---
id: "CVE-2026-119434"
page: "https://infrastack.ai/live/CVE-2026-119434"
kind: "vulnerability"
aliases: ["CVE-2026-119434"]
title: "ezstd: dictionary decompress path lets a small zstd frame kill Erlang node"
severity: "medium"
cvss: 6.9
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["erlang", "ezstd", "package", "zstd"]
not_affected_if: ["ezstd-1.2.5-or-later", "trusted-input-only", "uses-decompress-not-ddict"]
published_at: "2026-11-05T21:18:41+00:00"
first_seen_at: "2026-11-05T21:40:45+00:00"
updated_at: "2026-11-05T21:41:13+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119434", "first_seen_at": "2026-11-05T21:40:45+00:00"}]
exploit_sources: []
---

# ezstd: dictionary decompress path lets a small zstd frame kill Erlang node

Link for people: https://infrastack.ai/live/CVE-2026-119434 (this .md is for agents)

The decompress_using_ddict function in the Erlang ezstd library allocates memory based on a size the compressed frame declares, without the 1 GiB limit applied by the plain decompress function. A small crafted zstd frame can make the Erlang VM exhaust memory, and the operating system kills the whole node.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the ezstd version in the project's lock file (for example `rebar.lock` or `mix.lock`) and see whether it is from `1.0.5` up to, but not including, `1.2.5`.
- Search the code for calls to `ezstd:decompress_using_ddict` that take zstd frames from untrusted input.

## Fix

- ezstd `1.2.5` (the first fixed version, per the affected range 1.0.5 to before 1.2.5)

## Timeline

- 2026-11-05T21:40:45+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119434

## Documents

- [fix] Patch: github.com https://github.com/silviucpp/ezstd/commit/6730128b1d35eca02a2028671421471ff651f423
- [fix] Patch: github.com https://github.com/silviucpp/ezstd/commit/e34f4a4f6dc18d990d1cece2d5fceef8e934a195
- [fix] Release notes: github.com https://github.com/silviucpp/ezstd/releases/tag/v1.2.5

## From the sources

Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in silviucpp ezstd allows an attacker who supplies a zstd frame to ezstd:decompress_using_ddict/2 to exhaust memory and terminate the Erlang VM via a small frame that declares a very large content size.

zstd_nif_decompress_using_ddict in c_src/ezstd_nif.cc reads the frame's declared content size with ZSTD_getFrameContentSize and passes it directly to enif_make_new_binary, without the 1 GiB MAX_BUFFER_SIZE check that ezstd:decompress/1 applies before allocating. A valid 65,550-byte frame of RLE blocks declaring 2 GiB is rejected by ezstd:decompress/1 but is fully allocated and decompressed by the dictionary path. The allocation happens inside a NIF, so when it exceeds the memory available to the VM the operating system kills the whole node rather than the calling process.

This issue affects ezstd: from 1.0.5 before 1.2.5.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_