{"id":"CVE-2026-63209","title":"compress provides various compression algorithms","summary":"compress provides various compression algorithms. Prior to version 1.18.7, a signed integer overflow vulnerability in s2.NewDict() allows an attacker to bypass repeat index validation by supplying a dictionary with a uvarint-encoded repe…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-190","CWE-787","CWE-823"],"vendor":"klauspost","product":"compress","affected":["compress < 1.18.7"],"patched":["github.com/klauspost/compress 1.18.7"],"published":"2026-09-29","updated":"2026-09-30","sourceUpdated":"2026-09-30T19:57:08.043","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-63209","references":[{"url":"https://github.com/klauspost/compress/commit/539243b8823ee8f03e49969823d57c348c917536","label":"security-advisories@github.com"},{"url":"https://github.com/klauspost/compress/releases/tag/v1.18.7","label":"security-advisories@github.com"},{"url":"https://github.com/klauspost/compress/security/advisories/GHSA-259r-337f-4rfw","label":"security-advisories@github.com"},{"url":"https://github.com/klauspost/compress/security/advisories/GHSA-259r-337f-4rfw","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://github.com/klauspost/compress/commit/8668e357e776d5152ed62f33c17f21b8690664fa"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-63209.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-63209"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2543236"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-63209"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63209"},{"url":"https://access.redhat.com/errata/RHSA-2026:70670"},{"url":"https://access.redhat.com/errata/RHSA-2026:72497"},{"url":"https://access.redhat.com/errata/RHSA-2026:72498"},{"url":"https://access.redhat.com/errata/RHSA-2026:72507"},{"url":"https://access.redhat.com/errata/RHSA-2026:68806"},{"url":"https://access.redhat.com/errata/RHSA-2026:68717"},{"url":"https://access.redhat.com/errata/RHSA-2026:68729"},{"url":"https://access.redhat.com/errata/RHSA-2026:54419"},{"url":"https://access.redhat.com/errata/RHSA-2026:70031"},{"url":"https://access.redhat.com/errata/RHSA-2026:72570"},{"url":"https://access.redhat.com/errata/RHSA-2026:72496"},{"url":"https://access.redhat.com/errata/RHSA-2026:54413"},{"url":"https://access.redhat.com/errata/RHSA-2026:68256"},{"url":"https://access.redhat.com/errata/RHSA-2026:68272"},{"url":"https://access.redhat.com/errata/RHSA-2026:68290"},{"url":"https://access.redhat.com/errata/RHSA-2026:68591"},{"url":"https://access.redhat.com/errata/RHSA-2026:70726"},{"url":"https://access.redhat.com/errata/RHSA-2026:58472"},{"url":"https://access.redhat.com/errata/RHSA-2026:70684"},{"url":"https://access.redhat.com/errata/RHSA-2026:72493"},{"url":"https://access.redhat.com/errata/RHSA-2026:68808"},{"url":"https://access.redhat.com/errata/RHSA-2026:72490"},{"url":"https://access.redhat.com/errata/RHSA-2026:83013"},{"url":"https://github.com/klauspost/compress/pull/1163"},{"url":"https://github.com/advisories/GHSA-259r-337f-4rfw"},{"url":"https://github.com/klauspost/compress"},{"url":"https://access.redhat.com/errata/RHSA-2026:85227"}],"tags":["nvd","cve.org","osv","go","csaf","vex","red-hat","ghsa"],"epss":0.00501,"epssPercentile":0.42693,"aliases":["GO-2026-5841","GHSA-259r-337f-4rfw"],"ecosystem":"go","ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-09-29T16:31:39.668233Z"},"ingestedAt":"2026-09-29T16:39:33.260Z","slug":"CVE-2026-63209","body":"## Overview\n\ncompress provides various compression algorithms. Prior to version 1.18.7, a signed integer overflow vulnerability in s2.NewDict() allows an attacker to bypass repeat index validation by supplying a dictionary with a uvarint-encoded repeat value exceeding MaxInt64. When Dict.Encode() is subsequently called, the overflowed negative repeat value causes an out-of-bounds memory access via unsafe.Pointer arithmetic, crashing the process with SIGSEGV. This issue has been patched in version 1.18.7.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-63209)\n\nAffected packages:\n\n- `github.com/klauspost/compress >= 1.16.0, < 1.18.7`\n\nPatched in:\n\n- `github.com/klauspost/compress 1.18.7`\n\nSource: https://osv.dev/vulnerability/GO-2026-5841\n\n## Vendor advisories\n\n- **RHSA-2026:70670** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:70670)\n- **RHSA-2026:72497** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-28 · [advisory](https://access.redhat.com/errata/RHSA-2026:72497)\n- **RHSA-2026:72498** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-28 · [advisory](https://access.redhat.com/errata/RHSA-2026:72498)\n- **RHSA-2026:72507** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-28 · [advisory](https://access.redhat.com/errata/RHSA-2026:72507)\n- **RHSA-2026:68806** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-18 · [advisory](https://access.redhat.com/errata/RHSA-2026:68806)\n- **RHSA-2026:68717** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68717)\n- **RHSA-2026:68729** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68729)\n- **RHSA-2026:54419** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-08-12 · [advisory](https://access.redhat.com/errata/RHSA-2026:54419)\n- **RHSA-2026:70031** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:70031)\n- **RHSA-2026:72570** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-28 · [advisory](https://access.redhat.com/errata/RHSA-2026:72570)\n- **RHSA-2026:72496** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-28 · [advisory](https://access.redhat.com/errata/RHSA-2026:72496)\n- **Red Hat VEX** · Important · affected: Compliance Operator, File Integrity Operator, Multicluster Engine for Kubernetes, Multicluster Global Hub, Network Observability Operator, OpenShift API for Data Protection, … · no fix planned: Red Hat Hardened Images, Red Hat OpenShift GitOps, Compliance Operator, File Integrity Operator, … · updated 2026-10-26 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-63209.json)\n- **RHSA-2026:83013** · Red Hat · fixed in: Logging Subsystem for Red Hat OpenShift 6.0 · released 2026-10-14 · [advisory](https://access.redhat.com/errata/RHSA-2026:83013)\n- **RHSA-2026:85227** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.16 · released 2026-10-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:85227)","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}