compress-lzf vulnerabilities

CVEs whose affected-version data names the compress-lzf package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-109395Critical· 9.1

today

Ning compress-lzf before 1.2.0 Out-of-Bounds Memory Access via UnsafeChunkDecoder

Ning compress-lzf before 1.2.0 contains an out-of-bounds memory access vulnerability in the sun.misc.Unsafe based UnsafeChunkDecoder that fails to validate back-references and literal runs. Attackers can supply crafted LZF streams to app…

▾ Midnightning · compress-lzfvia CVEORG