CVE-2026-89045mediumCWE-835

CVE-2026-89045: fallo de gravedad media en luben zstd-jni

zstd-jni 1.4.8-4 through 1.5.7-13 Denial of Service via Negative Length

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear zstd-jni+ Monitorear zstd-jni-java

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 5.1epss 0.2%
zstd-jni versions 1.4.8-4 through 1.5.7-13 fail to validate negative length parameters in ZstdInputStreamNoFinalizer.read(), allowing attackers to trigger infinite loops. Attackers can pass negative length values to cause the read method to spin indefinitely while holding the stream monitor, blocking all other threads from accessing the stream.
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Productos afectados
luben · zstd-jni
CVEs relacionadas — luben zstd-jni

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-89046HIGHzstd-jni 1.5.5-6 through 1.5.7-13 Out-of-Bounds Read via Negative OffsetEPSS 0.7%CVE-2026-87795HIGHzstd-jni 1.2.0 through 1.5.7-13 Out-of-Bounds Read via ZstdDictCompressEPSS 0.6%CVE-2026-90560HIGHzstd-jni 1.2.0 through 1.5.7-13 Out-of-Bounds Read via ZstdDictDecompressEPSS 0.6%CVE-2026-90852MEDIUMluben zstd-jni Dictionary Sharing ZstdCompressCtx.java ZstdCompressCtx.loadDict use after freeEPSS 0.5%CVE-2026-87823HIGHzstd-jni 1.1.1 through 1.5.7-13 Out-of-Bounds Read via Direct ByteBuffer Frame-Size MethodsEPSS 0.4%CVE-2026-87824HIGHzstd-jni 1.3.3-1 through 1.5.7-13 Out-of-Bounds Read via Zstd.trainFromBufferDirectEPSS 0.4%