Ning compress-lzf before 1.2.0 contains an out-of-bounds memory access vulnerability in the sun.misc.Unsafe based UnsafeChunkDecoder that fails to validate back-references and literal runs. Attackers can supply crafted LZF streams to applications using the default LZFDecoder to leak unrelated JVM heap memory into decompressed output or crash the JVM.
Fix
Nothing published yet: no patch, vendor advisory or mitigation reference on NVD, no vendor advisory in the News for this CVE, not in CISA's KEV, no fixed package version. BaselineWatch does not guess at one.
Change history 4
- StatusAwaiting Analysis → PublishedNVD modified 2026-10-20 14:29
- StatusPublished → Awaiting AnalysisNVD modified 2026-10-20 20:06
- StatusReceived → PublishedNVD modified 2026-10-20 14:29
- First seenCVSS 8.8NVD modified 2026-10-20 01:17
Affected (CPE criteria) 0
NVD has not attached CPE configurations yet.
References 6
- https://github.com/github/securitylab/discussions/970
- https://github.com/ning/compress
- https://github.com/ning/compress/blob/compress-lzf-1.1.3/src/main/java/com/ning/compress/lzf/impl/UnsafeChunkDecoder.java#L104
- https://github.com/ning/compress/commit/06bdc3744a96b736a7118891f403e44c664f108b
- https://github.com/ning/compress/pull/68
- https://www.vulncheck.com/advisories/ning-compress-lzf-before-1.2.0-out-of-bounds-memory-access-via-unsafechunkdecoder