Technical impact
zstd-jni versions 1.4.8-4 through 1.5.7-13 fail to validate negative length parameters in the ZstdInputStreamNoFinalizer.read() method. This oversight allows attackers to supply negative length values, causing the read loop to execute indefinitely while holding the stream monitor. The result is a denial of service, as the blocked monitor prevents other threads from accessing the stream and may exhaust system resources.
Affected Systems
The vulnerability affects the zstd-jni library distributed by the luben project. All releases from 1.4.8-4 up to and including 1.5.7-13 are impacted. Users relying on these versions in Java applications that decompress or decompress using ZstdInputStreamNoFinalizer should be aware of the risk.
Risk and Exploitability
The CVSS score of 5.1 indicates moderate severity. No EPSS score is provided, and the vulnerability is not listed in the CISA KEV catalog. The attack vector involves an adversary controlling input to the read method or otherwise manipulating the stream to provide a negative length. If successful, the attacker can force an infinite loop that monopolizes the stream monitor, blocking other threads. The lack of a pre-existing patch and limited exploitation guidance mean the exploitation likelihood remains uncertain but is feasible in environments with untrusted data streams.
