CVE-2026-119434— Decompression bomb in ezstd:decompress_using_ddict/2 allows BEAM memory exhaustion via unbounded output buffer

Quick assessment

Affected

silviucpp ezstd

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 silviucpp 的 ezstd 库中存在一个“高度压缩数据处理不当（数据放大）”漏洞。攻击者可向函数提供一个 Zstd 帧，该帧声明了极大的内容大小，但实际帧体非常小。利用此漏洞，攻击者能够耗尽系统内存并导致 Erlang 虚拟机（VM）终止。具体而言，中的函数通过读取帧中声明的内容大小，并直接将其传递给进行内存分配。然而，该函数缺少在分配前执行的 1 GiB 检查。因此，一个大小为 65,550 字节、由 RLE 块组成且声明内容为 2 GiB 的合法帧，会被拒绝，却能在字典路径（dict

CVSS 6.9 · Medium Updated Nov 06, 2026

Possible ATT&CK Techniques 2 AI

T1190 · Exploit Public-Facing Application T1499.003 · Application Exhaustion Flood

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Decompression bomb in ezstd:decompress_using_ddict/2 allows BEAM memory exhaustion via unbounded output buffer

Source: CVE Program / CVE List V5

Vulnerability Description

Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in silviucpp ezstd allows an attacker who supplies a zstd frame to ezstd:decompress_using_ddict/2 to exhaust memory and terminate the Erlang VM via a small frame that declares a very large content size. zstd_nif_decompress_using_ddict in c_src/ezstd_nif.cc reads the frame's declared content size with ZSTD_getFrameContentSize and passes it directly to enif_make_new_binary, without the 1 GiB MAX_BUFFER_SIZE check that ezstd:decompress/1 applies before allocating. A valid 65,550-byte frame of RLE blocks declaring 2 GiB is rejected by ezstd:decompress/1 but is fully allocated and decompressed by the dictionary path. The allocation happens inside a NIF, so when it exceeds the memory available to the VM the operating system kills the whole node rather than the calling process. This issue affects ezstd: from 1.0.5 before 1.2.5.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Source: CVE Program / CVE List V5

Vulnerability Type

对高度压缩数据的处理不恰当(数据放大攻击)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
silviucpp	ezstd	1.0.5 ~ 1.2.5	`cpe:2.3:a:silviucpp:ezstd::::::::`
silviucpp	ezstd	6730128b1d35eca02a2028671421471ff651f423 ~ e34f4a4f6dc18d990d1cece2d5fceef8e934a195	`cpe:2.3:a:silviucpp:ezstd::::::::`

II. Public POCs for CVE-2026-119434

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-119434

请登录查看更多情报信息。

Other References for CVE-2026-119434 (5)

https://github.com/silviucpp/ezstd/releases/tag/v1.2.5 release-notes related
https://osv.dev/vulnerability/EEF-CVE-2026-119434 related
https://cna.erlef.org/cves/CVE-2026-119434.html related third-party-advisory
https://github.com/silviucpp/ezstd/commit/e34f4a4f6dc18d990d1cece2d5fceef8e934a195 patch
https://github.com/silviucpp/ezstd/commit/6730128b1d35eca02a2028671421471ff651f423 related

https://www.cve.org/CVERecord?id=CVE-2026-119434

IV. Related Vulnerabilities

Same weakness: CWE-409