CVE-2026-109395
Ning compress-lzf before 1.2.0 Out-of-Bounds Memory Access via UnsafeChunkDecoder
ning compress-lzf
CVSS
8.8HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.40%Chance of exploitation activity in the next 30 days, higher than 33% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 1.2.0compress-lzfCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Ning compress-lzf before 1.2.0 contains an out-of-bounds memory access vulnerability in the sun.misc.Unsafe based UnsafeChunkDecoder that fails to validate back-references and literal runs. Attackers can supply crafted LZF streams to applications using the default LZFDecoder to leak unrelated JVM heap memory into decompressed output or crash the JVM.
Text from CVE List
Affected versions 1
- compress-lzfaffected: all versions before 1.2.0CVE List
References 6
- github.com/ning/compress/pull/68Fixvia CVE List
- github.com/ning/compress/commit/06bdc3744a96b736a7118891f403e44c664f108bFixvia CVE List
- github.com/github/securitylab/discussions/970Advisoryvia CVE List
- vulncheck.com/advisories/ning-compress-lzf-before-1.2.0-out-of-bounds-memory-access-via-unsafechunkdecoderAdvisoryvia CVE List
- github.com/ning/compress/blob/compress-lzf-1.1.3/src/main/java/com/ning/compress/lzf/impl/UnsafeChunkDecoder.java#L104Referencevia CVE List
- github.com/ning/compressReferencevia CVE List