Data Amplification Vulnerability in ezstd by silviucpp

CVE-2026-119434

What is CVE-2026-119434?

The ezstd library by silviucpp is compromised by a vulnerability that allows attackers to exploit the handling of highly compressed data. Specifically, an attacker can supply a zstd frame to the decompression function, causing excessive memory allocation that can exhaust system resources and terminate the Erlang VM. This occurs because the function fails to enforce a buffer size limit on the declared content size of a frame, presenting significant risks in environments utilizing this library for data processing. Attackers can exploit this issue with even small frames while the allocation process occurs inside a Native Implemented Function (NIF), leading to the complete shutdown of the application node.

References