814439138672386020122940744806",
                "125418192118942412411427988904750714371",
                "160518533996939639021567808701370391510",
                "28615655768215271941804668873256577067",
                "169105887916564966513434521475896654265",
                "293055559587077273719905026468558507567",
                "36615860887186839760675534659195509288",
                "306111020125137117961330872106111902587",
                "306386994860202161732109303897369291620",
                "25245124146335873966123015128391446668",
                "46155471403664440156868535388851317211",
                "139988886889336730135410868956921276390"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-87877-45c3a546",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/luben/zstd-jni/commit/393d7311766abbc285b149302c0fe1f94b16d555",
        "target":  {
            "file":  "src/main/java/com/github/luben/zstd/ZstdInputStreamNoFinalizer.java"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "271463915713822081245877430838300272161",
            "length":  180
        },
        "id":  "CVE-2026-87877-4b1273cc",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/luben/zstd-jni/commit/393d7311766abbc285b149302c0fe1f94b16d555",
        "target":  {
            "file":  "src/main/java/com/github/luben/zstd/ZstdInputStreamNoFinalizer.java",
            "function":  "setLongMax"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "100964816827806602550635380616494264833",
            "length":  256
        },
        "id":  "CVE-2026-87877-4c1fac9c",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/luben/zstd-jni/commit/f38f9a1563113d96d0fc38baee543f7457dd8a8e",
        "target":  {
            "file":  "src/main/java/com/github/luben/zstd/BaseZstdBufferDecompressingStreamNoFinalizer.java",
            "function":  "setDict"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "316115205150602137625555191023119549146",
            "length":  638
        },
        "id":  "CVE-2026-87877-5195ab92",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/luben/zstd-jni/commit/0827ed02551bbd8d6f8e4bbff99d83bf50f91938",
        "target":  {
            "file":  "src/main/native/jni_inputstream_zstd.c",
            "function":  "Java_com_github_luben_zstd_ZstdInputStream_initDStreamWithDict"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "70031939536342015921477796118506824547",
            "length":  1253
        },
        "id":  "CVE-2026-87877-6a7f904f",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/luben/zstd-jni/commit/0827ed02551bbd8d6f8e4bbff99d83bf50f91938",
        "target":  {
            "file":  "src/main/native/jni_inputstream_zstd.c",
            "function":  "Java_com_github_luben_zstd_ZstdInputStream_decompressStream"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "184412482065566415555236874295088898965",
            "length":  618
        },
        "id":  "CVE-2026-87877-6ea01eaf",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/luben/zstd-jni/commit/0827ed02551bbd8d6f8e4bbff99d83bf50f91938",
        "target":  {
            "file":  "src/main/native/jni_inputstream_zstd.c",
            "function":  "Java_com_github_luben_zstd_ZstdInputStream_initDStreamWithFastDict"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "319641253589214927682691714920742633531",
            "length":  197
        },
        "id":  "CVE-2026-87877-75843252",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/luben/zstd-jni/commit/393d7311766abbc285b149302c0fe1f94b16d555",
        "target":  {
            "file":  "src/main/java/com/github/luben/zstd/ZstdInputStreamNoFinalizer.java",
            "function":  "setDict"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "260759501099430209686084955000068839085",
            "length":  180
        },
        "id":  "CVE-2026-87877-7aa8d859",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/luben/zstd-jni/commit/393d7311766abbc285b149302c0fe1f94b16d555",
        "target":  {
            "file":  "src/main/java/com/github/luben/zstd/ZstdInputStreamNoFinalizer.java",
            "function":  "setRefMultipleDDicts"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "170568481383276599712457261937841558850",
                "229543292435634669739457181894341155837",
                "239966676698473478615467680705605280924",
                "316521954827615230962982527367976862752",
                "1782777112137163608098832151228703416",
                "243687218256308099706182769162129602069",
                "44473907197886718980651122616738430939",
                "241452303386160364363085439520057276328",
                "96308644468620632196205640924730988480",
                "155845712179438385424340464648960743913",
                "324883013780695734428821937947235404898",
                "220427344998461923630983096383108960916",
                "211238486118982189469621713008742053224",
                "509271047184189664638397160318352573",
                "170047312953424715741489745795234910138",
                "180774321641957468134352898629520814760",
                "313922876077941399343504116828280967646",
                "328398181155141763900388447936397473341",
                "198416365217909942224304075215653827869",
                "172425255981349427187140962028315524355",
                "221558127467684918004295427689360276233",
                "146373912880034541969053830603673507789",
                "209758269282267634250865715673178967409",
                "45163047261668331199604356187905763692",
                "55248796628210121246910545866091397963",
                "290426331214764887909640668559838526735",
                "273428914716255017380188502552431397765",
                "287169420803146240150120402543078614746",
                "301947677362385251556904768136125505827",
                "295139815346021582981260760862717864914",
                "277876504218794093539124688047361793178",
                "101324275571308629146437054480897412129",
                "99468670568881284498727698321378921643",
                "261886494336664274579946354810546380423",
                "283799738403105974941231852441889443234",
                "57233651659815631566488700084457919949",
                "173122525313244002146162733643945812940",
                "45401403496625663275554982797077774346",
                "244377870961414196012990091616507215175",
                "283823839129712826176104920861495360967",
                "327920014761678239691607631967562931124",
                "258785801278506633041075924500645300330",
                "91019171903556262031744676925899459215",
                "166532476911931918194796276115917512638",
                "252225056680332238858977443889690407105",
                "197187053546322423261945972282068375236"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-87877-840bf6c0",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/luben/zstd-jni/commit/0827ed02551bbd8d6f8e4bbff99d83bf50f91938",
        "target":  {
            "file":  "src/main/java/com/github/luben/zstd/ZstdInputStream.java"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "14954420267460264693101135173453685944",
            "length":  1430
        },
        "id":  "CVE-2026-87877-8f0fecfd",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/luben/zstd-jni/commit/0827ed02551bbd8d6f8e4bbff99d83bf50f91938",
        "target":  {
            "file":  "src/main/java/com/github/luben/zstd/ZstdInputStream.java",
            "function":  "readInternal"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "107969190982614359218092147501005512093",
            "length":  291
        },
        "id":  "CVE-2026-87877-99456351",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/luben/zstd-jni/commit/393d7311766abbc285b149302c0fe1f94b16d555",
        "target":  {
            "file":  "src/main/java/com/github/luben/zstd/ZstdOutputStreamNoFinalizer.java",
            "function":  "setDict"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "178691566480125545083897481397429913705",
                "27026733835453101681325318386225434173",
                "20934101978140110714062890983352037764",
                "179140947726698074228252074248609993748",
                "89636334816656029911195590785086593846",
                "158370242423049237151607850163621086388",
                "151746389891425922919089302863208347394",
                "321943947574852714368023088035248451814",
                "255100236820680088504400827479307032463",
                "147616016809210890368784642433687314213",
                "128963053751841334991569586428204005292",
                "137660504888678578059300644952571377781",
                "302352291930140934867009889874820270045",
                "214419353473350375573736753334796896725",
                "286120859013870098928390477959876746483",
                "193937137488937287396410023505088017496",
                "137879611079704377550710311363980321724",
                "95556320824569977235608554187261800635",
                "157713266669716739341679683316827858601",
                "20248207013033163068656988092585629837",
                "97481675661896979692186818919763540292",
                "274376054270777021191335947688032896307",
                "268454005763589359639216224402057876766",
                "93186406993453685997257278262263178681",
                "336421164699667983775742936469831282665",
                "337196388830807224904092119692708052936",
                "185758476731149326719779797168949903637",
                "131101032005908879786534990203064634408",
                "301222299873870999727819752897364047682",
                "145775362545413186109898949107002192056",
                "103491316954883803443801939505861065848",
                "303524260623436864380726155674802745896",
