CVE-2026-89046

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-89046
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-89046.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-89046
Aliases
  • GHSA-rm53-6wf5-f34m
Downstream
CLEANSTART (5)
DEBIAN (1)
UBUNTU (1)
Published
2026-09-10T17:39:35Z
Modified
2026-10-15T13:33:23Z
Severity
  • 8.8 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
zstd-jni 1.5.5-6 through 1.5.7-13 Out-of-Bounds Read via Negative Offset
Details

zstd-jni versions 1.5.5-6 through 1.5.7-13 contain an out-of-bounds read vulnerability in Zstd.getFrameContentSize that fails to validate negative srcPosition arguments. Attackers can supply negative offset values that bypass bounds checks and reach the native frame-header parser, causing out-of-bounds memory reads that lead to information disclosure or JVM crashes.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-125"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89046.json"
}
References

Affected packages

Git / github.com/luben/zstd-jni

Affected ranges

Type
GIT
Repo
https://github.com/luben/zstd-jni
Events
Introduced
92e7862b74112036a14359e184509875f310b32c
Fixed
3216860eea289fbbae0b191c0a4fd8b72dad949c
Fixed
dd08685ef913a32e76fb27f43470035c06758646
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "1.5.5-6"
                },
                {
                    "fixed":  "1.5.7-14"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        },
        {
            "range":  [
                {
                    "fixed":  "dd08685ef913a32e76fb27f43470035c06758646"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "original_tag":  "v1.5.7-14",
            "range":  [
                {
                    "fixed":  "3216860eea289fbbae0b191c0a4fd8b72dad949c"
                }
            ],
            "source":  "REFERENCES_TAG"
        }
    ]
}

Affected versions

b1.*
b1.5.5-9
v1.*
v1.5.5-10
v1.5.5-11
v1.5.5-6
v1.5.5-7
v1.5.5-8
v1.5.5-9
v1.5.6-1
v1.5.6-10
v1.5.6-2
v1.5.6-3
v1.5.6-4
v1.5.6-5
v1.5.6-6
v1.5.6-7
v1.5.6-8
v1.5.6-9
v1.5.7-1
v1.5.7-11
v1.5.7-12
v1.5.7-13
v1.5.7-2
v1.5.7-3
v1.5.7-4
v1.5.7-5
v1.5.7-6
v1.5.7-7
v1.5.7-8
v1.5.7-9

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-89046.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "163176608967625549994170912083350052708",
            "length":  1247
        },
        "id":  "CVE-2026-89046-0e6351b1",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/luben/zstd-jni/commit/dd08685ef913a32e76fb27f43470035c06758646",
        "target":  {
            "file":  "src/main/java/com/github/luben/zstd/ZstdInputStreamNoFinalizer.java",
            "function":  "readInternal"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "275344359314977493472007285396485056640",
                "316115599886286568013794359884890253216",
                "328365001249078288697268689154984735391",
                "77109289481455660233837093926009184496",
                "281158973307557163285491085635681886556",
                "196666546266696328670111300416738615163",
                "282190412522647678512867538625156258374",
                "77109289481455660233837093926009184496"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-89046-11373d9d",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/luben/zstd-jni/commit/dd08685ef913a32e76fb27f43470035c06758646",
        "target":  {
            "file":  "src/main/java/com/github/luben/zstd/ZstdInputStreamNoFinalizer.java"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "319696483832917712384682231278816072707",
            "length":  525
        },
        "id":  "CVE-2026-89046-44dbbae1",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/luben/zstd-jni/commit/3216860eea289fbbae0b191c0a4fd8b72dad949c",
        "target":  {
            "file":  "src/main/native/jni_zstd.c",
            "function":  "Java_com_github_luben_zstd_Zstd_getDirectByteBufferFrameContentSize"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "155532999205049707381413023812283718478",
            "length":  393
        },
        "id":  "CVE-2026-89046-457fa880",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/luben/zstd-jni/commit/dd08685ef913a32e76fb27f43470035c06758646",
        "target":  {
            "file":  "src/main/java/com/github/luben/zstd/ZstdInputStreamNoFinalizer.java",
            "function":  "read"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "242983979289756636978174893894911169283",
                "157823411836278810979700492519583258858",
                "47982388172284482667079231190836641912",
                "142002538935986523140505977783435642687",
                "70654406038950244899492554068964697791",
                "256841266079176367404669460587415964017",
                "136130365917502750732790875301653462261",
                "307914870517560413069750160813139035083",
                "70654406038950244899492554068964697791",
                "256841266079176367404669460587415964017",
                "136130365917502750732790875301653462261",
                "307914870517560413069750160813139035083"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-89046-cf1cd55a",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/luben/zstd-jni/commit/3216860eea289fbbae0b191c0a4fd8b72dad949c",
        "target":  {
            "file":  "src/main/native/jni_zstd.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "25964609007207720573219828689431886815",
                "267179681871520588723005531219984946856",
                "6472292023347682294147855619261434597",
                "244873686192727136384730960862444043219",
                "202915855663704198324274501629805830116",
                "149564327435357576627198027098710263601",
                "334033398233812454627262090002625548035"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-89046-e37dfadc",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/luben/zstd-jni/commit/dd08685ef913a32e76fb27f43470035c06758646",
        "target":  {
            "file":  "src/main/java/com/github/luben/zstd/Zstd.java"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "6130561471615133004258603361745015963",
            "length":  503
        },
        "id":  "CVE-2026-89046-e402cad3",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/luben/zstd-jni/commit/3216860eea289fbbae0b191c0a4fd8b72dad949c",
        "target":  {
            "file":  "src/main/native/jni_zstd.c",
            "function":  "Java_com_github_luben_zstd_Zstd_findDirectByteBufferFrameCompressedSize"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "243452810049814927721413726162029308560",
            "length":  552
        },
        "id":  "CVE-2026-89046-e43e017d",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/luben/zstd-jni/commit/3216860eea289fbbae0b191c0a4fd8b72dad949c",
        "target":  {
            "file":  "src/main/native/jni_zstd.c",
            "function":  "Java_com_github_luben_zstd_Zstd_decompressedDirectByteBufferSize"
        }
    }
]
vanir_signatures_modified 
"2026-10-15T13:33:23Z"