CVE-2026-109395

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-109395
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-109395.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-109395
Downstream
Published
2026-10-20T00:46:04Z
Modified
2026-10-28T02:30:41Z
Severity
  • 8.8 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Ning compress-lzf before 1.2.0 Out-of-Bounds Memory Access via UnsafeChunkDecoder
Details

Ning compress-lzf before 1.2.0 contains an out-of-bounds memory access vulnerability in the sun.misc.Unsafe based UnsafeChunkDecoder that fails to validate back-references and literal runs. Attackers can supply crafted LZF streams to applications using the default LZFDecoder to leak unrelated JVM heap memory into decompressed output or crash the JVM.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-125"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/109xxx/CVE-2026-109395.json"
}
References

Affected packages

Git / github.com/ning/compress

Affected ranges

Type
GIT
Repo
https://github.com/ning/compress
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
55b26f0562ab2ca75042918e663ecf1a676c6d7d
Fixed
06bdc3744a96b736a7118891f403e44c664f108b
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "1.2.0"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        },
        {
            "range": [
                {
                    "fixed": "06bdc3744a96b736a7118891f403e44c664f108b"
                }
            ],
            "source": "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

compress-lzf-0.*
compress-lzf-0.5.0
compress-lzf-0.5.1
compress-lzf-0.5.2
compress-lzf-0.5.3
compress-lzf-0.5.4
compress-lzf-0.6.0
compress-lzf-0.6.0-b
compress-lzf-0.7.0
compress-lzf-0.8.0
compress-lzf-0.8.1
compress-lzf-0.8.1b
compress-lzf-0.8.2
compress-lzf-0.8.3
compress-lzf-0.8.4
compress-lzf-0.8.5
compress-lzf-0.8.6
compress-lzf-0.9.0
compress-lzf-0.9.1
compress-lzf-0.9.10
compress-lzf-0.9.2
compress-lzf-0.9.3
compress-lzf-0.9.4
compress-lzf-0.9.5
compress-lzf-0.9.6
compress-lzf-0.9.7
compress-lzf-0.9.8
compress-lzf-0.9.9
compress-lzf-1.*
compress-lzf-1.0.0
compress-lzf-1.0.0c
compress-lzf-1.0.1
compress-lzf-1.0.2
compress-lzf-1.0.3
compress-lzf-1.0.4
compress-lzf-1.1
compress-lzf-1.1.1
compress-lzf-1.1.2
compress-lzf-1.1.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-109395.json"