CVE-2019-11922: A race condition in the one-pass compression functions of Zstandard prior to version 1.3.8 could allow an a...

Security readout for executives and security teams

Zstandard before version 1.3.8 had a race condition in certain one-pass compression functions. In affected use, an attacker could cause bytes to be written outside the intended output buffer when the application supplied a smaller-than-recommended buffer. Exposure is most likely in applications or packaged systems using embedded or vendor-supplied Zstandard versions before 1.3.8, especially where one-pass compression paths receive attacker-influenced input and use undersized output buffers. Treat this as a dependency hygiene and memory-safety remediation item. Prioritize internet-facing or data-processing services that compress untrusted content, but do not treat it as emergency active exploitation based on the provided evidence. Mitigation focus: Upgrade Zstandard to version 1.3.8 or later where directly embedded.; Apply distribution vendor updates from Ubuntu, openSUSE, Oracle, or relevant package maintainers.; Review applications that statically bundle Zstandard rather than using system packages..

Prepared

Jun 6, 2026, 14:06 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.