Ning compress-lzf CVE-2026-109395: Crafted Data Streams Crash JVMs and Leak Heap Memory Before 1.2.0
A high-severity flaw in Ning compress-lzf allows attackers to extract sensitive Java memory or crash systems using maliciously crafted data streams.
Key points
- CVE-2026-109395 affects Ning compress-lzf versions prior to 1.2.0.
- The vulnerability carries a CVSS score of 8.8, classified as high severity.
- Attackers can leak unrelated JVM heap memory or cause a service crash.
Security researchers have identified a significant memory safety flaw in the Ning compress-lzf library that exposes Java Virtual Machines to data leakage and denial-of-service attacks. The vulnerability, tracked as CVE-2026-109395, allows an attacker with the ability to supply crafted LZF compressed data to an application to read outside the intended memory boundaries. According to the NVD record, this out-of-bounds access enables the extraction of unrelated heap memory contents or forces the host JVM to crash unexpectedly.
In plain English
The issue arises when the library attempts to decompress data that has been deliberately manipulated by an adversary. Instead of stopping when it reaches the end of the valid data segment, the decoder continues reading into adjacent memory areas. This behavior reveals data that the application did not intend to expose, potentially including sensitive information stored in the JVM heap. Alternatively, the malformed input can cause the decoding process to fail catastrophically, resulting in a complete system crash.
The background
The affected component is the UnsafeChunkDecoder within Ning compress-lzf, which relies on sun.misc.Unsafe for its operations. According to the National Vulnerability Database, this specific decoder fails to properly validate back-references and literal runs within the LZF stream. This lack of validation is the root cause that permits the out-of-bounds memory access. The flaw is present in all versions of Ning compress-lzf prior to version 1.2.0, making earlier deployments vulnerable to exploitation via the default LZFDecoder configuration.
What changes now
Teams relying on Ning compress-lzf versions before 1.2.0 are exposed to this high-severity risk. The National Vulnerability Database rates the issue at 8.8, placing it firmly in the high category. While the source material identifies the affected version range, it does not confirm whether a patched release is currently available or if the vendor has issued an official update. Organizations must verify their current library versions against the affected range to determine their exposure level and assess the potential impact on their Java-based services.
What made it possible
Teams usually encounter out-of-bounds access flaws when software fails to validate input boundaries before processing memory requests. This weakness typically serves the initial access or privilege escalation stage of an intrusion, allowing adversaries to read sensitive data residing in adjacent memory blocks. Operators should check whether their applications accept untrusted compressed data from external sources. Monitoring for unexpected memory access patterns and reviewing library configurations for strict validation rules helps mitigate risks associated with malformed streams and unsafe memory operations.
What to do and how to stay safe: Ning compress-lzf
- Audit your Java applications to identify any usage of Ning compress-lzf versions earlier than 1.2.0.
- Implement strict input validation for all compressed data streams received from untrusted or external sources.
- Monitor JVM logs for unexpected crashes or anomalous memory access patterns that could indicate exploitation attempts.
- Restrict network access to services that process external LZF data to limit the attack surface for potential adversaries.
Step-by-step guide: Automatic Updates Mistakes That Leave Systems Exposed
General security guidance from the RedTeam Monitor newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which specific versions of Ning compress-lzf are vulnerable to CVE-2026-109395?
All versions of Ning compress-lzf prior to 1.2.0 are affected by this out-of-bounds memory access vulnerability.
What is the severity rating for this vulnerability?
The National Vulnerability Database assigns a CVSS score of 8.8, which is classified as high severity.
Can this vulnerability be used to execute arbitrary code?
The source material states that attackers can leak unrelated JVM heap memory or crash the JVM, but does not mention arbitrary code execution.
