{"id":"CVE-2026-89046","title":"zstd-jni: zstd-jni: Information disclosure or denial of service via out-of-bounds read (CVE-2026-89046)","summary":"A flaw was found in zstd-jni. This out-of-bounds read vulnerability in the Zstd.getFrameContentSize function occurs because it fails to validate negative srcPosition arguments. A remote attacker can supply negative offset values, bypassing…","severity":"high","cvss":8.2,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","cvssSource":"vendor","cwe":"CWE-125","vendor":"Red Hat","product":"Red Hat Ceph Storage 9","affected":["exploit_intelligence","openshift_developer_tools_and_services","build_of_apache_camel_4_for_quarkus 3","build_of_apicurio_registry 3","build_of_debezium 3","ceph_storage 9","enterprise_linux 9","jboss_enterprise_application_platform_expansion_pack","build_of_apache_camel 3.33.3.SP2","openshift_ai 3.4","build_of_apache_camel_4_18_4_for_spring_boot 3.5.16","build_of_quarkus 3.27.5.SP2","build_of_quarkus 3.33.3.SP2"],"patched":["build_of_apache_camel 3.33.3.SP2","openshift_ai 3.4","build_of_apache_camel_4_18_4_for_spring_boot 3.5.16","build_of_quarkus 3.27.5.SP2","build_of_quarkus 3.33.3.SP2"],"published":"2026-09-10","updated":"2026-10-19","sourceUpdated":"2026-10-19T11:30:26+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89046.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89046.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-89046"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2531577"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-89046"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89046"},{"url":"https://github.com/luben/zstd-jni"},{"url":"https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/Zstd.java#L730"},{"url":"https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/native/jni_zstd.c#L87"},{"url":"https://github.com/luben/zstd-jni/commit/dd08685ef913a32e76fb27f43470035c06758646"},{"url":"https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14"},{"url":"https://github.com/luben/zstd-jni/security/advisories/GHSA-rm53-6wf5-f34m"},{"url":"https://www.vulncheck.com/advisories/zstd-jni-1.5.5-6-through-1.5.7-13-out-of-bounds-read-via-negative-offset"},{"url":"https://access.redhat.com/errata/RHSA-2026:70257"},{"url":"https://access.redhat.com/errata/RHSA-2026:84734"},{"url":"https://access.redhat.com/errata/RHSA-2026:71675"},{"url":"https://access.redhat.com/errata/RHSA-2026:69470"},{"url":"https://access.redhat.com/errata/RHSA-2026:69440"}],"tags":["csaf","vex","red-hat","cve.org","exploit-available"],"epss":0.0065,"epssPercentile":0.50939,"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"yes","technicalImpact":"partial","timestamp":"2026-09-10T18:07:52.440977Z"},"ingestedAt":"2026-09-11T16:45:48.028Z","slug":"CVE-2026-89046","body":"## Overview\n\nA flaw was found in zstd-jni. This out-of-bounds read vulnerability in the Zstd.getFrameContentSize function occurs because it fails to validate negative srcPosition arguments. A remote attacker can supply negative offset values, bypassing bounds checks and accessing the native frame-header parser. This can lead to out-of-bounds memory reads, resulting in information disclosure or a Java Virtual Machine (JVM) crash.\n\n## Vendor advisories\n\n- **RHSA-2026:70257** · Red Hat · fixed in: Red Hat Build of Apache Camel 3.33.3.SP2 · released 2026-09-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:70257)\n- **RHSA-2026:84734** · Red Hat · fixed in: Red Hat OpenShift AI 3.4 · released 2026-10-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:84734)\n- **RHSA-2026:71675** · Red Hat · fixed in: Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16 · released 2026-09-24 · [advisory](https://access.redhat.com/errata/RHSA-2026:71675)\n- **RHSA-2026:69470** · Red Hat · fixed in: Red Hat build of Quarkus 3.27.5.SP2 · released 2026-09-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:69470)\n- **RHSA-2026:69440** · Red Hat · fixed in: Red Hat build of Quarkus 3.33.3.SP2 · released 2026-09-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:69440)\n- **Red Hat VEX** · Important · affected: Exploit Intelligence, OpenShift Developer Tools and Services, Red Hat build of Apache Camel 4 for Quarkus 3, Red Hat build of Apicurio Registry 3, Red Hat build of Debezium 3, Red Hat Ceph Storage 9, … · no fix planned: Red Hat Ceph Storage 9, Exploit Intelligence, OpenShift Developer Tools and Services, Red Hat build of Apache Camel 4 for Quarkus 3, … · updated 2026-10-19 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89046.json)\n\n**zstd-jni: zstd-jni: Information disclosure or denial of service via out-of-bounds read** — rated Important by Red Hat. Released 2026-09-10, updated 2026-10-19.\n\nAffected:\n\n- Exploit Intelligence\n- OpenShift Developer Tools and Services\n- Red Hat build of Apache Camel 4 for Quarkus 3\n- Red Hat build of Apicurio Registry 3\n- Red Hat build of Debezium 3\n- Red Hat Ceph Storage 9\n- Red Hat Enterprise Linux 9\n- Red Hat JBoss Enterprise Application Platform Expansion Pack\n\nFixed:\n\n- Red Hat Build of Apache Camel 3.33.3.SP2\n- Red Hat OpenShift AI 3.4\n- Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16\n- Red Hat build of Quarkus 3.27.5.SP2\n- Red Hat build of Quarkus 3.33.3.SP2\n\nNo fix planned:\n\n- Red Hat Ceph Storage 9\n- Exploit Intelligence\n- OpenShift Developer Tools and Services\n- Red Hat build of Apache Camel 4 for Quarkus 3\n- Red Hat build of Apicurio Registry 3\n- Red Hat build of Debezium 3\n- Red Hat Enterprise Linux 9\n- Red Hat JBoss Enterprise Application Platform Expansion Pack\n\nNot affected:\n\n- Red Hat Build of Apache Camel 3.33.3.SP2\n- Red Hat OpenShift AI 3.4\n- Red Hat Enterprise Linux 8\n- Red Hat Fuse 7\n- Red Hat Hardened Images\n- Red Hat JBoss Enterprise Application Platform 8\n- Red Hat OpenShift AI (RHOAI)\n\n## Remediation\n\nBefore applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\nThe References section of this erratum contains a download link (you must log in to download the update). https://access.redhat.com/errata/RHSA-2026:70257\nFor Red Hat OpenShift AI 3.4.5 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:\n\nhttps://docs.redhat.com/en/documentation/red_hat_openshift_ai/ https://access.redhat.com/errata/RHSA-2026:84734\nBefore applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:71675\n\nWorkarounds / mitigations:\n\n- Update to a product release containing zstd-jni 1.5.7-14 or later. Until updated, validate source positions and reject negative offsets before calling Zstd.getFrameContentSize. Do not pass attacker-controlled offsets to this method without validation.","depth":"midnight","depthScore":57,"depthScoreParts":{"impact":45.1,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[]}