Search
Find a vulnerability
Search criteria
2 vulnerabilities found for compress-lzf by ning
CVE-2026-109395 (GCVE-0-2026-109395)
Vulnerability from nvd – Published: 2026-10-20 00:46 – Updated: 2026-10-20 00:46
VLAI
EPSS
VEX
Title
Ning compress-lzf before 1.2.0 Out-of-Bounds Memory Access via UnsafeChunkDecoder
Summary
Ning compress-lzf before 1.2.0 contains an out-of-bounds memory access vulnerability in the sun.misc.Unsafe based UnsafeChunkDecoder that fails to validate back-references and literal runs. Attackers can supply crafted LZF streams to applications using the default LZFDecoder to leak unrelated JVM heap memory into decompressed output or crash the JVM.
Severity
9.1 (Critical)
CWE
- CWE-125 - Out-of-bounds Read
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/ning/compress/pull/68 | patchissue-tracking |
| https://github.com/ning/compress/commit/06bdc3744… | patch |
| https://github.com/ning/compress/blob/compress-lz… | technical-description |
| https://github.com/github/securitylab/discussions/970 | technical-description |
| https://github.com/ning/compress | product |
| https://www.vulncheck.com/advisories/ning-compres… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| ning | compress-lzf |
Affected:
0 , < 1.2.0
(semver)
|
Date Public
2026-10-07 13:15
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:maven/com.ning/compress-lzf",
"product": "compress-lzf",
"repo": "https://github.com/ning/compress",
"vendor": "ning",
"versions": [
{
"lessThan": "1.2.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Marcono1234"
}
],
"datePublic": "2026-10-07T13:15:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Ning compress-lzf before 1.2.0 contains an out-of-bounds memory access vulnerability in the sun.misc.Unsafe based UnsafeChunkDecoder that fails to validate back-references and literal runs. Attackers can supply crafted LZF streams to applications using the default LZFDecoder to leak unrelated JVM heap memory into decompressed output or crash the JVM."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T00:46:04.633Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"patch",
"issue-tracking"
],
"url": "https://github.com/ning/compress/pull/68"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ning/compress/commit/06bdc3744a96b736a7118891f403e44c664f108b"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/ning/compress/blob/compress-lzf-1.1.3/src/main/java/com/ning/compress/lzf/impl/UnsafeChunkDecoder.java#L104"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/github/securitylab/discussions/970"
},
{
"tags": [
"product"
],
"url": "https://github.com/ning/compress"
},
{
"name": "VulnCheck Advisory: Ning compress-lzf before 1.2.0 Out-of-Bounds Memory Access via UnsafeChunkDecoder",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/ning-compress-lzf-before-1.2.0-out-of-bounds-memory-access-via-unsafechunkdecoder"
}
],
"title": "Ning compress-lzf before 1.2.0 Out-of-Bounds Memory Access via UnsafeChunkDecoder",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-109395",
"datePublished": "2026-10-20T00:46:04.633Z",
"dateReserved": "2026-10-12T14:40:43.306Z",
"dateUpdated": "2026-10-20T00:46:04.633Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-109395 (GCVE-0-2026-109395)
Vulnerability from cvelistv5 – Published: 2026-10-20 00:46 – Updated: 2026-10-20 00:46
VLAI
EPSS
VEX
Title
Ning compress-lzf before 1.2.0 Out-of-Bounds Memory Access via UnsafeChunkDecoder
Summary
Ning compress-lzf before 1.2.0 contains an out-of-bounds memory access vulnerability in the sun.misc.Unsafe based UnsafeChunkDecoder that fails to validate back-references and literal runs. Attackers can supply crafted LZF streams to applications using the default LZFDecoder to leak unrelated JVM heap memory into decompressed output or crash the JVM.
Severity
9.1 (Critical)
CWE
- CWE-125 - Out-of-bounds Read
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/ning/compress/pull/68 | patchissue-tracking |
| https://github.com/ning/compress/commit/06bdc3744… | patch |
| https://github.com/ning/compress/blob/compress-lz… | technical-description |
| https://github.com/github/securitylab/discussions/970 | technical-description |
| https://github.com/ning/compress | product |
| https://www.vulncheck.com/advisories/ning-compres… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| ning | compress-lzf |
Affected:
0 , < 1.2.0
(semver)
|
Date Public
2026-10-07 13:15
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:maven/com.ning/compress-lzf",
"product": "compress-lzf",
"repo": "https://github.com/ning/compress",
"vendor": "ning",
"versions": [
{
"lessThan": "1.2.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Marcono1234"
}
],
"datePublic": "2026-10-07T13:15:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Ning compress-lzf before 1.2.0 contains an out-of-bounds memory access vulnerability in the sun.misc.Unsafe based UnsafeChunkDecoder that fails to validate back-references and literal runs. Attackers can supply crafted LZF streams to applications using the default LZFDecoder to leak unrelated JVM heap memory into decompressed output or crash the JVM."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T00:46:04.633Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"patch",
"issue-tracking"
],
"url": "https://github.com/ning/compress/pull/68"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ning/compress/commit/06bdc3744a96b736a7118891f403e44c664f108b"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/ning/compress/blob/compress-lzf-1.1.3/src/main/java/com/ning/compress/lzf/impl/UnsafeChunkDecoder.java#L104"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/github/securitylab/discussions/970"
},
{
"tags": [
"product"
],
"url": "https://github.com/ning/compress"
},
{
"name": "VulnCheck Advisory: Ning compress-lzf before 1.2.0 Out-of-Bounds Memory Access via UnsafeChunkDecoder",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/ning-compress-lzf-before-1.2.0-out-of-bounds-memory-access-via-unsafechunkdecoder"
}
],
"title": "Ning compress-lzf before 1.2.0 Out-of-Bounds Memory Access via UnsafeChunkDecoder",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-109395",
"datePublished": "2026-10-20T00:46:04.633Z",
"dateReserved": "2026-10-12T14:40:43.306Z",
"dateUpdated": "2026-10-20T00:46:04.633Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}