CVE-2026-109395
9.1CriticalPublished 20 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on confidentiality, availability
- Weakness
- CWE-125
Impact
Remote, unauthenticated attackers can crash your JVM or leak sensitive heap memory into decompressed output. All they need is the ability to send a crafted LZF stream to an application using the default decoder.
Root cause
The sun.misc.Unsafe implementation in UnsafeChunkDecoder fails to validate back-references and literal run boundaries, causing out-of-bounds heap reads.
Affected systems
Ning compress-lzf before version 1.2.0
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Fix & remediation
Upgrade the com.ning:compress-lzf dependency to version 1.2.0 or higher. If upgrading immediately is not possible, avoid using the default sun.misc.Unsafe-backed LZFDecoder and switch to a safe array-based decoder implementation.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Ning compress-lzf before 1.2.0 contains an out-of-bounds memory access vulnerability in the sun.misc.Unsafe based UnsafeChunkDecoder that fails to validate back-references and literal runs. Attackers can supply crafted LZF streams to applications using the default LZFDecoder to leak unrelated JVM heap memory into decompressed output or crash the JVM.
References
- https://github.com/github/securitylab/discussions/970
- https://github.com/ning/compress
- https://github.com/ning/compress/blob/compress-lzf-1.1.3/src/main/java/com/ning/compress/lzf/impl/UnsafeChunkDecoder.java#L104
- https://github.com/ning/compress/commit/06bdc3744a96b736a7118891f403e44c664f108b
- https://github.com/ning/compress/pull/68
- https://www.vulncheck.com/advisories/ning-compress-lzf-before-1.2.0-out-of-bounds-memory-access-via-unsafechunkdecoder