What’s Vulnerable › Vulnerabilities

CVE-2026-89045: zstd-jni 1.4.8-4 through 1.5.7-13 Denial of Service via Negative Length

• Severity: medium (CVSS 4.0 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-10 · updated 2026-09-15
• Weakness: CWE-835

Description

zstd-jni versions 1.4.8-4 through 1.5.7-13 fail to validate negative length parameters in ZstdInputStreamNoFinalizer.read(), allowing attackers to trigger infinite loops. Attackers can pass negative length values to cause the read method to spin indefinitely while holding the stream monitor, blocking all other threads from accessing the stream.

Affected products

• luben zstd-jni: from 1.4.8-4 before 1.5.7-14 — fixed in 1.5.7-14

How to fix

Upgrade to a fixed version: luben zstd-jni 1.5.7-14. Check the vendor advisory for mitigations.

References

• https://github.com/luben/zstd-jni
• https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/ZstdInputStreamNoFinalizer.java#L133
• https://github.com/luben/zstd-jni/commit/dd08685ef913a32e76fb27f43470035c06758646
• https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14
• https://github.com/luben/zstd-jni/security/advisories/GHSA-9jx2-gfp9-phfm
• https://www.vulncheck.com/advisories/zstd-jni-1.4.8-4-through-1.5.7-13-denial-of-service-via-negative-length
• https://github.com/luben/zstd-jni/security/advisories/GHSA-9jx2-gfp9-phfm

Get alerted when CVE-2026-89045 or the next vulnerability affects your stack