TI-2026-60349 Aliases CVE-2026-89045 GHSA-r8cw-jvfx-h6x5

zstd-jni 1.4.8-4 through 1.5.7-13 Denial of Service via Negative Length

MEDIUM 56CWE-835Published 2026-09-10 · Updated 2026-09-15

Key facts

Attack vector: Local
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · Low
Fix status: Partial Red Hat: 2 fixed, 13 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-835.

Summary

zstd-jni versions 1.4.8-4 through 1.5.7-13 fail to validate negative length parameters in ZstdInputStreamNoFinalizer.read(), allowing attackers to trigger infinite loops. Attackers can pass negative length values to cause the read method to spin indefinitely while holding the stream monitor, blocking all other threads from accessing the stream.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00177 7th percentileScored 2026-11-07

Fix Partial zstd-jni (luben): 1.5.7-14Red Hat: 2 advisoriesRed Hat: 2 fixed, 13 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
luben	zstd-jni	1.4.8-4 to before 1.5.7-14	1.5.7-14	Patch available	CNA

zstd-jni Vendorluben Affected 1.4.8-4 to before 1.5.7-14 Fixed in 1.5.7-14 Patch available CNA

Remediation

Fix · CNA zstd-jni (luben) Fixed in 1.5.7-14

Red Hat 2 advisories

RHSA-2026:69440 Released 2026-09-21 · Red Hat rating Important
Red Hat build of Quarkus 3.33.3.SP2 release and security update
- Red Hat build of Quarkus 3.33.3.SP2
RHSA-2026:69470 Released 2026-09-21 · Red Hat rating Important
Red Hat build of Quarkus 3.27.5.SP2 release and security update
- Red Hat build of Quarkus 3.27.5.SP2

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2026-09-10
luben zstd-jni 1.5.7-14
2 records Highest priority Priority HIGH 1 HIGH, 1 MEDIUM
Other records, highest priority first
- TI-2026-60350 zstd-jni 1.5.5-6 through 1.5.7-13 Out-of-Bounds Read via Negative OffsetPriority HIGH 77
Show all 2 records →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Exploit Intelligence	Affected	No fix planned: Out of support scope
OpenShift Developer Tools and Services	Affected	No fix planned: Out of support scope
Red Hat Ceph Storage 9	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 8	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 9	Affected	No fix yet: Fix deferred
Red Hat Fuse 7	Affected	No fix planned: Out of support scope
Red Hat JBoss Enterprise Application Platform 8	Affected	No fix yet: Fix deferred
Red Hat JBoss Enterprise Application Platform Expansion Pack	Affected	No fix yet: Fix deferred
Red Hat OpenShift AI (RHOAI)	Affected	No fix yet: Fix deferred
Red Hat build of Apache Camel 4 for Quarkus 3	Affected	No fix yet: Fix deferred
Red Hat build of Apache Camel for Spring Boot 4	Affected	No fix yet: Fix deferred
Red Hat build of Apicurio Registry 3	Affected	No fix yet: Fix deferred
Red Hat build of Debezium 3	Affected	No fix yet: Fix deferred
Red Hat build of Quarkus 3.27.5.SP2	Fixed	RHSA-2026:69470
Red Hat build of Quarkus 3.33.3.SP2	Fixed	RHSA-2026:69440

Not affected: 1 product

Red Hat Hardened Images

Timeline

2026-10-02 Threatist record created from CVE-2026-89045
2026-10-03 Alias added: GHSA-r8cw-jvfx-h6x5
2026-10-09 Fix available: RHSA-2026:69440 · Red Hat
2026-10-09 Fix available: RHSA-2026:69470 · Red Hat
2026-10-10 Fix available: Red Hat build of Quarkus 3.27.5.SP2, Red Hat build of Quarkus 3.33.3.SP2 · Red Hat

References

Patch 1

Fix commit: reject a negative length in read and readInternal

Advisory 1

GitHub Security Advisory (GHSA-9jx2-gfp9-phfm)

Other 3

TI-2026-61574 zstd-jni 1.2.0 through 1.5.7-13 Out-of-Bounds Read via ZstdDictDecompress CVSS 4.0HIGH 8.8
TI-2026-60350 zstd-jni 1.5.5-6 through 1.5.7-13 Out-of-Bounds Read via Negative Offset CVSS 4.0HIGH 8.8
TI-2026-59940 zstd-jni 1.1.1 through 1.5.7-13 Out-of-Bounds Read via Direct ByteBuffer Frame-Size Methods CVSS 4.0HIGH 8.8
TI-2026-59916 zstd-jni 1.2.0 through 1.5.7-13 Out-of-Bounds Read via ZstdDictCompress CVSS 4.0HIGH 8.8
TI-2026-61747 luben zstd-jni Dictionary Sharing ZstdCompressCtx.java ZstdCompressCtx.loadDict use after free CVSS 4.0MEDIUM 6.9
TI-2026-59963 zstd-jni 1.3.8-4 through 1.5.7-13 Use-After-Free via Setters Called After close() CVSS 4.0HIGH 7.0

See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences