CVE-2026-109395: compress-lzf 0 to before 1.2.0

Affected technology

compress-lzf · 0 to before 1.2.0
ning

Description’s affected range: before 1.2.0

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

Attackers can supply crafted LZF streams to applications using the default LZFDecoder to leak unrelated JVM heap memory into decompressed output or crash the JVM. Vendor/CNA’s CVSS 4.0 assessment (base score 8.8/10) rates confidentiality and availability impact as high; integrity impact as none.