CyberRota Analysis
AI-GeneratedThe vulnerability affects zstd-jni versions 1.4.8-4 through 1.5.7-13, where improper validation of negative length parameters in the ZstdInputStreamNoFinalizer.read() method can lead to infinite loops. This allows attackers to exploit the issue, causing the read method to block all other threads from accessing the stream, potentially leading to denial of service. Organizations utilizing these versions should prioritize remediation to mitigate the risk of service disruption.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
zstd-jni versions 1.4.8-4 through 1.5.7-13 fail to validate negative length parameters in ZstdInputStreamNoFinalizer.read(), allowing attackers to trigger infinite loops. Attackers can pass negative length values to cause the read method to spin indefinitely while holding the stream monitor, blocking all other threads from accessing the stream.