The vulnerability in zstd-jni versions >=1.4.8-4 and <1.5.7-14 arises because the ZstdInputStreamNoFinalizer.read() method does not properly validate negative length parameters. This allows an attacker to trigger an infinite loop by passing such negative values, resulting in the method spinning indefinitely while holding the stream monitor lock. Consequently, this blocks all other threads from accessing the stream, leading to a denial of service condition.

Exploitation of this vulnerability can cause a denial of service by making the affected method enter an infinite loop, effectively blocking other threads from accessing the stream. This can degrade application availability and responsiveness but does not involve privilege escalation or data compromise according to the available data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid processing untrusted input that could supply negative length parameters to ZstdInputStreamNoFinalizer.read().