---
id: CVE-2026-119434
title: >-
  Decompression bomb in ezstd:decompress_using_ddict/2 allows BEAM memory
  exhaustion via unbounded output buffer
summary: >-
  Improper Handling of Highly Compressed Data (Data Amplification) vulnerability
  in silviucpp ezstd allows an attacker who supplies a zstd frame to
  ezstd:decompress_using_ddict/2 to exhaust memory and terminate the Erlang VM
  via a small fr…
severity: medium
cvss: 6.9
cvssVector: 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'
cvssSource: cna
cwe:
  - CWE-409
vendor: silviucpp
product: ezstd
affected:
  - ezstd >= 1.0.5 < 1.2.5
  - >-
    silviucpp/ezstd >= 6730128b1d35eca02a2028671421471ff651f423 <
    e34f4a4f6dc18d990d1cece2d5fceef8e934a195
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T20:45:27.204341Z'
published: '2026-11-05'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T20:45:33.490Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-119434'
references:
  - url: 'https://github.com/silviucpp/ezstd/releases/tag/v1.2.5'
    label: ezstd v1.2.5 release notes
  - url: 'https://cna.erlef.org/cves/CVE-2026-119434.html'
    label: EEF CNA record for CVE-2026-119434
  - url: 'https://osv.dev/vulnerability/EEF-CVE-2026-119434'
    label: OSV record EEF-CVE-2026-119434
  - url: >-
      https://github.com/silviucpp/ezstd/commit/6730128b1d35eca02a2028671421471ff651f423
    label: Introducing commit 6730128 in silviucpp/ezstd
  - url: >-
      https://github.com/silviucpp/ezstd/commit/e34f4a4f6dc18d990d1cece2d5fceef8e934a195
    label: Fix commit e34f4a4 in silviucpp/ezstd
tags:
  - cve.org
ingestedAt: '2026-11-05T22:38:31.878Z'
---

## Overview

Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in silviucpp ezstd allows an attacker who supplies a zstd frame to ezstd:decompress_using_ddict/2 to exhaust memory and terminate the Erlang VM via a small frame that declares a very large content size.

zstd_nif_decompress_using_ddict in c_src/ezstd_nif.cc reads the frame's declared content size with ZSTD_getFrameContentSize and passes it directly to enif_make_new_binary, without the 1 GiB MAX_BUFFER_SIZE check that ezstd:decompress/1 applies before allocating. A valid 65,550-byte frame of RLE blocks declaring 2 GiB is rejected by ezstd:decompress/1 but is fully allocated and decompressed by the dictionary path. The allocation happens inside a NIF, so when it exceeds the memory available to the VM the operating system kills the whole node rather than the calling process.

This issue affects ezstd: from 1.0.5 before 1.2.5.

## Affected

- `ezstd >= 1.0.5 < 1.2.5`
- `silviucpp/ezstd >= 6730128b1d35eca02a2028671421471ff651f423 < e34f4a4f6dc18d990d1cece2d5fceef8e934a195`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

### Workarounds

Replace calls to ezstd:decompress_using_ddict/2 with the streaming API: create a context with ezstd:create_decompression_context/1 using a small output buffer, attach the dictionary with ezstd:select_ddict/2, and decompress with ezstd:decompress_streaming/2. The streaming path decompresses into the caller-sized buffer and gives up with {error, decompressor_stuck} after 1000 chunks, so a 64 KiB buffer caps a single call at 64 MiB of output. Treat that error as a rejected input. Legitimate frames whose output exceeds 1000 times the buffer size fail the same way, so size the buffer for the largest expected payload.