Critical severity · published Oct 20, 2026
CVE-2026-109395
Ning compress-lzf before 1.2.0 Out-of-Bounds Memory Access via UnsafeChunkDecoder
9.1
CVSS
0.5%
EPSS
No
On KEV
Description
Ning compress-lzf before 1.2.0 contains an out-of-bounds memory access vulnerability in the sun.misc.Unsafe based UnsafeChunkDecoder that fails to validate back-references and literal runs. Attackers can supply crafted LZF streams to applications using the default LZFDecoder to leak unrelated JVM heap memory into decompressed output or crash the JVM.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 44% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CO
compress-lzf · ning
before 1.2.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-109395
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-109395
github.com
https://github.com/github/securitylab/discussions/970
github.com
https://github.com/ning/compress
github.com
https://github.com/ning/compress/blob/compress-lzf-1.1.3/src/main/java/com/ning/compress/lzf/impl/UnsafeChunkDecoder.java#L104
github.com
https://github.com/ning/compress/commit/06bdc3744a96b736a7118891f403e44c664f108b
github.com
https://github.com/ning/compress/pull/68
www.vulncheck.com
https://www.vulncheck.com/advisories/ning-compress-lzf-before-1.2.0-out-of-bounds-memory-access-via-unsafechunkdecoder