CVE-2026-89045 in zstd-jni
Summary
by MITRE • 09/10/2026
zstd-jni versions 1.4.8-4 through 1.5.7-13 fail to validate negative length parameters in ZstdInputStreamNoFinalizer.read(), allowing attackers to trigger infinite loops. Attackers can pass negative length values to cause the read method to spin indefinitely while holding the stream monitor, blocking all other threads from accessing the stream.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/10/2026
The vulnerability identified in zstd-jni library versions ranging from 1.4.8-4 through 1.5.7-13 represents a critical input validation failure within the ZstdInputStreamNoFinalizer class. Specifically, the read method fails to properly validate negative length parameters passed by callers or derived from stream data. This flaw allows an attacker who can influence the input stream's metadata or control flow logic to inject maliciously crafted requests that specify invalid buffer sizes. The core technical issue lies in the absence of boundary checks before processing these values, which leads to undefined behavior within the native decompression routines and the subsequent Java synchronization mechanisms.
From a technical perspective, when a negative length value is processed by the read method, it does not trigger an immediate exception or error return as expected for invalid inputs. Instead, the logic proceeds into a loop structure that attempts to fulfill the request based on this erroneous parameter. Because the condition governing the loop relies on arithmetic operations involving the negative number without proper saturation checks, the iteration count effectively becomes unbounded. This results in an infinite loop where the thread executing the read operation remains active and occupied indefinitely.
The operational impact of this vulnerability is severe due to its direct effect on application availability and resource contention. The ZstdInputStreamNoFinalizer class utilizes a monitor lock to ensure thread-safe access to the underlying stream resources. During the execution of the flawed read method, this monitor lock is held by the affected thread. Since the loop runs infinitely, the lock remains locked for an extended period, effectively blocking all other threads that attempt to interact with the same stream instance. This creates a classic denial-of-service scenario where legitimate users or services are unable to decompress data because they cannot acquire the necessary synchronization primitives.
This behavior aligns with CWE-835, which describes loops that never terminate due to logic errors involving integer overflow or underflow, and more broadly falls under CWE-20 for improper input validation. In terms of attack classification within the MITRE ATT&CK framework, this vulnerability facilitates Denial of Service (T1499) by exhausting system resources through CPU consumption and thread blocking. It also relates to Resource Exhaustion during DoS attacks where an attacker leverages a single request to tie up multiple threads in a multi-threaded environment.
Mitigation strategies for this issue primarily involve upgrading the zstd-jni library to versions that include patches addressing these input validation gaps. Developers should ensure they are using version 1.5.7-14 or later, where the read method has been updated to validate length parameters and handle negative values appropriately by throwing an IllegalArgumentException or similar exception rather than entering a loop. For applications unable to upgrade immediately, implementing wrapper classes that pre-validate input lengths before passing them to the zstd-jni library can provide a temporary defensive layer. Additionally, configuring thread pools with appropriate timeout mechanisms for blocking operations may help mitigate the impact of such hangs by allowing the system to detect and terminate stuck threads after a defined period, although this is not a substitute for fixing the root cause in the library itself.