EUVD-2026-75634
GHSA-r8cw-jvfx-h6x5
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AV:L follows provided CVSS 4.0; attacker must reach the stream read API with a controlled length parameter; only stream availability is impacted.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
zstd-jni versions 1.4.8-4 through 1.5.7-13 fail to validate negative length parameters in ZstdInputStreamNoFinalizer.read(), allowing attackers to trigger infinite loops. Attackers can pass negative length values to cause the read method to spin indefinitely while holding the stream monitor, blocking all other threads from accessing the stream.
AnalysisAI
Infinite-loop denial of service in zstd-jni versions 1.4.8-4 through 1.5.7-13 allows thread starvation by passing negative length values to ZstdInputStreamNoFinalizer.read(). Because the method is declared synchronized, the spinning loop holds the stream monitor indefinitely, blocking every other thread that attempts to call any synchronized method on the same stream object. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must control or influence the len argument passed to the three-argument form of ZstdInputStreamNoFinalizer.read(byte[], int offset, int len) or the internal readInternal() method. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 5.1 with vector AV:L/AC:L/AT:N/PR:N/UI:N/VA:L accurately captures a moderate, locally-triggered availability issue. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade zstd-jni to version 1.5.7-14 or later, which adds explicit len < 0 validation guards in both the public read() and internal readInternal() methods of ZstdInputStreamNoFinalizer, and analogous checks for srcPosition and srcSize in Zstd.java. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Out-of-bounds read in zstd-jni versions 1.2.0 through 1.5.7-13 allows attackers who can supply dictionary constructor pa
Out-of-bounds read in zstd-jni versions 1.5.5-6 through 1.5.7-13 exposes JVM-based applications to memory disclosure or
Out-of-bounds memory reads in zstd-jni versions 1.1.1 through 1.5.7-13 allow unauthenticated remote attackers to crash t
Out-of-bounds memory access in zstd-jni versions 1.3.3-1 through 1.5.7-13 enables unauthenticated network-accessible att
Use-after-free in zstd-jni versions 1.3.8-4 through 1.5.7-13 allows callers to invoke setDict, setLongMax, setLevel, and
Use-after-free in zstd-jni versions 1.3.8-4 through 1.5.7-13 allows attackers to trigger silent data corruption or JVM c
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today