Cpe:2.3:a:ning:compress-Lzf:*:*:*:*:*:*:*:*

Ning compress-lzf versions prior to 1.2.0 are vulnerable to an out-of-bounds memory access flaw in the UnsafeChunkDecoder, which can be exploited via crafted LZF streams to leak JVM heap memory or cause application crashes.