zstd-jni 1.4.8-4-1.5.7-13: Loop Negative Length ZstdInputStreamNoFinalizer.read()
CVE-2026-89045 Published on September 10, 2026
zstd-jni 1.4.8-4 through 1.5.7-13 Denial of Service via Negative Length
zstd-jni versions 1.4.8-4 through 1.5.7-13 fail to validate negative length parameters in ZstdInputStreamNoFinalizer.read(), allowing attackers to trigger infinite loops. Attackers can pass negative length values to cause the read method to spin indefinitely while holding the stream monitor, blocking all other threads from accessing the stream.
Vulnerability Analysis
CVE-2026-89045 can be exploited with local system access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. Public availability of a proof of concept (POC) exploit exists for CVE-2026-89045. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.
Weakness Type
What is an Infinite Loop Vulnerability?
The program contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop. If the loop can be influenced by an attacker, this weakness could allow attackers to consume excessive resources such as CPU or memory.
CVE-2026-89045 has been classified to as an Infinite Loop vulnerability or weakness.
Products Associated with CVE-2026-89045
Want to know whenever a new CVE is published for Red Hat Kafka? stack.watch will email you.
Affected Versions
luben zstd-jni:- Version 1.4.8-4 and below 1.5.7-14 is affected.