CVE-2026-119434 · Package
NO FIX YET · SEE WHAT TO DO
The decompress_using_ddict function in the Erlang ezstd library allocates memory based on a size the compressed frame declares, without the 1 GiB limit applied by the plain decompress function. A small crafted zstd frame can make the Erlang VM exhaust memory, and the operating system kills the whole node.
first public Nov 5, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Applications that use the ezstd Erlang library from version 1.0.5 up to before 1.2.5 and call decompress_using_ddict on zstd data an outside party can supply. Code that only decompresses trusted data, or that uses only the plain decompress function, is not exposed through this path.
Not affected if ezstd-1.2.5-or-later, trusted-input-only, uses-decompress-not-ddict
Who cares erlang, ezstd, zstd
rebar.lock or mix.lock) and see whether it is from 1.0.5 up to, but not including, 1.2.5.ezstd:decompress_using_ddict that take zstd frames from untrusted input.1.2.5 (the first fixed version, per the affected range 1.0.5 to before 1.2.5)Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in silviucpp ezstd allows an attacker who supplies a zstd frame to ezstd:decompress_using_ddict/2 to exhaust memory and terminate the Erlang VM via a small frame that declares a very large content size.
zstd_nif_decompress_using_ddict in c_src/ezstd_nif.cc reads the frame's declared content size with ZSTD_getFrameContentSize and passes it directly to enif_make_new_binary, without the 1 GiB MAX_BUFFER_SIZE check that ezstd:decompress/1 applies before allocating. A valid 65,550-byte frame of RLE blocks declaring 2 GiB is rejected by ezstd:decompress/1 but is fully allocated and decompressed by the dictionary path. The allocation happens inside a NIF, so when it exceeds the memory available to the VM the operating system kills the whole node rather than the calling process.
This issue affects ezstd: from 1.0.5 before 1.2.5.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.