Does CVE-2026-109395 allow crafted LZF streams to crash Java Virtual Machines in Ning compress-lzf?

The short version

• Ning compress-lzf before version 1.2.0 contains a high-severity vulnerability.
• The defect involves invalid back-references in the UnsafeChunkDecoder component.
• Exploitation can lead to heap data leakage or complete JVM termination.

The details

Ning compress-lzf versions preceding 1.2.0 suffer from an out-of-bounds memory access vulnerability, rated High with a CVSS score of 8.8, according to the National Vulnerability Database. The flaw resides within the sun.misc.Unsafe based UnsafeChunkDecoder, which fails to properly validate back-references and literal runs within LZF streams. This weakness is classified under CWE-125, indicating an attempt to read memory outside the intended buffer boundaries.

An attacker can exploit this by supplying crafted LZF streams to applications utilising the default LZFDecoder. This action allows the adversary to leak unrelated JVM heap memory into the decompressed output. Alternatively, the malformed input can cause the Java Virtual Machine to crash, resulting in a denial of service condition for any application relying on this library for decompression tasks.

The context

The vulnerability specifically impacts the UnsafeChunkDecoder component, which relies on sun.misc.Unsafe for performance-critical operations. The failure to validate back-references means that the decoder can be tricked into reading memory addresses that do not belong to the compressed data payload. This exposes unrelated JVM heap memory to potential leakage through the decompressed output.

Organisations using Ning compress-lzf in their software supply chain should verify their current version immediately. Any deployment running a version earlier than 1.2.0 is exposed to this risk. The severity rating of 8.8 highlights the significant potential impact on confidentiality and availability for affected systems.

Next steps

Teams should audit their dependencies to identify instances of Ning compress-lzf. Verify the installed version against the affected range. If the version is before 1.2.0, assess the exposure of decompression endpoints. Monitor for unusual memory usage patterns or unexpected JVM restarts that may indicate exploitation attempts.

What defenders should look for

Security operations teams should monitor for anomalous JVM behaviour following decompression events. Look for sudden spikes in memory consumption or unexpected process terminations that correlate with incoming compressed data streams. Check application logs for errors related to buffer overflows or invalid memory access during LZF decoding. If suspicious activity is detected, isolate the affected instance to prevent potential data exfiltration. Review network traffic for unusually large responses from decompression services, which might indicate heap data leakage.

What to do and how to stay safe: Ning compress-lzf

• Inventory all applications using Ning compress-lzf to determine version status.
• Monitor JVM logs for out-of-bounds access errors or unexpected crashes.
• Restrict network access to endpoints processing untrusted LZF streams.
• Plan to upgrade once the vendor provides a confirmed secure update.

Step-by-step guide: How Virtual Patching Works: The Mechanics Behind Inline Protection

General security guidance from the Honeypot Daily newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-109395?

The National Vulnerability Database rates the severity as High with a CVSS score of 8.8.

Which versions of Ning compress-lzf are affected?

All versions of Ning compress-lzf prior to 1.2.0 are vulnerable to this out-of-bounds memory access flaw.

What is the primary impact of this vulnerability?

Attackers can leak unrelated JVM heap memory or crash the JVM by supplying crafted LZF streams.