Vulnerability · Published Sep 10, 2026 · Assigned by VulnCheck

CVE-2026-89045zstd-jni 1.4.8-4 through 1.5.7-13 Denial of Service via Negative Length

Medium 4.0

In plain English

A medium-severity infinite loop in zstd-jni from luben. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 7% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.0Medium

Exploit odds (30 days)0.2%top 92.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

zstd-jni versions 1.4.8-4 through 1.5.7-13 fail to validate negative length parameters in ZstdInputStreamNoFinalizer.read(), allowing attackers to trigger infinite loops. Attackers can pass negative length values to cause the read method to spin indefinitely while holding the stream monitor, blocking all other threads from accessing the stream.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	zstd-jni-java	no fix listed	DEBIAN-CVE-2026-89045
Debian:13	zstd-jni-java	no fix listed	DEBIAN-CVE-2026-89045
Debian:14	zstd-jni-java	1.5.7-23+ds-1	DEBIAN-CVE-2026-89045
Ubuntu:24.04:LTS	zstd-jni-java	no fix listed	UBUNTU-CVE-2026-89045
Ubuntu:26.04:LTS	zstd-jni-java	no fix listed	UBUNTU-CVE-2026-89045
Ubuntu:26.10	zstd-jni-java	no fix listed	UBUNTU-CVE-2026-89045

Affected products (as reported)

Vendor	Product	Versions
luben	zstd-jni	1.4.8-4 – before 1.5.7-14

Weakness: CWE-835 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

GitHub Security Advisory (GHSA-9jx2-gfp9-phfm) vendor-advisory
Fix commit: reject a negative length in read and readInternal patch
Guard that never checks a negative length at v1.5.7-13 technical-description
zstd-jni v1.5.7-14 Release Notes release-notes
luben/zstd-jni product
VulnCheck Advisory: zstd-jni 1.4.8-4 through 1.5.7-13 Denial of Service via Negative Length third-party-advisory