---
id: CVE-2026-89046
title: >-
  zstd-jni: zstd-jni: Information disclosure or denial of service via
  out-of-bounds read (CVE-2026-89046)
summary: >-
  A flaw was found in zstd-jni. This out-of-bounds read vulnerability in the
  Zstd.getFrameContentSize function occurs because it fails to validate negative
  srcPosition arguments. A remote attacker can supply negative offset values,
  bypassing…
severity: high
cvss: 8.2
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H'
cvssSource: vendor
cwe: CWE-125
vendor: Red Hat
product: Red Hat Ceph Storage 9
affected:
  - exploit_intelligence
  - openshift_developer_tools_and_services
  - build_of_apache_camel_4_for_quarkus 3
  - build_of_apache_camel_for_spring_boot 4
  - build_of_apicurio_registry 3
  - build_of_debezium 3
  - ceph_storage 9
  - enterprise_linux 8
  - enterprise_linux 9
  - jboss_enterprise_application_platform 8
  - jboss_enterprise_application_platform_expansion_pack
  - openshift_ai_rhoai
published: '2026-09-10'
updated: '2026-09-21'
sourceUpdated: '2026-09-21T16:36:55+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89046.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89046.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-89046'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2531577'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-89046'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89046'
  - url: 'https://github.com/luben/zstd-jni'
  - url: >-
      https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/Zstd.java#L730
  - url: >-
      https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/native/jni_zstd.c#L87
  - url: >-
      https://github.com/luben/zstd-jni/commit/dd08685ef913a32e76fb27f43470035c06758646
  - url: 'https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14'
  - url: 'https://github.com/luben/zstd-jni/security/advisories/GHSA-rm53-6wf5-f34m'
  - url: >-
      https://www.vulncheck.com/advisories/zstd-jni-1.5.5-6-through-1.5.7-13-out-of-bounds-read-via-negative-offset
tags:
  - csaf
  - vex
  - red-hat
  - cve.org
  - exploit-available
epss: 0.00571
epssPercentile: 0.46031
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-10T18:07:52.440977Z'
ingestedAt: '2026-09-11T16:45:48.028Z'
---

## Overview

A flaw was found in zstd-jni. This out-of-bounds read vulnerability in the Zstd.getFrameContentSize function occurs because it fails to validate negative srcPosition arguments. A remote attacker can supply negative offset values, bypassing bounds checks and accessing the native frame-header parser. This can lead to out-of-bounds memory reads, resulting in information disclosure or a Java Virtual Machine (JVM) crash.

## Vendor advisories

- **Red Hat VEX** · Important · affected: Exploit Intelligence, OpenShift Developer Tools and Services, Red Hat build of Apache Camel 4 for Quarkus 3, Red Hat build of Apache Camel for Spring Boot 4, Red Hat build of Apicurio Registry 3, Red Hat build of Debezium 3, … · no fix planned: Red Hat Ceph Storage 9, Exploit Intelligence, OpenShift Developer Tools and Services, Red Hat build of Apache Camel 4 for Quarkus 3, … · updated 2026-09-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89046.json)

**zstd-jni: zstd-jni: Information disclosure or denial of service via out-of-bounds read** — rated Important by Red Hat. Released 2026-09-10, updated 2026-09-21.

Affected:

- Exploit Intelligence
- OpenShift Developer Tools and Services
- Red Hat build of Apache Camel 4 for Quarkus 3
- Red Hat build of Apache Camel for Spring Boot 4
- Red Hat build of Apicurio Registry 3
- Red Hat build of Debezium 3
- Red Hat Ceph Storage 9
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat JBoss Enterprise Application Platform 8
- Red Hat JBoss Enterprise Application Platform Expansion Pack
- Red Hat OpenShift AI (RHOAI)

No fix planned:

- Red Hat Ceph Storage 9
- Exploit Intelligence
- OpenShift Developer Tools and Services
- Red Hat build of Apache Camel 4 for Quarkus 3
- Red Hat build of Apache Camel for Spring Boot 4
- Red Hat build of Apicurio Registry 3
- Red Hat build of Debezium 3
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat JBoss Enterprise Application Platform 8
- Red Hat JBoss Enterprise Application Platform Expansion Pack
- Red Hat OpenShift AI (RHOAI)

Not affected:

- Red Hat Fuse 7
- Red Hat Hardened Images
- Red Hat OpenShift AI (RHOAI)

## Remediation

Fix deferred

Workarounds / mitigations:

- Update to a product release containing zstd-jni 1.5.7-14 or later. Until updated, validate source positions and reject negative offsets before calling Zstd.getFrameContentSize. Do not pass attacker-controlled offsets to this method without validation.