CVE-2026-109395
Ning compress-lzf before 1.2.0 contains an out-of-bounds memory access vulnerability in the…
- Risk score
- 66/100
- CVSS
- 9.1 v3.1
- Exploit chance (30 days)
- 0.4%
- Published
- 20 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- The Ning compress-lzf library before version 1.2.0 has an out-of-bounds memory access vulnerability in the UnsafeChunkDecoder. An attacker can supply crafted LZF streams to leak unrelated JVM heap memory or crash the JVM.
- Affected
- {'products': [], 'packages': ['compress-lzf'], 'versions': ['before 1.2.0']}
- Fix
- Check the linked advisory for a fix, as none is provided.
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 9.1 critical
- Remotely exploitable without logging in
References
- https://github.com/github/securitylab/discussions/970
- https://github.com/ning/compress
- https://github.com/ning/compress/blob/compress-lzf-1.1.3/src/main/java/com/ning/compress/lzf/impl/UnsafeChunkDecoder.java#L104
- https://github.com/ning/compress/commit/06bdc3744a96b736a7118891f403e44c664f108b
- https://github.com/ning/compress/pull/68
- https://www.vulncheck.com/advisories/ning-compress-lzf-before-1.2.0-out-of-bounds-memory-access-via-unsafechunkdecoder
Original description
Ning compress-lzf before 1.2.0 contains an out-of-bounds memory access vulnerability in the sun.misc.Unsafe based UnsafeChunkDecoder that fails to validate back-references and literal runs. Attackers can supply crafted LZF streams to applications using the default LZFDecoder to leak unrelated JVM heap memory into decompressed output or crash the JVM.
Last activity 20 Oct 2026. Patch Forecast updates every hour.