Nine of fifteen fixes landed in a library nobody chose
Serguey Asael Shinder1 min readToday's Quarkus maintenance release closes fifteen CVEs. Four are in components a developer picked on purpose: Hibernate ORM, Quarkus HTTP security, SmallRye JWT, WebSockets Next. Nine are in zstd-jni - use-after-free, out-of-bounds reads in dictionary constructors, a negative length parameter, a remote use-after-free in dictionary sharing.
Almost nobody chose zstd-jni. It arrived because something in the dependency tree wanted fast compression, and a native binding was the way to get it.
This is the shape of most dependency risk now, and it resists the usual advice. "Audit your dependencies" assumes a list short enough to read and decisions you remember making. A transitive native binding has neither property: it has no line in your build file, no entry in your architecture notes, and a memory-safety surface that the language you chose was supposed to have removed.
What actually helps is narrower than an audit. Know which of your dependencies cross into native code, because that is where the use-after-free lives. Know which of them are maintained by one person. And read the CVE list on a maintenance release rather than the word "maintenance" - today those two things said different things about the same download.