HIGH 8.8 NVD
CVE-2026-109395
Ning compress-lzf before 1.2.0 contains an out-of-bounds memory access vulnerability in the sun.misc.Unsafe based UnsafeChunkDecoder that fails to validate back
Ning compress-lzf before 1.2.0 contains an out-of-bounds memory access vulnerability in the sun.misc.Unsafe based UnsafeChunkDecoder that fails to validate back-references and literal runs. Attackers can supply crafted LZF streams to applications using the default LZFDecoder to leak unrelated JVM heap memory into decompressed output or crash the JVM.
References
- https://github.com/github/securitylab/discussions/970
- https://github.com/ning/compress
- https://github.com/ning/compress/blob/compress-lzf-1.1.3/src/main/java/com/ning/compress/l
- https://github.com/ning/compress/commit/06bdc3744a96b736a7118891f403e44c664f108b
- https://github.com/ning/compress/pull/68
This high severity vulnerability with a CVSS score of 8.8 was published on 2026-10-20 via NVD.
vulnfeed aggregates 17400 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.