p PatchFirst

PatchFirst · Latest vulnerabilities

compress-lzf vulnerabilities

Vulnerabilities published for compress-lzf in the last 30 days: 1. Listed in the KEV catalogue: 0.

RSS ↗ JSON ↗
Filter vulnerabilities
Clear filters

Vulnerabilities: 1

  1. CVE-2026-109395

    High · CVSS 8.8EPSS 0.52%No fix published

    Ning compress-lzf before 1.2.0 Out-of-Bounds Memory Access via UnsafeChunkDecoder

    Ning compress-lzf before 1.2.0 contains an out-of-bounds memory access vulnerability in the sun.misc.Unsafe based UnsafeChunkDecoder that fails to validate back-references and literal runs. Attackers can supply crafted LZF streams to applications using the default LZFDecoder to leak unrelated JVM heap memory into decompressed output or crash the JVM.

    compress-lzfOperating systems
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →