Description
A vulnerability was found in zstd v1.4.10, where an attacker can supply empty string as an argument to the command line tool to cause buffer overrun.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | zstd | zstd 1.5.4 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libzstd | 1.5.4+dfsg2-1 | — |
| Debian 13 | libzstd | 1.5.4+dfsg2-1 | — |
| Debian 12 | libzstd | 1.5.4+dfsg2-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | libzstd | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9 | mysql +6 | 8.0.36-1.el9_3 | RHSA-2024:1141 |
| RHEL 8 | mecab +1 | 0.996-2.module+el8.9.0+21207+6c20cb3d | RHSA-2024:0894 |
| RHEL 8 | mecab-ipadic +1 | 2.7.0.20070801-16.module+el8.9.0+21207+6c20cb3d | RHSA-2024:0894 |
| RHEL 8 | mysql +6 | 8.0.36-1.module+el8.9.0+21207+6c20cb3d | RHSA-2024:0894 |
| RHEL 3 | rh-mysql80-mysql +10 | 8.0.36-1.el7 | RHSA-2024:2619 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 9 | mysql +6 | 8.0.36-1.el9_3 | ALSA-2024:1141 |
| AlmaLinux 8 | mecab +1 | 0.996-2.module_el8.6.0+3340+d764b636 | ALSA-2024:0894 |
| AlmaLinux 8 | mecab-ipadic +1 | 2.7.0.20070801-16.module_el8.6.0+3340+d764b636 | ALSA-2024:0894 |
| AlmaLinux 8 | mysql +6 | 8.0.36-1.module_el8.9.0+3735+82bd6c11 | ALSA-2024:0894 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 8 | mecab | 0.996-2.module+el8.10.0+1676+9b4b6e24 | RLSA-2024:0894 |
| Rocky Linux 8 | mecab-ipadic | 2.7.0.20070801-16.module+el8.10.0+1676+9b4b6e24 | RLSA-2024:0894 |
| Rocky Linux 8 | mysql | 8.0.36-1.module+el8.10.0+1676+9b4b6e24 | RLSA-2024:0894 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP4 | zstd | 1.5.0-150400.3.3.1 | SUSE-SU-2023:1688-1 |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLE Real Time 15 SP3 | zstd | 1.4.4-150000.1.9.1 | SUSE-SU-2023:2074-1 |
| SLE Micro 5.4 | zstd | 1.5.0-150400.3.3.1 | SUSE-SU-2023:1688-1 |
| SLE Micro 5.3 | zstd | 1.5.0-150400.3.3.1 | SUSE-SU-2023:1688-1 |
| SLE Micro 5.2 | zstd | 1.4.4-150000.1.9.1 | SUSE-SU-2023:2074-1 |
| SLE Micro 5.1 | zstd | 1.4.4-150000.1.9.1 | SUSE-SU-2023:2074-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | zstd | 1.5.5-5.1 | openSUSE-SU-2024:13613-1 |
| openSUSE Leap 15.4 | zstd | 1.5.0-150400.3.3.1 | SUSE-SU-2023:1688-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap Micro 5.3 | zstd | 1.5.0-150400.3.3.1 | SUSE-SU-2023:1688-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | zstd +3 | 1.5.2-1.amzn2023.0.3 | ALAS2023-2023-244 |
| Amazon Linux 2 | zstd +3 | 1.5.2-1.amzn2.0.1 | ALAS2-2023-2140 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 2 (CBL-Mariner) | zstd | 1.5.4-1 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 9 | mysql +6 | 8.0.36-1.el9_3 | ELSA-2024-1141 |
| Oracle Linux 8 | mecab +1 | 0.996-2.module+el8.9.0+90153+70413b10 | ELSA-2024-0894 |
| Oracle Linux 8 | mecab-ipadic +1 | 2.7.0.20070801-16.0.1.module+el8.9.0+90153+70413b10 | ELSA-2024-0894 |
| Oracle Linux 8 | mysql +6 | 8.0.36-1.module+el8.9.0+90153+70413b10 | ELSA-2024-0894 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | zstd | < 1.5.4.0 | 1.5.4.0 | GHSA-5c9c-6x87-f9vm |
| SwiftURL | github.com/facebook/zstd | < 1.5.4 | 1.5.4 | GHSA-5c9c-6x87-f9vm |
Advisories 16
- ALSA-2024:0894 Moderate: mysql:8.0 security update AlmaLinux Security Advisories · Nov 5, 2026
- ALSA-2024:1141 Moderate: mysql security update AlmaLinux Security Advisories · Oct 29, 2026
- WID-SEC-2023-2917 Xerox FreeFlow Print Server: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 30, 2026
- RHSA-2024:2619 Red Hat Security Advisory: rh-mysql80-mysql security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2024:1141 Red Hat Security Advisory: mysql security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2024:0894 Red Hat Security Advisory: mysql:8.0 security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- openSUSE-SU-2024:13613-1 libzstd-devel-1.5.5-5.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2023:1688-1 Security update for zstd SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2023:2074-1 Security update for zstd SUSE / openSUSE Security Updates · Feb 4, 2026
- RLSA-2024:0894 Moderate: mysql:8.0 security update Rocky Linux Security Advisories · May 7, 2025
- WID-SEC-2023-1794 Oracle MySQL: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 30, 2024
- ELSA-2024-1141 Moderate: mysql security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Mar 6, 2024
- ELSA-2024-0894 Moderate: mysql:8.0 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Feb 21, 2024
- WID-SEC-2023-2679 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 17, 2023
- ALAS2023-2023-244 Moderate: zstd security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Jul 20, 2023
- ALAS2-2023-2140 Moderate: zstd security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Jul 19, 2023
References
- https://github.com/facebook/zstd/issues/3200
- https://security.netapp.com/advisory/ntap-20230725-0005/
- FEDORA-2023-9ccff0b1b7 vendor-advisory
- FEDORA-2023-492105ed08 vendor-advisory
- FEDORA-2023-a9283d639f vendor-advisory