CVE-2026-109395

CriticalCVSS 9.1/10Last modified Oct 20, 2026

Description

Ning compress-lzf before 1.2.0 contains an out-of-bounds memory access vulnerability in the sun.misc.Unsafe based UnsafeChunkDecoder that fails to validate back-references and literal runs. Attackers can supply crafted LZF streams to applications using the default LZFDecoder to leak unrelated JVM heap memory into decompressed output or crash the JVM.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Weakness enumeration

CWE-125

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Oct 20, 2026
Last modified: Oct 20, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-1093964.2Thelia before 3.1.2 and 3.2.x before 3.2.1 contains a CSV formula injection vulnerability that allows unauthenticated visitors to inject spr CVE-2026-1093977.2Thelia before 3.1.2 and 3.2.x before 3.2.1 contains an unrestricted file upload vulnerability that allows authenticated back-office users to CVE-2026-1093987.5Gumlet php-image-resize before 3.0.1 contains a denial of service vulnerability because the ImageResize constructor in lib/ImageResize.php p CVE-2026-1093998.1SWUpdate through 2026.05.1 contains an improper certificate validation vulnerability in crypto/swupdate_cms_verify_openssl.c that trusts unt CVE-2026-10944.6GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.8 before 18.8.4 that could have allowed an authenticated devel CVE-2026-109408.3Race in Codecs in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to pote CVE-2026-1094007.5The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and i CVE-2026-1094012.7The WP Mail Logging plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.17.0 via th CVE-2026-1094026.3A vulnerability was found in conductor-oss conductor 3.22.0. Affected is the function MCPService.listTools of the file ai/src/main/java/org/CVE-2026-1094037.3A vulnerability was determined in conductor-oss conductor up to 3.32.5. Affected by this vulnerability is the function A2AService.getAgentCa CVE-2026-1094045.3A vulnerability was identified in conductor-oss conductor up to 3.33.0-rc10. Affected by this issue is some unknown functionality of the fil CVE-2026-1094057.3A security flaw has been discovered in conductor-oss conductor up to 3.33.0-rc10. This affects the function KafkaPublishTask.start of the fi