Ning compress-lzf before 1.2.0 Out-of-Bounds Memory Access via UnsafeChunkDecoder

Advisories

Ning compress-lzf before 1.2.0 Out-of-Bounds Memory Access via UnsafeChunkDecoder

Severity: high
Date: 10/19/2026
Affecting: compress-lzf >= 0, < 1.2.0
CVE: CVE-2026-109395
CWE: CWE-125 Out-of-bounds Read
CVSS: 8.8
CVSS V4 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N
References: https://github.com/ning/compress/pull/68
https://github.com/ning/compress/commit/06bdc3744a96b736a7118891f403e44c664f108b
https://github.com/ning/compress/blob/compress-lzf-1.1.3/src/main/java/com/ning/compress/lzf/impl/UnsafeChunkDecoder.java#L104
https://github.com/github/securitylab/discussions/970
https://github.com/ning/compress
Credit: Marcono1234
Description: Ning compress-lzf before 1.2.0 contains an out-of-bounds memory access vulnerability in the sun.misc.Unsafe based UnsafeChunkDecoder that fails to validate back-references and literal runs. Attackers can supply crafted LZF streams to applications using the default LZFDecoder to leak unrelated JVM heap memory into decompressed output or crash the JVM.

Ready to get Started?

Explore VulnCheck, a next-generation Cyber Threat Intelligence platform, which provides exploit and vulnerability intelligence to help you prioritize and remediate vulnerabilities that matter.

Vulnerability Prioritization
Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.
Early Warning System
Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

Schedule a Demo