by Kastro
Paper/Archive/CVE-2026-109395

CVE-2026-109395

ning compress-lzf — Ning compress-lzf before 1.2.0 Out-of-Bounds Memory Access via UnsafeChunkDecoder

EPSS 0.5%CVSS 9.1
critical.is priorityof 100
36
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 44.3.443 × 208.9No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Ning compress-lzf before 1.2.0 contains an out-of-bounds memory access vulnerability in the sun.misc.Unsafe based UnsafeChunkDecoder that fails to validate back-references and literal runs. Attackers can supply crafted LZF streams to applications using the default LZFDecoder to leak unrelated JVM heap memory into decompressed output or crash the JVM.

Affected

ProductAffectedFixed inSource
compress-lzf< 1.2.01.2.0CNA

Scores by source

VulnCheck (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
VulnCheck (CNA)8.8CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

patchgithub.com/ning/compress/pull/68patchgithub.com/ning/compress/commit/06bdc3744a96b736a7118891f403e44c664f108bwriteupgithub.com/ning/compress/blob/compress-lzf-1.1.3/src/main/java/com/ning/compress/lzf/impl/UnsafeChunkDecoder.java#L104writeupgithub.com/github/securitylab/discussions/970refgithub.com/ning/compresswriteupvulncheck.com/advisories/ning-compress-lzf-before-1.2.0-out-of-bounds-memory-access-via-unsafechunkdecoder