FrankChen021 commented on PR #20228: URL: https://github.com/apache/druid/pull/20228#issuecomment-6306984344
> https://nvd.nist.gov/vuln/detail/cve-2026-90560 may force our hand here @FrankChen021 @capistrant I checked CVE-2026-90560 against Druid and its dependencies. It’s a close sibling of CVE-2026-87795, which we already suppress (analysis in [apache/druid#20236 (comment)](https://github.com/apache/druid/pull/20236#issuecomment-5646494509)): the same missing offset/length bounds check, but in the decompress-side constructor ZstdDictDecompress(byte[] dict, int offset, int length) instead of ZstdDictCompress. It was published a few hours after that analysis, which is why the current suppression block doesn’t list it. Like the other two, it’s fixed only in 1.5.7-14+. Reachability: it can only be triggered if a caller passes attacker-controlled offset/length values to that constructor. - Druid’s only direct zstd-jni usage, CompressionStrategy.ZstdDecompressor/ZstdCompressor, calls Zstd.compress, compressBound, decompressDirectByteBuffer and decompressByteArray. It never uses dictionaries. - I scanned the bytecode of every jar that references zstd-jni (~240 artifacts) for references to ZstdDictDecompress outside zstd-jni’s own package. None was found. This covers the versions we ship: kafka-clients 4.3.1 / 8.3.x-ccs, parquet-hadoop 1.18.x (and 1.16.0 via Delta), avro 1.12.2, orc-core 2.3.1, commons-compress 1.28.0, httpclient5 5.6.4, netty-codec-compression 4.2.17, grpc-netty-shaded 1.82.2, rabbitmq stream-client 0.15.0, hadoop-client-runtime 3.5.0, and the AWS SDK bundle. - A malicious .zst/segment/Kafka payload controls only the compressed bytes, not the Java-level offset/length arguments, so input data can’t reach this path. So, like 87795 and 87823, this is a version-match finding with no reachable path in Druid. My final opinion: I don't want to include this one to be upgraded in druid 39. we can upgrade it after druid 39. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
