zstd vulnerable to buffer overrun

HIGH 7.5CVE-2022-4899 · GHSA-5c9c-6x87-f9vm · PYSEC-2023-121 · Published 31/03/2023 · updated 17/06/2026

In short

CVE-2022-4899 is a HIGH (CVSS 7.5) vulnerability affecting zstd, github.com/facebook/zstd, zstandard (facebook).
Chance of exploitation in the next 30 days (EPSS): 1.6%, higher than 75.6% of all vulnerabilities.
Fix: update to 1.5.4, 1.5.4.0 or later.

Package	Affected versions	Patched versions
zstd PyPI	`< 1.5.4< 1.5.4.0`	`1.5.41.5.4.0`
github.com/facebook/zstd SwiftURL	`< 1.5.4`	`1.5.4`
zstandard facebook	`= 1.4.10`	No fix yet

Description

A vulnerability was found in zstd v1.4.10, where an attacker can supply an empty string as an argument to the command line tool to cause buffer overrun.

NVD description

A vulnerability was found in zstd v1.4.10, where an attacker can supply empty string as an argument to the command line tool to cause buffer overrun.

References

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free