Read the docs
TI-2026-60350 Aliases CVE-2026-89046GHSA-h98q-h7vh-hjv2

zstd-jni 1.5.5-6 through 1.5.7-13 Out-of-Bounds Read via Negative Offset

Priority HIGH 77CWE-125Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
Low · None · High
Fix status
Partial Red Hat: 17 fixed, 8 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat.

Summary

zstd-jni versions 1.5.5-6 through 1.5.7-13 contain an out-of-bounds read vulnerability in Zstd.getFrameContentSize that fails to validate negative srcPosition arguments. Attackers can supply negative offset values that bypass bounds checks and reach the native frame-header parser, causing out-of-bounds memory reads that lead to information disclosure or JVM crashes.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0065 51st percentileScored 2026-11-07
Fix Partial zstd-jni (luben): 1.5.7-14Red Hat: 17 advisoriesRed Hat: 17 fixed, 8 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
lubenzstd-jni1.5.5-6 to before 1.5.7-141.5.7-14Patch availableCNA
  • zstd-jni Vendorluben Affected 1.5.5-6 to before 1.5.7-14 Fixed in 1.5.7-14 Patch available CNA

Remediation

  • Fix · CNA zstd-jni (luben) Fixed in 1.5.7-14

Red Hat 17 advisories

  • RHSA-2026:95221 Released 2026-11-04 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 8.1.9 XP 6.0.7.GA release
    • Red Hat JBoss Enterprise Application Platform 8.1
  • RHSA-2026:88159 Released 2026-10-22 · Red Hat rating Critical
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.17 security update.
    • OpenShift Developer Tools and Services 4.17 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:88158 Released 2026-10-22 · Red Hat rating Critical
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.19 security update.
    • OpenShift Developer Tools and Services 4.19 registry.redhat.io/ocp-tools-4/jenkins-rhel9
Show 14 more Red Hat advisories
  • RHSA-2026:88157 Released 2026-10-22 · Red Hat rating Critical
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.20 security update.
    • OpenShift Developer Tools and Services 4.20 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:88156 Released 2026-10-22 · Red Hat rating Critical
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.16 security update.
    • OpenShift Developer Tools and Services 4.16 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:88155 Released 2026-10-22 · Red Hat rating Critical
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.21 security update.
    • OpenShift Developer Tools and Services 4.21 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:88154 Released 2026-10-22 · Red Hat rating Critical
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.22 security update.
    • OpenShift Developer Tools and Services 4.22 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:88153 Released 2026-10-22 · Red Hat rating Critical
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.18 security update.
    • OpenShift Developer Tools and Services 4.18 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:88151 Released 2026-10-22 · Red Hat rating Critical
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.14 security update.
    • OpenShift Developer Tools and Services 4.14 registry.redhat.io/ocp-tools-4/jenkins-rhel8
  • RHSA-2026:88152 Released 2026-10-22 · Red Hat rating Critical
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.12 security update.
    • OpenShift Developer Tools and Services 4.12 registry.redhat.io/ocp-tools-4/jenkins-rhel8
  • RHSA-2026:88149 Released 2026-10-22 · Red Hat rating Critical
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.13 security update.
    • OpenShift Developer Tools and Services 4.13 registry.redhat.io/ocp-tools-4/jenkins-rhel8
  • RHSA-2026:88150 Released 2026-10-22 · Red Hat rating Critical
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.15 security update.
    • OpenShift Developer Tools and Services 4.15 registry.redhat.io/ocp-tools-4/jenkins-rhel8
  • RHSA-2026:84734 Released 2026-10-19 · Red Hat rating Critical
    RHOAI 3.4.5 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-ai-gateway-payload-processing-rhel9, registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-autorag-rhel9 +47
  • RHSA-2026:71675 Released 2026-09-24 · Red Hat rating Important
    Red Hat Build of Apache Camel 4.18.4 for Spring Boot release.
    • Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16
  • RHSA-2026:70257 Released 2026-09-22 · Red Hat rating Important
    Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 update is now available (RHBQ 3.33.3.SP2)
    • Red Hat Build of Apache Camel 3.33.3.SP2 com.github.luben.zstd-jni-1.5.7.16-rhel8-redhat-00001.jar, com.squareup.wire.wire-runtime-6.4.7.jar, com.squareup.wire.wire-runtime-jvm-6.4.7.jar +7
  • RHSA-2026:69440 Released 2026-09-21 · Red Hat rating Important
    Red Hat build of Quarkus 3.33.3.SP2 release and security update
    • Red Hat build of Quarkus 3.33.3.SP2
  • RHSA-2026:69470 Released 2026-09-21 · Red Hat rating Important
    Red Hat build of Quarkus 3.27.5.SP2 release and security update
    • Red Hat build of Quarkus 3.27.5.SP2

