{"id":"CVE-2026-109395","summary":"Ning compress-lzf before 1.2.0 Out-of-Bounds Memory Access via UnsafeChunkDecoder","details":"Ning compress-lzf before 1.2.0 contains an out-of-bounds memory access vulnerability in the sun.misc.Unsafe based UnsafeChunkDecoder that fails to validate back-references and literal runs. Attackers can supply crafted LZF streams to applications using the default LZFDecoder to leak unrelated JVM heap memory into decompressed output or crash the JVM.","modified":"2026-10-20T11:16:47.043811646Z","published":"2026-10-20T00:46:04.633Z","database_specific":{"cwe_ids":["CWE-125"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/109xxx/CVE-2026-109395.json","cna_assigner":"VulnCheck"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/109xxx/CVE-2026-109395.json"},{"type":"ARTICLE","url":"https://github.com/github/securitylab/discussions/970"},{"type":"PACKAGE","url":"https://github.com/ning/compress"},{"type":"ARTICLE","url":"https://github.com/ning/compress/blob/compress-lzf-1.1.3/src/main/java/com/ning/compress/lzf/impl/UnsafeChunkDecoder.java#L104"},{"type":"FIX","url":"https://github.com/ning/compress/commit/06bdc3744a96b736a7118891f403e44c664f108b"},{"type":"FIX","url":"https://github.com/ning/compress/pull/68"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109395"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/ning-compress-lzf-before-1.2.0-out-of-bounds-memory-access-via-unsafechunkdecoder"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/ning/compress","events":[{"introduced":"0"},{"fixed":"55b26f0562ab2ca75042918e663ecf1a676c6d7d"}],"database_specific":{"source":"AFFECTED_FIELD","extracted_events":[{"introduced":"0"},{"fixed":"1.2.0"}]}}],"versions":["compress-lzf-1.1.3","compress-lzf-1.1.2","compress-lzf-1.1.1","compress-lzf-1.1","compress-lzf-1.0.4","compress-lzf-1.0.3","compress-lzf-1.0.2","compress-lzf-1.0.1","compress-lzf-1.0.0c","compress-lzf-1.0.0","compress-lzf-0.9.10","compress-lzf-0.9.9","compress-lzf-0.9.8","compress-lzf-0.9.7","compress-lzf-0.9.6","compress-lzf-0.9.5","compress-lzf-0.9.4","compress-lzf-0.9.3","compress-lzf-0.9.2","compress-lzf-0.9.1","compress-lzf-0.9.0","compress-lzf-0.8.6","compress-lzf-0.8.5","compress-lzf-0.8.4","compress-lzf-0.8.3","compress-lzf-0.8.2","compress-lzf-0.8.1b","compress-lzf-0.8.1","compress-lzf-0.8.0","compress-lzf-0.7.0","compress-lzf-0.6.0-b","compress-lzf-0.6.0","compress-lzf-0.5.4","compress-lzf-0.5.3","compress-lzf-0.5.2","compress-lzf-0.5.1","compress-lzf-0.5.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-109395.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N"}]}