Skip to content
Threat Feed
Subscribe

Product

Compress-Lzf (< 1.2.0)

1 brief RSS
medium advisory

CVE-2026-109395 - Out-of-Bounds Memory Access in Ning compress-lzf

Ning compress-lzf versions prior to 1.2.0 are vulnerable to an out-of-bounds memory access flaw in the UnsafeChunkDecoder, which can be exploited via crafted LZF streams to leak JVM heap memory or cause application crashes.

compress-lzf vulnerability memory-safety java
1c