Vulnerability · Published Oct 20, 2026 · Assigned by VulnCheck
CVE-2026-109395Ning compress-lzf before 1.2.0 Out-of-Bounds Memory Access via UnsafeChunkDecoder
Critical 9.1
In plain English
A critical-severity out-of-bounds read in compress-lzf from ning. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities).
Severity (CVSS 3.1)9.1Critical
Exploit odds (30 days)0.5%top 55.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Ning compress-lzf before 1.2.0 contains an out-of-bounds memory access vulnerability in the sun.misc.Unsafe based UnsafeChunkDecoder that fails to validate back-references and literal runs. Attackers can supply crafted LZF streams to applications using the default LZFDecoder to leak unrelated JVM heap memory into decompressed output or crash the JVM.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | compress-lzf | no fix listed | DEBIAN-CVE-2026-109395 |
| Debian:13 | compress-lzf | no fix listed | DEBIAN-CVE-2026-109395 |
| Debian:14 | compress-lzf | no fix listed | DEBIAN-CVE-2026-109395 |
| Ubuntu:22.04:LTS | compress-lzf | no fix listed | UBUNTU-CVE-2026-109395 |
| Ubuntu:24.04:LTS | compress-lzf | no fix listed | UBUNTU-CVE-2026-109395 |
| Ubuntu:26.04:LTS | compress-lzf | no fix listed | UBUNTU-CVE-2026-109395 |
| Ubuntu:26.10 | compress-lzf | no fix listed | UBUNTU-CVE-2026-109395 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| ning | compress-lzf | 0 – before 1.2.0 |
Weakness: CWE-125 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
References
- https://github.com/ning/compress/pull/68 patch, issue-tracking
- https://github.com/ning/compress/commit/06bdc3744a96b736a7118891f403e44c664f108b patch
- https://github.com/ning/compress/blob/compress-lzf-1.1.3/src/main/java/com/ning/compress/lzf/impl/UnsafeChunkDecoder.java#L104 technical-description
- https://github.com/github/securitylab/discussions/970 technical-description
- https://github.com/ning/compress product
- VulnCheck Advisory: Ning compress-lzf before 1.2.0 Out-of-Bounds Memory Access via UnsafeChunkDecoder third-party-advisory