{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3aningcompress-lzf/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ning:compress-lzf:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.1,"id":"CVE-2026-109395"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["compress-lzf (\u003c 1.2.0)"],"_cs_severities":["medium"],"_cs_tags":["vulnerability","memory-safety","java"],"_cs_type":"advisory","_cs_vendors":["Ning"],"content_html":"\u003cp\u003eNing compress-lzf versions before 1.2.0 contain an out-of-bounds (OOB) memory access vulnerability located within the \u003ccode\u003eUnsafeChunkDecoder\u003c/code\u003e component. This component utilizes \u003ccode\u003esun.misc.Unsafe\u003c/code\u003e for high-performance decompression; however, it fails to properly validate back-references and literal runs during the decompression process. An attacker can provide a specifically crafted LZF compressed stream to any application utilizing the default \u003ccode\u003eLZFDecoder\u003c/code\u003e. When the application attempts to process this malicious stream, the vulnerability is triggered, leading to either an application-wide crash (Denial of Service) or the exposure and leakage of unrelated JVM heap memory into the output buffer. This vulnerability is significant for any Java-based environment processing untrusted compressed data, as it allows for the potential exfiltration of sensitive information stored in the heap.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies an application that utilizes the Ning compress-lzf library (versions \u0026lt; 1.2.0) to process input data.\u003c/li\u003e\n\u003cli\u003eAttacker crafts a malicious LZF stream designed to trigger the validation flaw in the \u003ccode\u003eUnsafeChunkDecoder\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eAttacker submits the crafted LZF stream through an application entry point (e.g., API request, file upload, or network packet).\u003c/li\u003e\n\u003cli\u003eThe target application passes the attacker-supplied payload to the \u003ccode\u003eLZFDecoder\u003c/code\u003e for decompression.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eUnsafeChunkDecoder\u003c/code\u003e reads memory beyond the bounds of the expected input buffer due to improper back-reference checks.\u003c/li\u003e\n\u003cli\u003eThe system places the OOB memory data into the application's output buffer or crashes the JVM process.\u003c/li\u003e\n\u003cli\u003eAttacker retrieves the processed output, which now contains unauthorized heap memory contents, or observes the application service termination.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-109395 can result in the unauthorized disclosure of sensitive data residing in the JVM heap, such as session tokens, cryptographic keys, or user credentials. Furthermore, the vulnerability allows for reliable application crashes, enabling a denial-of-service attack against the affected service. Given the prevalence of Java-based web applications, this vulnerability poses a high risk to availability and confidentiality.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade the Ning compress-lzf library to version 1.2.0 or later immediately to incorporate the necessary memory bounds validation.\u003c/li\u003e\n\u003cli\u003eAudit applications that accept compressed LZF input to identify those utilizing the vulnerable \u003ccode\u003eUnsafeChunkDecoder\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eIf upgrading is not immediately feasible, implement strict input validation and sanitization for all data passed to decompression routines.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-20T02:31:13Z","date_published":"2026-10-20T02:31:13Z","id":"https://feed.craftedsignal.io/briefs/2026-10-compress-lzf-oob/","summary":"Ning compress-lzf versions prior to 1.2.0 are vulnerable to an out-of-bounds memory access flaw in the UnsafeChunkDecoder, which can be exploited via crafted LZF streams to leak JVM heap memory or cause application crashes.","title":"CVE-2026-109395 - Out-of-Bounds Memory Access in Ning compress-lzf","url":"https://feed.craftedsignal.io/briefs/2026-10-compress-lzf-oob/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:ning:compress-Lzf:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}