p PatchFirst

CVE-2026-109395

CVE-2026-109395 · Ning compress-lzf before 1.2.0 Out-of-Bounds Memory Access via UnsafeChunkDecoder

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Ning compress-lzf before 1.2.0 contains an out-of-bounds memory access vulnerability in the sun.misc.Unsafe based UnsafeChunkDecoder that fails to validate back-references and literal runs. Attackers can supply crafted LZF streams to applications using the default LZFDecoder to leak unrelated JVM heap memory into decompressed output or crash the JVM.

CVSS 8.8 · High · EPSS 0.5% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • compress-lzf

    Versions
    • ≥ 0, < 1.2.0: Affected (semver)

    Update to 1.2.0

  • compress-lzf Debian:12

    Versions
    • 1.0.4-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • compress-lzf Debian:13

    Versions
    • 1.0.4-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • compress-lzf Debian:14

    Versions
    • 1.0.4-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • compress-lzf Ubuntu:16.04:LTS

    Versions
    • 1.0.3-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • compress-lzf Ubuntu:18.04:LTS

    Versions
    • 1.0.3-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • compress-lzf Ubuntu:20.04:LTS

    Versions
    • 1.0.4-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • compress-lzf Ubuntu:22.04:LTS

    Versions
    • 1.0.4-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • compress-lzf Ubuntu:24.04:LTS

    Versions
    • 1.0.4-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • compress-lzf Ubuntu:26.10

    Versions
    • 1.0.4-1build1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • compress-lzf Ubuntu:26.04:LTS

    Versions
    • 1.0.4-1
    • 1.0.4-1build1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →