{"id":"CVE-2026-109395","kind":"vulnerability","aliases":["CVE-2026-109395"],"related":[],"title":"Java compress-lzf: crafted LZF input leaks JVM heap memory or crashes","description":"Ning compress-lzf before 1.2.0 contains an out-of-bounds memory access vulnerability in the sun.misc.Unsafe based UnsafeChunkDecoder that fails to validate back-references and literal runs. Attackers can supply crafted LZF streams to applications using the default LZFDecoder to leak unrelated JVM heap memory into decompressed output or crash the JVM.","summary":"Ning compress-lzf before 1.2.0 has an out-of-bounds read (CWE-125) in the sun.misc.Unsafe-based UnsafeChunkDecoder: back-references and literal runs are not validated. A crafted LZF stream fed to the default LZFDecoder can leak JVM heap memory into the decompressed output or crash the JVM. Found by Marcono1234; fixed upstream in PR #68.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"com.ning:compress-lzf","fixed":["1.2.0"],"affected":">= 0, < 1.2.0","ecosystem":"maven"}],"ecosystems":[],"tags":["compress-lzf","java","maven","package"],"not_affected_if":["no-untrusted-lzf-input"],"how_to_check":"Run mvn dependency:tree or gradle dependencies and look for com.ning:compress-lzf below 1.2.0, including transitive uses (Jackson, Spark, Kafka, Cassandra and similar). You are exposed only if the app decompresses LZF data from untrusted sources. On Debian, the compress-lzf package 1.0.4-1 is vulnerable and unfixed.","fix":"Upgrade com.ning:compress-lzf to 1.2.0 or later. For transitive dependencies, force the version through dependencyManagement or a Gradle constraint. If you cannot upgrade, do not decompress untrusted LZF input.","status":"open","published_at":"2026-10-20T01:17:09+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","triaged_at":"2026-10-23T22:39:45+00:00","updated_at":"2026-10-23T23:23:21+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T22:39:45Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade com.ning:compress-lzf to 1.2.0 or later.","reach":"unknown","title":"Java compress-lzf: crafted LZF input leaks JVM heap memory or crashes","impact":"medium","summary":"Ning compress-lzf before 1.2.0 has an out-of-bounds read in its sun.misc.Unsafe-based decoder because back-references and literal runs are not validated. An attacker who supplies a crafted LZF stream can leak unrelated JVM heap memory into decompressed output or crash the JVM.","category":"package","who_cares":["java","compress-lzf"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Heap memory leaks into output or the JVM crashes","analyst_note":"Confirm the affected version range and whether the fixed 1.2.0 release is available; check the NVD entry for the exact vulnerable input path and CVSS vector.","how_to_check":"Check the compress-lzf version in your build file or dependency tree (for example mvn dependency:tree or gradle dependencies) and look for com.ning:compress-lzf below 1.2.0.","needs_analyst":true,"not_affected_if":["no-untrusted-lzf-input"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000527,"input_tokens":2965,"output_tokens":461,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm the affected version range and fixed version against the NVD entry and the upstream Ning compress-lzf release notes; sources give no detail on whether the default LZFDecoder path needs any special setup.","search":"'-109395':16A,19A '-125':44B '-2026':15A,18A '1.2.0':35B,94C '68':88B 'access':102C 'applic':126C 'attack':119C 'back':51B,114C 'back-refer':50B,113C 'base':48B,107C 'bound':41B,100C 'com.ning':20A 'compress':3A,22A,25B,32B,91C 'compress-lzf':2A,21A,24B,31B,90C 'contain':95C 'craft':5A,60B,122C 'crash':13A,78B,141C 'cve':14A,17A 'cwe':43B 'decompress':75B,138C 'default':66B,129C 'fail':110C 'fed':63B 'fix':84B 'found':81B 'heap':10A,71B,135C 'input':7A 'java':1A,27B 'jvm':9A,70B,80B,134C,143C 'leak':8A,69B,132C 'liter':54B,117C 'lzf':4A,6A,23A,26B,33B,61B,92C,123C 'lzfdecod':67B,130C 'marcono1234':83B 'maven':28B 'memori':11A,72B,101C,136C 'ning':30B,89C 'out-of-bound':38B,97C 'output':76B,139C 'packag':29B 'pr':87B 'read':42B 'refer':52B,115C 'run':55B,118C 'stream':62B,124C 'sun.misc.unsafe':47B,106C 'suppli':121C 'unrel':133C 'unsafechunkdecod':49B,108C 'upstream':85B 'use':127C 'valid':58B,112C 'vulner':103C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T01:17:09+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-109395","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109395","severity":null,"published_at":"2026-10-20T01:17:09+00:00","modified_at":"2026-10-20T20:06:37+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-109395:431","url":null,"severity":null,"published_at":"2026-10-23T23:23:21+00:00","modified_at":"2026-10-23T23:23:21+00:00","first_seen_at":"2026-10-23T23:23:21+00:00","fetched_at":"2026-10-23T23:23:21+00:00","note":"Affected <1.2.0 (all versions from 0) per CVE record/VulnCheck advisory; fix is merged ning/compress PR #68 (commit 06bdc37), 1.2.0 is the fixed version. No known exploitation or public PoC found. Did not verify the 1.2.0 release page directly (GitHub releases page empty). Debian packages 1.0.4-1 unfixed. PR discussion notes some bounds checks in ChunkDecoder happen after consumption; low residual side-channel risk. CVSS 3.1 9.1, v4 8.8. No social discussion searched (low-profile library)."}],"documents":[{"id":1925,"url":"https://www.vulncheck.com/advisories/ning-compress-lzf-before-1.2.0-out-of-bounds-memory-access-via-unsafechunkdecoder","title":"VulnCheck advisory: Ning compress-lzf before 1.2.0","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1926,"url":"https://github.com/ning/compress/pull/68","title":"ning/compress PR #68 Improve bounds checks (merged)","kind":"issue","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":1927,"url":"https://security-tracker.debian.org/tracker/CVE-2026-109395","title":"Debian tracker: compress-lzf 1.0.4-1 vulnerable, unfixed","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}