                "52330583718710554257385845190366448543",
                "128963053751841334991569586428204005292",
                "328771868482696711886931879688959971085",
                "218991712009611854041375403707769962990",
                "139773119057406227983270607052558271282",
                "108206242679865708297775771039780479658"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-87877-9b602d16",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/luben/zstd-jni/commit/0827ed02551bbd8d6f8e4bbff99d83bf50f91938",
        "target":  {
            "file":  "src/main/native/jni_inputstream_zstd.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "74455674866543267600323183610353566425",
                "104303472910255849574009696782222497627",
                "125424914868468814562900959445886372296",
                "160545172446603814756871854605618253528",
                "282481271018160306216050242828482235492",
                "40713340882558282911128258701333885729",
                "280520504329013798854554905856858736514",
                "225254474602493753919964394705260136934",
                "336087237197818649892450586568309516894",
                "191937646250162431147149798881614586886",
                "99884675316341602085583605478731896591",
                "46356239636191228421164252797994197140",
                "117728383546245102028786931062141257421",
                "332907289521509766774353044362251331685",
                "149913402196823921892226963591376609411",
                "137356514208070631661453990621757444244",
                "241692203275808010759599086382472996411",
                "236729460068367658912698159815895444773",
                "17567403461232829665962412072086926009",
                "199490092555280766509022487279932998000",
                "58683591593303962060913105293615216808",
                "3039807520169150701671137231814646489",
                "310294753027526759919583350045936373997",
                "335657711617037135027162529693383550957",
                "230976928102971873851317510544797308782",
                "261120791004201477057035928767954478416",
                "234652052280607766069399070334468659768",
                "309935255291308959642482893046965746427",
                "320274593056442929328309558740021021134",
                "227250235862692399237395374503236582599",
                "226914302866278220457606174908179334529",
                "328025982446031431156972514719456948442",
                "277045177588055439848021572331963836012",
                "31604907878431848040837143662393386333",
                "164898943394301030715460811086661431216",
                "208040746012957378269183237993613361424",
                "332092226985985638053500727384286801683",
                "18311215638409940417227595265372805362",
                "124848993726531244568356616851106381416",
                "92187924838632831764227527745790605567",
                "101276177592573537920611283631906549510",
                "45120770702661914034069784489441024563",
                "271574723997082877010650472662369532360",
                "52815045351248476456535127859446677830",
                "19183470307466171212650007824213115873",
                "41011123896315914607609544584747345833",
                "271496040356161696355184168134177719807",
                "323819342324308088686354313601676606579",
                "116068075780665376085745048107411919215",
                "212962310549434437267520000132227545208",
                "123292615164364238921147073077726294552",
                "293946064409153490040355912215641564531",
                "212319137029919694061585596806814969983",
                "128103863884348929675076993732087118886",
                "121174977646609686955234775707204251124",
                "263206777839316912105896955636470416970",
                "169474696394765377379573305555595824081",
                "241893609724057024704766270038336719111",
                "222435154897144962146478483517005856289",
                "159633936964226236478603839187288978792",
                "98025755611052609260852558549916351515",
                "32769167042404322289623550003151445846",
                "73426124730689841056298799432364177945",
                "302234525767176018423345985768003806461",
                "4113670512980813352479408306603414075",
                "300902234690768657683377193768542158047"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-87877-9c0e224b",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/luben/zstd-jni/commit/393d7311766abbc285b149302c0fe1f94b16d555",
        "target":  {
            "file":  "src/main/java/com/github/luben/zstd/ZstdOutputStreamNoFinalizer.java"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "96156479135770289450050622847482613871",
            "length":  123
        },
