CVE-2026-89045
zstd-jni 1.4.8-4 through 1.5.7-13 Denial of Service via Negative Length
CVSS Score
4.0
EPSS Score
0.0%
EPSS Percentile
0th
zstd-jni versions 1.4.8-4 through 1.5.7-13 fail to validate negative length parameters in ZstdInputStreamNoFinalizer.read(), allowing attackers to trigger infinite loops. Attackers can pass negative length values to cause the read method to spin indefinitely while holding the stream monitor, blocking all other threads from accessing the stream.
| CWE | CWE-835 |
| Vendor | luben |
| Product | zstd-jni |
| Published | Sep 10, 2026 |
| Last Updated | Sep 15, 2026 |
Stay Ahead of the Next One
Get instant alerts for luben zstd-jni
Be the first to know when new medium vulnerabilities affecting luben zstd-jni are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
Low
Affected Versions
luben / zstd-jni
1.4.8-4 < 1.5.7-14
References
github.com: https://github.com/luben/zstd-jni/security/advisories/GHSA-9jx2-gfp9-phfm github.com: https://github.com/luben/zstd-jni/commit/dd08685ef913a32e76fb27f43470035c06758646 github.com: https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/ZstdInputStreamNoFinalizer.java#L133 github.com: https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14 github.com: https://github.com/luben/zstd-jni vulncheck.com: https://www.vulncheck.com/advisories/zstd-jni-1.4.8-4-through-1.5.7-13-denial-of-service-via-negative-length
Credits
Yu Bao, PayPal Cyber Security Team