CVE-2026-109395

Critical

Description

Ning compress-lzf before 1.2.0 contains an out-of-bounds memory access vulnerability in the sun.misc.Unsafe based UnsafeChunkDecoder that fails to validate back-references and literal runs. Attackers can supply crafted LZF streams to applications using the default LZFDecoder to leak unrelated JVM heap memory into decompressed output or crash the JVM.

SeverityCritical

CVSS9.1

Exploit probability—

ProductNing Compress-lzf

PublishedOct 20, 2026

First seenOct 20, 2026

Weakness typeCWE-125Out-of-bounds read

How to fix

Update

ning compress-lzf1.2.0 or later

Patches

github.com/ning/compress/pull/68
github.com/ning/compress/commit/06bdc3744a96b736a7118891f403e44c664f108b

Affected products

Product	Affected versions	Fixed in
ning compress-lzf	v < 1.2.0	1.2.0

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.