CVE-2026-89045

Published: Sep 10, 2026Modified: Sep 15, 2026

5.1

Vector

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Show more

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: disclosure@vulncheck.com (Secondary)

Description

zstd-jni versions 1.4.8-4 through 1.5.7-13 fail to validate negative length parameters in ZstdInputStreamNoFinalizer.read(), allowing attackers to trigger infinite loops. Attackers can pass negative length values to cause the read method to spin indefinitely while holding the stream monitor, blocking all other threads from accessing the stream.

Related CWEs

Loop with Unreachable Exit Condition ('Infinite Loop')

The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

References (7)

https://github.com/luben/zstd-jni

Source: disclosure@vulncheck.com

https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/ZstdInputStreamNoFinalizer.java#L133

Source: disclosure@vulncheck.com

https://github.com/luben/zstd-jni/commit/dd08685ef913a32e76fb27f43470035c06758646

Source: disclosure@vulncheck.com

https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14

Source: disclosure@vulncheck.com

https://github.com/luben/zstd-jni/security/advisories/GHSA-9jx2-gfp9-phfm

Source: disclosure@vulncheck.com

https://www.vulncheck.com/advisories/zstd-jni-1.4.8-4-through-1.5.7-13-denial-of-service-via-negative-length

Source: disclosure@vulncheck.com

https://github.com/luben/zstd-jni/security/advisories/GHSA-9jx2-gfp9-phfm

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.