---
id: CVE-2026-89045
title: >-
  zstd-jni versions 1.4.8-4 through 1.5.7-13 fail to validate negative length
  parameters in ZstdInputStreamNoFinalizer.read(), allowing attackers to trigger
  infinite loops
summary: >-
  zstd-jni versions 1.4.8-4 through 1.5.7-13 fail to validate negative length
  parameters in ZstdInputStreamNoFinalizer.read(), allowing attackers to trigger
  infinite loops. Attackers can pass negative length values to cause the read
  method…
severity: medium
cvss: 4
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'
cwe:
  - CWE-835
vendor: luben
product: zstd-jni
affected:
  - zstd-jni >= 1.4.8-4 < 1.5.7-14
published: '2026-09-10'
updated: '2026-09-15'
sourceUpdated: '2026-09-15T15:17:26.880'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89045'
references:
  - url: 'https://github.com/luben/zstd-jni'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/ZstdInputStreamNoFinalizer.java#L133
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/luben/zstd-jni/commit/dd08685ef913a32e76fb27f43470035c06758646
    label: disclosure@vulncheck.com
  - url: 'https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/luben/zstd-jni/security/advisories/GHSA-9jx2-gfp9-phfm'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/zstd-jni-1.4.8-4-through-1.5.7-13-denial-of-service-via-negative-length
    label: disclosure@vulncheck.com
  - url: 'https://github.com/luben/zstd-jni/security/advisories/GHSA-9jx2-gfp9-phfm'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89045.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-89045'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2531570'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-89045'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89045'
tags:
  - nvd
  - cve.org
  - exploit-available
  - csaf
  - vex
  - red-hat
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-15T14:54:22.478650Z'
epss: 0.00177
epssPercentile: 0.06417
ingestedAt: '2026-09-11T14:42:19.866Z'
---

## Overview

zstd-jni versions 1.4.8-4 through 1.5.7-13 fail to validate negative length parameters in ZstdInputStreamNoFinalizer.read(), allowing attackers to trigger infinite loops. Attackers can pass negative length values to cause the read method to spin indefinitely while holding the stream monitor, blocking all other threads from accessing the stream.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Exploit Intelligence, OpenShift Developer Tools and Services, Red Hat build of Apache Camel 4 for Quarkus 3, Red Hat build of Apache Camel for Spring Boot 4, Red Hat build of Apicurio Registry 3, Red Hat build of Debezium 3, … · no fix planned: Exploit Intelligence, OpenShift Developer Tools and Services, Red Hat Fuse 7, Red Hat build of Apache Camel 4 for Quarkus 3, … · updated 2026-09-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89045.json)