CVE-2026-109395

{
  "etk_id": "ETK-2026-2120",
  "cve_id": "CVE-2026-109395",
  "display_id": "CVE-2026-109395",
  "ghsa_id": "GHSA-7xjc-8h6q-2f5h",
  "euvd_id": "EUVD-2026-104679",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Out-of-bounds read in ning compress-lzf decoder",
  "summary": "ning compress-lzf versions before 1.2.0 can read beyond intended data boundaries while decoding LZF input. An attacker who can provide LZF data to an application using the default decoder may cause memory disclosure through decoded output or crash the JVM.",
  "mitigation": "Upgrade ning compress-lzf to version 1.2.0 or later. Until upgraded, do not process untrusted LZF input with the default decoder.",
  "vendor": "ning",
  "product": "compress-lzf",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 1.2.0"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "1.2.0"
      ],
      "package_name": "compress-lzf",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 9.1,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
  "epss_score": 0.004,
  "epss_percentile": 0.3314,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": true,
  "check_confidence_basis": "assessed",
  "exploit": false,
  "pipeline_minutes": 16.50929573333333,
  "t0_at": "2026-10-20T00:46:04.633000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-20T04:50:54.489891+00:00",
      "days": 0.1700214917939815,
      "is_lower_bound": false,
      "measured_at": "2026-10-20T00:46:04.633000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-20T00:46:04.633000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-20T00:46:04.633000+00:00",
      "url": "https://github.com/advisories/GHSA-7xjc-8h6q-2f5h"
    }
  }
}