CVE-2026-109395 Ning compress-lzf before 1.2.0 Out-of-Bounds Memory Access via UnsafeChunkDecoder

Ning compress-lzf before 1.2.0 contains an out-of-bounds memory access vulnerability in the sun.misc.Unsafe based UnsafeChunkDecoder that fails to validate back-references and literal runs. Attackers can supply crafted LZF streams to applications using the default LZFDecoder to leak unrelated JVM...

CVE-2026-109395

The Ning compress-lzf library, in versions before 1.2.0 , is vulnerable to an out-of-bounds memory access within the sun.misc.Unsafe based UnsafeChunkDecoder . The root cause is a failure to properly validate back-references and literal runs during decompression. An attacker can provide a crafted...

EUVD-2026-104679

Ning compress-lzf before 1.2.0 contains an out-of-bounds memory access vulnerability in the sun.misc.Unsafe based UnsafeChunkDecoder that fails to validate back-references and literal runs. Attackers can supply crafted LZF streams to applications using the default LZFDecoder to leak unrelated JVM...