CVE-2026-89045 — zstd-jni 1.4.8-4 through 1.5.7-13 Denial of Service via Negative Length
zstd-jni versions 1.4.8-4 through 1.5.7-13 fail to validate negative length parameters in ZstdInputStreamNoFinalizer.read(), allowing attackers to trigger infinite loops. Attack…
Published: 2026-09-10 · CVSS: 5.1 · CVSS 4.0
zstd-jni versions 1.4.8-4 through 1.5.7-13 fail to validate negative length parameters in ZstdInputStreamNoFinalizer.read(), allowing attackers to trigger infinite loops. Attackers can pass negative length values to cause the read method to spin indefinitely while holding the stream monitor, blocking all other threads from accessing the stream.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7