silviucpp ezstd up to 1.2.4 Dictionary Decompression c_src/ezstd_nif.cc ezstd:decompress_using_ddict allocation of resources

Summaryinfo

A vulnerability identified as problematic has been detected in silviucpp ezstd up to 1.2.4. This impacts the function ezstd:decompress_using_ddict of the file c_src/ezstd_nif.cc of the component Dictionary Decompression. This manipulation causes allocation of resources. This vulnerability is handled as CVE-2026-119434. The attack can be initiated remotely. There is not any exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability has been found in silviucpp ezstd up to 1.2.4 and classified as problematic. Affected by this vulnerability is the function ezstd:decompress_using_ddict of the file c_src/ezstd_nif.cc of the component Dictionary Decompression. The manipulation with an unknown input leads to a allocation of resources vulnerability. The CWE definition for the vulnerability is CWE-770. The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor. As an impact it is known to affect availability. The summary by CVE is:

Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in silviucpp ezstd allows an attacker who supplies a zstd frame to ezstd:decompress_using_ddict/2 to exhaust memory and terminate the Erlang VM via a small frame that declares a very large content size. zstd_nif_decompress_using_ddict in c_src/ezstd_nif.cc reads the frame's declared content size with ZSTD_getFrameContentSize and passes it directly to enif_make_new_binary, without the 1 GiB MAX_BUFFER_SIZE check that ezstd:decompress/1 applies before allocating. A valid 65,550-byte frame of RLE blocks declaring 2 GiB is rejected by ezstd:decompress/1 but is fully allocated and decompressed by the dictionary path. The allocation happens inside a NIF, so when it exceeds the memory available to the VM the operating system kills the whole node rather than the calling process. This issue affects ezstd: from 1.0.5 before 1.2.5.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-119434 since 10/30/2026. The exploitation appears to be easy. The attack can be launched remotely. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1499 according to MITRE ATT&CK.

Upgrading to version 1.2.5 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• silviucpp

Name

• ezstd

Version

• 1.2.0
• 1.2.1
• 1.2.2
• 1.2.3
• 1.2.4

Website

• Product: https://github.com/silviucpp/ezstd/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion