This page tracks the Ubuntu fix status. The vulnerability itself is described on the main CVE page.
View CVE-2026-89045 →
UBUNTU-CVE-2026-89045
zstd-jni versions 1.4.8-4 through 1.5.7-13 fail to validate negative length parameters in ZstdInputStreamNoFinalizer.read(), allowing attackers to tri...
Original description
The description as published by the source.
zstd-jni versions 1.4.8-4 through 1.5.7-13 fail to validate negative length parameters in ZstdInputStreamNoFinalizer.read(), allowing attackers to trigger infinite loops. Attackers can pass negative length values to cause the read method to spin indefinitely while holding the stream monitor, blocking all other threads from accessing the stream.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Affected packages
Ubuntu:24.04:LTS
zstd-jni-java
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:26.10
zstd-jni-java
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:26.04:LTS
zstd-jni-java
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
References
- report ubuntu.com
- report cve.org
- report github.com