        "id":  "CVE-2026-87877-a01c1937",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/luben/zstd-jni/commit/f38f9a1563113d96d0fc38baee543f7457dd8a8e",
        "target":  {
            "file":  "src/main/java/com/github/luben/zstd/BaseZstdBufferDecompressingStreamNoFinalizer.java",
            "function":  "hasRemaining"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "97082945452581887555177505813648299677",
            "length":  208
        },
        "id":  "CVE-2026-87877-a1a29e24",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/luben/zstd-jni/commit/0827ed02551bbd8d6f8e4bbff99d83bf50f91938",
        "target":  {
            "file":  "src/main/java/com/github/luben/zstd/ZstdInputStream.java",
            "function":  "setDict"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "323556055200443188316258958117677726716",
            "length":  140
        },
        "id":  "CVE-2026-87877-aa73e27e",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/luben/zstd-jni/commit/0827ed02551bbd8d6f8e4bbff99d83bf50f91938",
        "target":  {
            "file":  "src/main/java/com/github/luben/zstd/ZstdInputStream.java",
            "function":  "ZstdInputStream"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "271463915713822081245877430838300272161",
            "length":  180
        },
        "id":  "CVE-2026-87877-ad6751c0",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/luben/zstd-jni/commit/f38f9a1563113d96d0fc38baee543f7457dd8a8e",
        "target":  {
            "file":  "src/main/java/com/github/luben/zstd/BaseZstdBufferDecompressingStreamNoFinalizer.java",
            "function":  "setLongMax"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "242983979289756636978174893894911169283",
                "157823411836278810979700492519583258858",
                "47982388172284482667079231190836641912",
                "142002538935986523140505977783435642687",
                "70654406038950244899492554068964697791",
                "256841266079176367404669460587415964017",
                "136130365917502750732790875301653462261",
                "307914870517560413069750160813139035083",
                "70654406038950244899492554068964697791",
                "256841266079176367404669460587415964017",
                "136130365917502750732790875301653462261",
                "307914870517560413069750160813139035083"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-87877-cf1cd55a",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/luben/zstd-jni/commit/3216860eea289fbbae0b191c0a4fd8b72dad949c",
        "target":  {
            "file":  "src/main/native/jni_zstd.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "6130561471615133004258603361745015963",
            "length":  503
        },
        "id":  "CVE-2026-87877-e402cad3",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/luben/zstd-jni/commit/3216860eea289fbbae0b191c0a4fd8b72dad949c",
        "target":  {
            "file":  "src/main/native/jni_zstd.c",
            "function":  "Java_com_github_luben_zstd_Zstd_findDirectByteBufferFrameCompressedSize"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "243452810049814927721413726162029308560",
            "length":  552
        },
        "id":  "CVE-2026-87877-e43e017d",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/luben/zstd-jni/commit/3216860eea289fbbae0b191c0a4fd8b72dad949c",
        "target":  {
            "file":  "src/main/native/jni_zstd.c",
            "function":  "Java_com_github_luben_zstd_Zstd_decompressedDirectByteBufferSize"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "319641253589214927682691714920742633531",
            "length":  197
        },
        "id":  "CVE-2026-87877-e4d70bd4",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/luben/zstd-jni/commit/f38f9a1563113d96d0fc38baee543f7457dd8a8e",
        "target":  {
            "file":  "src/main/java/com/github/luben/zstd/BaseZstdBufferDecompressingStreamNoFinalizer.java",
            "function":  "setDict"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "169309054857599887673336342145114688531",
            "length":  278
        },
        "id":  "CVE-2026-87877-f5aa3ca4",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/luben/zstd-jni/commit/393d7311766abbc285b149302c0fe1f94b16d555",
        "target":  {
            "file":  "src/main/java/com/github/luben/zstd/ZstdInputStreamNoFinalizer.java",
            "function":  "setDict"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "233600532191171171471086635846812889960",
            "length":  172
        },
        "id":  "CVE-2026-87877-f9d2726e",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/luben/zstd-jni/commit/393d7311766abbc285b149302c0fe1f94b16d555",
        "target":  {
            "file":  "src/main/java/com/github/luben/zstd/ZstdInputStreamNoFinalizer.java",
            "function":  "close"
        }
    }
]
vanir_signatures_modified 
"2026-10-21T11:19:17Z"