What’s Vulnerable › Vulnerabilities

CVE-2026-109395: Ning compress-lzf before 1.2.0 Out-of-Bounds Memory Access via UnsafeChunkDecoder

• Severity: critical (CVSS 9.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-20 · updated 2026-10-20
• Weakness: CWE-125

Description

Ning compress-lzf before 1.2.0 contains an out-of-bounds memory access vulnerability in the sun.misc.Unsafe based UnsafeChunkDecoder that fails to validate back-references and literal runs. Attackers can supply crafted LZF streams to applications using the default LZFDecoder to leak unrelated JVM heap memory into decompressed output or crash the JVM.

Affected products

• ning compress-lzf: before 1.2.0 — fixed in 1.2.0

How to fix

Upgrade to a fixed version: ning compress-lzf 1.2.0. Check the vendor advisory for mitigations.

References

• https://github.com/github/securitylab/discussions/970
• https://github.com/ning/compress
• https://github.com/ning/compress/blob/compress-lzf-1.1.3/src/main/java/com/ning/compress/lzf/impl/UnsafeChunkDecoder.java#L104
• https://github.com/ning/compress/commit/06bdc3744a96b736a7118891f403e44c664f108b
• https://github.com/ning/compress/pull/68
• https://www.vulncheck.com/advisories/ning-compress-lzf-before-1.2.0-out-of-bounds-memory-access-via-unsafechunkdecoder

Get alerted when CVE-2026-109395 or the next vulnerability affects your stack