CVE-2026-89045

MediumCVSS 4.0/10Last modified Sep 15, 2026

Description

zstd-jni versions 1.4.8-4 through 1.5.7-13 fail to validate negative length parameters in ZstdInputStreamNoFinalizer.read(), allowing attackers to trigger infinite loops. Attackers can pass negative length values to cause the read method to spin indefinitely while holding the stream monitor, blocking all other threads from accessing the stream.

Metrics

CVSS 3.1 4.0/10CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-835

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Sep 10, 2026
Last modified: Sep 15, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-890468.2zstd-jni versions 1.5.5-6 through 1.5.7-13 contain an out-of-bounds read vulnerability in Zstd.getFrameContentSize that fails to validate ne CVE-2026-890476.1The Social Media Share Buttons & Social Sharing Icons plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URL in all ve CVE-2026-890499.9A server-side request forgery issue due to improper validation of equivalent address representations in the port forwarding to remote hosts CVE-2026-89056.1The Osiris Signature Banner plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.5. This CVE-2026-890504.3The Quads Ads Manager for Google AdSense WordPress plugin before 3.0.5 does not verify payment completion with the configured payment gatewa CVE-2026-890517.2The WP Ghost (Hide My WP Ghost) – Security & Firewall plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'replaceHead CVE-2026-890525.9A hardcoded cryptographic key management vulnerability exists in Archer C6 due to the use of a universal cryptographic key shared across dev CVE-2026-890548.2A missing authorization vulnerability in OpenNMS Horizon allows configuration changes without authentication. The Spring Security policy for CVE-2026-890559.1The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.120.CVE-2026-890576.8A potential authentication bypass vulnerability was reported in some Lenovo tablets that could allow a user with physical access to gain una CVE-2026-890587.4A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins ("*"), reflects the request's Origin header back in t CVE-2026-890597.5A flaw was found in RESTEasy's IIOImageProvider, which decodes attacker-supplied image request bodies without enforcing any limit on the dec