Ning compress-lzf Vulnerability Exposes JVM Heap to Data Leaks
A high-severity flaw in Ning compress-lzf allows attackers to leak memory or crash systems via crafted LZF streams.
Key points
- CVE-2026-109395 is rated CVSS 8.8 HIGH.
- The flaw exists in versions before 1.2.0.
- Attackers can leak JVM heap memory or crash the service.
An out-of-bounds memory access vulnerability in Ning compress-lzf allows attackers to compromise Java Virtual Machines. The flaw, identified as CVE-2026-109395, is rated HIGH with a CVSS score of 8.8. It affects all versions of the library prior to 1.2.0.
At a glance
- CVE
- CVE-2026-109395
- Product
- ning compress-lzf
- CVSS
- 8.8 High
- Weakness
- out-of-bounds read
- Exploited
- No known exploitation
The vulnerability resides in the UnsafeChunkDecoder component. According to the National Vulnerability Database, this decoder relies on sun.misc.Unsafe and fails to properly validate back-references and literal runs. This lack of validation creates a pathway for memory corruption.
Technical Context
The issue is classified under CWE-125, which denotes out-of-bounds read errors. The UnsafeChunkDecoder processes LZF compressed data without sufficient boundary checks. Attackers can exploit this by supplying specifically crafted LZF streams to affected applications.
When an application uses the default LZFDecoder to process these malicious streams, the decoder accesses memory locations it should not reach. This behavior violates standard memory safety protocols within the Java environment. The flaw is inherent in the library's handling of compression instructions.
Who Is Affected
Any software utilizing Ning compress-lzf versions earlier than 1.2.0 is vulnerable to this exploit. The NVD record explicitly lists "before 1.2.0" as the affected range. Applications that rely on the default LZFDecoder are at the highest risk of exposure.
Successful exploitation can lead to two primary outcomes. Attackers can force the JVM to crash, resulting in a denial of service. Alternatively, they can leak unrelated JVM heap memory into the decompressed output. This data leakage could expose sensitive information stored in the heap.
What should you do?
Organizations should immediately audit their dependencies for Ning compress-lzf. Identify all instances where versions prior to 1.2.0 are in use. Monitor logs for unexpected JVM crashes or unusual data outputs from decompression tasks. Restrict input sources for LZF streams to trusted origins where possible.
What to do and how to stay safe: Ning compress-lzf
- Inventory all Java projects to identify usage of Ning compress-lzf.
- Verify the specific version number of the library in each project.
- Isolate systems that process untrusted LZF data until mitigations are in place.
- Monitor JVM logs for crashes or memory access errors linked to decompression.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-109395?
It is an out-of-bounds memory access vulnerability in Ning compress-lzf before 1.2.0.
How severe is this vulnerability?
The CVSS score is 8.8, which is rated as HIGH severity.
Can this flaw be exploited remotely?
Attackers can supply crafted LZF streams to applications using the default decoder.
