CVE-2026-109395 | CVSS: 9.1 | 严重级别: CRITICAL
Ning compress-lzf before 1.2.0 contains an out-of-bounds memory access vulnerability in the sun.misc.Unsafe based UnsafeChunkDecoder that fails to validate back-references and literal runs. Attackers can supply crafted LZF streams to applications using the default LZFDecoder to leak unrelated JVM heap memory into decompressed output or crash the JVM.
参考链接:
• https://github.com/github/securitylab/discussions/970
• https://github.com/ning/compress
• https://github.com/ning/compress/blob/compress-lzf-1.1.3/src/main/java/com/ning/
📌 数据来源: NVD 官方
⚠️ 合规声明: 本文内容仅用于网络安全合规学习、科研与授权测试用途。严禁用于任何未授权行为,违者自行承担全部法律责任。