Voidly
Research
NIST · via Voidly Atlas

CVE-2026-109395

This is the agency's own public-domain data, curated and made citable by Voidly. Voidly adds no independent claim — always verify against the linked canonical source.
cve id
CVE-2026-109395
published
2026-10-20T01:17:09.957
last modified
2026-10-20T01:17:09.957
status
Received
description
Ning compress-lzf before 1.2.0 contains an out-of-bounds memory access vulnerability in the sun.misc.Unsafe based UnsafeChunkDecoder that fails to validate back-references and literal runs. Attackers can supply crafted LZF streams to applications using the default LZFDecoder to leak unrelated JVM heap memory into decompressed output or crash the JVM.
cvss score
9.1
cvss severity
CRITICAL
cvss vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
cwes
CWE-125
cpe count
0
Verify at NIST National Vulnerability Database ↗
Cite this record

Cite this record

CVE-2026-109395 — CRITICAL. NIST, via Voidly Atlas — Surveillance & Digital-Rights Watch. Retrieved 2026-10-20, https://voidly.ai/atlas/federal/nvd-cves/CVE-2026-109395

@misc{voidly_nvd_cves_CVE2026109395,
  title        = {CVE-2026-109395 — CRITICAL},
  author       = {{Voidly}},
  howpublished = {\url{https://voidly.ai/atlas/federal/nvd-cves/CVE-2026-109395}},
  note         = {Source: NIST National Vulnerability Database, https://nvd.nist.gov/vuln/detail/CVE-2026-109395. Public domain (17 U.S.C. §105); re-surfaced under CC BY 4.0},
  urldate      = {2026-10-20},
  year         = {2026}
}

Also available as JSON/BibTeX/APA: API record. Source data is U.S. federal public domain (17 U.S.C. §105). Re-surfaced by Voidly under CC BY 4.0.