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    luben zstd-jni 1.5.7-14

    2 records Highest priority Priority HIGH 1 HIGH, 1 MEDIUM

    Other records, highest priority first

    • TI-2026-60349 zstd-jni 1.4.8-4 through 1.5.7-13 Denial of Service via Negative LengthPriority MEDIUM 56
    Show all 2 records →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Exploit IntelligenceAffectedNo fix yet
OpenShift Developer Tools and ServicesAffectedNo fix yet
Red Hat Ceph Storage 9AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 9AffectedNo fix yet
Red Hat JBoss Enterprise Application Platform Expansion PackAffectedNo fix yet
Red Hat build of Apache Camel 4 for Quarkus 3AffectedNo fix yet
Red Hat build of Apicurio Registry 3AffectedNo fix yet
Red Hat build of Debezium 3AffectedNo fix yet
OpenShift Developer Tools and Services 4.12Fixed RHSA-2026:88152
OpenShift Developer Tools and Services 4.13Fixed RHSA-2026:88149
OpenShift Developer Tools and Services 4.14Fixed RHSA-2026:88151
OpenShift Developer Tools and Services 4.15Fixed RHSA-2026:88150
OpenShift Developer Tools and Services 4.16Fixed RHSA-2026:88156
OpenShift Developer Tools and Services 4.17Fixed RHSA-2026:88159
OpenShift Developer Tools and Services 4.18Fixed RHSA-2026:88153
OpenShift Developer Tools and Services 4.19Fixed RHSA-2026:88158
OpenShift Developer Tools and Services 4.20Fixed RHSA-2026:88157
OpenShift Developer Tools and Services 4.21Fixed RHSA-2026:88155
OpenShift Developer Tools and Services 4.22Fixed RHSA-2026:88154
Red Hat Build of Apache Camel 3.33.3.SP2Fixed RHSA-2026:70257
Red Hat JBoss Enterprise Application Platform 8.1Fixed RHSA-2026:95221
Red Hat OpenShift AI 3.4Fixed RHSA-2026:84734
Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16Fixed RHSA-2026:71675
Red Hat build of Quarkus 3.27.5.SP2Fixed RHSA-2026:69470
Red Hat build of Quarkus 3.33.3.SP2Fixed RHSA-2026:69440
Not affected: 18 products
  • OpenShift Developer Tools and Services 4.12
  • OpenShift Developer Tools and Services 4.13
  • OpenShift Developer Tools and Services 4.14
  • OpenShift Developer Tools and Services 4.15
  • OpenShift Developer Tools and Services 4.16
  • OpenShift Developer Tools and Services 4.17
  • OpenShift Developer Tools and Services 4.18
  • OpenShift Developer Tools and Services 4.19
  • OpenShift Developer Tools and Services 4.20
  • OpenShift Developer Tools and Services 4.21
  • OpenShift Developer Tools and Services 4.22
  • Red Hat Build of Apache Camel 3.33.3.SP2
  • Red Hat Enterprise Linux 8
  • Red Hat Fuse 7
  • Red Hat Hardened Images
  • Red Hat JBoss Enterprise Application Platform 8
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift AI 3.4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-89046
  2. 2026-10-03 Alias added: GHSA-h98q-h7vh-hjv2
  3. 2026-10-09 Fix available: RHSA-2026:69440 · Red Hat
  4. 2026-10-09 Fix available: RHSA-2026:69470 · Red Hat
  5. 2026-10-09 Fix available: RHSA-2026:70257 · Red Hat
  6. 2026-10-09 Fix available: Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP2, Red Hat build of Quarkus 3.27.5.SP2, Red Hat build of Quarkus 3.33.3.SP2 · Red Hat
  7. 2026-10-10 Fix available: Red Hat Build of Apache Camel 3.33.3.SP2 · Red Hat
  8. 2026-10-13 Affected versions changed · Red Hat
  9. 2026-10-16 EPSS moved to the 50th–90th percentile
  10. 2026-10-20 Fix available: RHSA-2026:84734 · Red Hat
  11. 2026-10-20 Fix available: Red Hat OpenShift AI 3.4 · Red Hat
  12. 2026-10-23 Fix available: RHSA-2026:88149 · Red Hat
  13. 2026-10-23 Fix available: RHSA-2026:88152 · Red Hat
  14. 2026-10-23 Fix available: RHSA-2026:88150 · Red Hat
  15. 2026-10-23 Fix available: RHSA-2026:88156 · Red Hat
  16. 2026-10-23 Fix available: RHSA-2026:88153 · Red Hat
  17. 2026-10-23 Fix available: RHSA-2026:88154 · Red Hat
  18. 2026-10-23 Fix available: RHSA-2026:88157 · Red Hat
  19. 2026-10-23 Fix available: RHSA-2026:88155 · Red Hat
  20. 2026-10-23 Fix available: RHSA-2026:88151 · Red Hat
  21. 2026-10-23 Fix available: RHSA-2026:88158 · Red Hat
  22. 2026-10-23 Fix available: RHSA-2026:88159 · Red Hat
  23. 2026-10-23 Fix available: OpenShift Developer Tools and Services 4.12, OpenShift Developer Tools and Services 4.13, OpenShift Developer Tools and Services 4.14 +8 · Red Hat
  24. 2026-11-04 Fix available: RHSA-2026:95221 · Red Hat
  25. 2026-11-04 Fix available: Red Hat JBoss Enterprise Application Platform 8.1 · Red Hat

References

Patch 1

Advisory 1

Other 4

  • TI-2026-61574 zstd-jni 1.2.0 through 1.5.7-13 Out-of-Bounds Read via ZstdDictDecompress CVSS 4.0HIGH 8.8
  • TI-2026-59940 zstd-jni 1.1.1 through 1.5.7-13 Out-of-Bounds Read via Direct ByteBuffer Frame-Size Methods CVSS 4.0HIGH 8.8
  • TI-2026-59916 zstd-jni 1.2.0 through 1.5.7-13 Out-of-Bounds Read via ZstdDictCompress CVSS 4.0HIGH 8.8
  • TI-2026-61747 luben zstd-jni Dictionary Sharing ZstdCompressCtx.java ZstdCompressCtx.loadDict use after free CVSS 4.0MEDIUM 6.9
  • TI-2026-59963 zstd-jni 1.3.8-4 through 1.5.7-13 Use-After-Free via Setters Called After close() CVSS 4.0HIGH 7.0
  • TI-2026-59942 zstd-jni 1.3.8-4 through 1.5.7-13 Use-After-Free of Compression and Decompression Dictionaries CVSS 4.0HIGH 7.0
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences