CVE catalog

CVE-2026-109395

Ning compress-lzf before 1.2.0 contains an out-of-bounds memory access vulnerability in the sun.misc.Unsafe based UnsafeChunkDecoder that fails to validate back-references and literal runs. Attackers

[CVE catalog]

Severity
High · CVSS 8.8CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Published
Updated
Source
[NVD] · [CVE record]
EPSS
0.52% · Oct 25, 2026

Ning compress-lzf before 1.2.0 contains an out-of-bounds memory access vulnerability in the sun.misc.Unsafe based UnsafeChunkDecoder that fails to validate back-references and literal runs. Attackers can supply crafted LZF streams to applications using the default LZFDecoder to leak unrelated JVM heap memory into decompressed output or crash the JVM.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiancompress-lzfsid1.0.4-1vulnerable
Debiancompress-lzfforky1.0.4-1vulnerable
Debiancompress-lzftrixie1.0.4-1vulnerable
Debiancompress-lzfbookworm1.0.4-1vulnerable
Ubuntucompress-lzf16.041.0.3-1vulnerable
Ubuntucompress-lzf18.041.0.3-1vulnerable
Ubuntucompress-lzf20.041.0.4-1vulnerable
Ubuntucompress-lzf22.041.0.4-1vulnerable
Ubuntucompress-lzf24.041.0.4-1vulnerable
Ubuntucompress-lzf26.101.0.4-1build1vulnerable
Ubuntucompress-lzf26.041.0.4-1vulnerable
Ubuntucompress-lzf26.041.0.4-1build1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiancompress-lzfsourcesid(unfixed)not yet assignedNot reportedNot reported
Debiancompress-lzfsourceforky(unfixed)not yet assignedNot reportedNot reported
Debiancompress-lzfsourcetrixie(unfixed)not yet assignedNot reportedNot reported
Debiancompress-lzfsourcebookworm(unfixed)not yet assignedNot reportedNot reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libcompress-lzf-java]Affected

    Source package: [compress-lzf]

    Details (2)

    • 1.0.4-1 · all · bookworm

      Affected

      nvd · compress-lzf · debian · bookworm; nvd · compress-lzf · debian · 12

    • 1.0.4-1 · all · bookworm

      Affected

      nvd · compress-lzf · debian · bookworm; nvd · compress-lzf · debian · 12

[Debian 13 (Trixie)]

  • [libcompress-lzf-java]Affected

    Source package: [compress-lzf]

    Details (2)

    • 1.0.4-1 · all · trixie

      Affected

      nvd · compress-lzf · debian · 13

    • 1.0.4-1 · all · trixie

      Affected

      nvd · compress-lzf · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database]