---
id: "CVE-2026-109395"
kind: "vulnerability"
aliases: ["CVE-2026-109395"]
title: "Java compress-lzf: crafted LZF input leaks JVM heap memory or crashes"
severity: "critical"
cvss: 9.1
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "com.ning:compress-lzf", "fixed": ["1.2.0"], "affected": ">= 0, < 1.2.0", "ecosystem": "maven"}]
ecosystems: []
tags: ["compress-lzf", "java", "maven", "package"]
not_affected_if: ["no-untrusted-lzf-input"]
published_at: "2026-10-20T01:17:09+00:00"
first_seen_at: "2026-10-23T21:57:19+00:00"
updated_at: "2026-10-23T23:23:21+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109395", "first_seen_at": "2026-10-23T21:57:19+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:23:21+00:00"}]
---

# Java compress-lzf: crafted LZF input leaks JVM heap memory or crashes

Ning compress-lzf before 1.2.0 has an out-of-bounds read (CWE-125) in the sun.misc.Unsafe-based UnsafeChunkDecoder: back-references and literal runs are not validated. A crafted LZF stream fed to the default LZFDecoder can leak JVM heap memory into the decompressed output or crash the JVM. Found by Marcono1234; fixed upstream in PR #68.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- maven:com.ning:compress-lzf affected >= 0, < 1.2.0 fixed 1.2.0

## How to check

Run mvn dependency:tree or gradle dependencies and look for com.ning:compress-lzf below 1.2.0, including transitive uses (Jackson, Spark, Kafka, Cassandra and similar). You are exposed only if the app decompresses LZF data from untrusted sources. On Debian, the compress-lzf package 1.0.4-1 is vulnerable and unfixed.

## Fix

Upgrade com.ning:compress-lzf to 1.2.0 or later. For transitive dependencies, force the version through dependencyManagement or a Gradle constraint. If you cannot upgrade, do not decompress untrusted LZF input.

## Timeline

- 2026-10-23T21:57:19+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-109395
- 2026-10-23T23:23:21+00:00 analyst — Affected <1.2.0 (all versions from 0) per CVE record/VulnCheck advisory; fix is merged ning/compress PR #68 (commit 06bdc37), 1.2.0 is the fixed version. No known exploitation or public PoC found. Did not verify the 1.2.0 release page directly (GitHub releases page empty). Debian packages 1.0.4-1 unfixed. PR discussion notes some bounds checks in ChunkDecoder happen after consumption; low residual side-channel risk. CVSS 3.1 9.1, v4 8.8. No social discussion searched (low-profile library).

## Documents

- [advisory] VulnCheck advisory: Ning compress-lzf before 1.2.0 https://www.vulncheck.com/advisories/ning-compress-lzf-before-1.2.0-out-of-bounds-memory-access-via-unsafechunkdecoder
- [fix] ning/compress PR #68 Improve bounds checks (merged) https://github.com/ning/compress/pull/68
- [mentions] Debian tracker: compress-lzf 1.0.4-1 vulnerable, unfixed https://security-tracker.debian.org/tracker/CVE-2026-109395

## From the sources

Ning compress-lzf before 1.2.0 contains an out-of-bounds memory access vulnerability in the sun.misc.Unsafe based UnsafeChunkDecoder that fails to validate back-references and literal runs. Attackers can supply crafted LZF streams to applications using the default LZFDecoder to leak unrelated JVM heap memory into decompressed output or crash the JVM.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_