Out-of-bounds memory access in Ning compress-lzf LZF decoder
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- High · None · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
Ning compress-lzf before 1.2.0 contains an out-of-bounds memory access in its sun.misc.Unsafe based UnsafeChunkDecoder, which fails to validate back-references and literal runs (CWE-125). An unauthenticated remote attacker can supply crafted LZF streams to applications using the default LZFDecoder, leaking unrelated JVM heap memory into decompressed output or crashing the JVM.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
Ning compress-lzf before 1.2.0 contains an out-of-bounds memory access vulnerability in the sun.misc.Unsafe based UnsafeChunkDecoder that fails to validate back-references and literal runs. Attackers can supply crafted LZF streams to applications using the default LZFDecoder to leak unrelated JVM heap memory into decompressed output or crash the JVM.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
Upgrade compress-lzf to version 1.2.0 or later, which fixes the flaw.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
- Fix · CNA compress-lzf (ning) Fixed in 1.2.0
Timeline
- 2026-10-20 Threatist record created from CVE-2026-109395
- 2026-10-20 CISA SSVC decision points changed
References
Patch 2
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences