A critical out-of-bounds memory access flaw in Ning compress-lzf before 1.2.0 lets attackers use crafted LZF streams to leak unrelated JVM heap memory or crash the JVM.
What Is It
CVE-2026-109395 is an out-of-bounds memory access vulnerability (CWE-125, Out-of-bounds Read) in the Ning compress-lzf Java library. The flaw is in UnsafeChunkDecoder, the decoder built on sun.misc.Unsafe, which does not validate back-references and literal runs while decompressing.
An attacker can supply a crafted LZF stream to any application that uses the default LZFDecoder. This can copy unrelated JVM heap memory into the decompressed output, or crash the JVM.
VulnCheck disclosed the vulnerability. NVD lists its status as "Received."
Why It Matters
VulnCheck scored the flaw 9.1 (CRITICAL) under CVSS 3.1, with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H:
- Network-reachable with low attack complexity
- No privileges or user interaction required
- High confidentiality impact: heap memory from the process can appear in decompressed output
- High availability impact: a crafted stream can crash the JVM
A secondary CVSS 4.0 assessment scores it 8.8 (HIGH), also with high confidentiality and availability impact and no integrity impact.
The advisory says the flaw can be reached through the default LZFDecoder. Applications that use that decoder on untrusted LZF data may therefore be exposed without any special configuration. Whether a specific deployment is exposed depends on how it handles LZF input.
At the time of writing, CVE-2026-109395 is not in the CISA Known Exploited Vulnerabilities (KEV) catalog. The supplied data does not confirm active exploitation in the wild.
What's Vulnerable
- Vendor: ning
- Product: compress-lzf
- Package:
pkg:maven/com.ning/compress-lzf - Repository: https://github.com/ning/compress
- Affected versions: all versions before 1.2.0 (semver)
Applications are exposed if they use compress-lzf's default LZFDecoder to decompress untrusted LZF data. The vulnerable code is referenced in UnsafeChunkDecoder.java as of release compress-lzf-1.1.3.
Patch Status
The affected range ends before version 1.2.0, so compress-lzf 1.2.0 is the first unaffected release. The fix is referenced in upstream commit 06bdc37 and pull request #68 in the ning/compress repository.
Required action: Upgrade com.ning:compress-lzf to 1.2.0 or later. Check dependency trees for transitive use of the library, and prioritize services that decompress LZF data from untrusted or network-facing sources.
CISA has not issued a KEV remediation deadline, because the CVE is not listed in the catalog.