--- id: CVE-2026-63209 title: compress provides various compression algorithms summary: >- compress provides various compression algorithms. Prior to version 1.18.7, a signed integer overflow vulnerability in s2.NewDict() allows an attacker to bypass repeat index validation by supplying a dictionary with a uvarint-encoded repe… severity: high cvss: 7.5 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H' cwe: - CWE-190 - CWE-787 - CWE-823 vendor: klauspost product: compress affected: - compress < 1.18.7 patched: - github.com/klauspost/compress 1.18.7 published: '2026-09-29' updated: '2026-09-30' sourceUpdated: '2026-09-30T19:57:08.043' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-63209' references: - url: >- https://github.com/klauspost/compress/commit/539243b8823ee8f03e49969823d57c348c917536 label: security-advisories@github.com - url: 'https://github.com/klauspost/compress/releases/tag/v1.18.7' label: security-advisories@github.com - url: >- https://github.com/klauspost/compress/security/advisories/GHSA-259r-337f-4rfw label: security-advisories@github.com - url: >- https://github.com/klauspost/compress/security/advisories/GHSA-259r-337f-4rfw label: 134c704f-9b21-4f2e-91b3-4a467353bcc0 - url: >- https://github.com/klauspost/compress/commit/8668e357e776d5152ed62f33c17f21b8690664fa - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-63209.json - url: 'https://access.redhat.com/security/cve/CVE-2026-63209' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2543236' - url: 'https://www.cve.org/CVERecord?id=CVE-2026-63209' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-63209' - url: 'https://access.redhat.com/errata/RHSA-2026:70670' - url: 'https://access.redhat.com/errata/RHSA-2026:72497' - url: 'https://access.redhat.com/errata/RHSA-2026:72498' - url: 'https://access.redhat.com/errata/RHSA-2026:72507' - url: 'https://access.redhat.com/errata/RHSA-2026:68806' - url: 'https://access.redhat.com/errata/RHSA-2026:68717' - url: 'https://access.redhat.com/errata/RHSA-2026:68729' - url: 'https://access.redhat.com/errata/RHSA-2026:54419' - url: 'https://access.redhat.com/errata/RHSA-2026:70031' - url: 'https://access.redhat.com/errata/RHSA-2026:72570' - url: 'https://access.redhat.com/errata/RHSA-2026:72496' - url: 'https://access.redhat.com/errata/RHSA-2026:54413' - url: 'https://access.redhat.com/errata/RHSA-2026:68256' - url: 'https://access.redhat.com/errata/RHSA-2026:68272' - url: 'https://access.redhat.com/errata/RHSA-2026:68290' - url: 'https://access.redhat.com/errata/RHSA-2026:68591' - url: 'https://access.redhat.com/errata/RHSA-2026:70726' - url: 'https://access.redhat.com/errata/RHSA-2026:58472' - url: 'https://access.redhat.com/errata/RHSA-2026:70684' - url: 'https://access.redhat.com/errata/RHSA-2026:72493' - url: 'https://access.redhat.com/errata/RHSA-2026:68808' - url: 'https://access.redhat.com/errata/RHSA-2026:72490' - url: 'https://access.redhat.com/errata/RHSA-2026:83013' - url: 'https://github.com/klauspost/compress/pull/1163' - url: 'https://github.com/advisories/GHSA-259r-337f-4rfw' - url: 'https://github.com/klauspost/compress' - url: 'https://access.redhat.com/errata/RHSA-2026:85227' tags: - nvd - cve.org - osv - go - csaf - vex - red-hat - ghsa epss: 0.00501 epssPercentile: 0.42693 aliases: - GO-2026-5841 - GHSA-259r-337f-4rfw ecosystem: go ssvc: exploitation: none automatable: 'yes' technicalImpact: partial timestamp: '2026-09-29T16:31:39.668233Z' ingestedAt: '2026-09-29T16:39:33.260Z' --- ## Overview compress provides various compression algorithms. Prior to version 1.18.7, a signed integer overflow vulnerability in s2.NewDict() allows an attacker to bypass repeat index validation by supplying a dictionary with a uvarint-encoded repeat value exceeding MaxInt64. When Dict.Encode() is subsequently called, the overflowed negative repeat value causes an out-of-bounds memory access via unsafe.Pointer arithmetic, crashing the process with SIGSEGV. This issue has been patched in version 1.18.7. ## Remediation Refer to the linked advisories for vendor-supplied fixes and affected version ranges. ## Package advisory (CVE-2026-63209) Affected packages: - `github.com/klauspost/compress >= 1.16.0, < 1.18.7` Patched in: - `github.com/klauspost/compress 1.18.7` Source: https://osv.dev/vulnerability/GO-2026-5841 ## Vendor advisories - **RHSA-2026:70670** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:70670) - **RHSA-2026:72497** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-28 · [advisory](https://access.redhat.com/errata/RHSA-2026:72497) - **RHSA-2026:72498** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-28 · [advisory](https://access.redhat.com/errata/RHSA-2026:72498) - **RHSA-2026:72507** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-28 · [advisory](https://access.redhat.com/errata/RHSA-2026:72507) - **RHSA-2026:68806** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-18 · [advisory](https://access.redhat.com/errata/RHSA-2026:68806) - **RHSA-2026:68717** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68717) - **RHSA-2026:68729** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68729) - **RHSA-2026:54419** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-08-12 · [advisory](https://access.redhat.com/errata/RHSA-2026:54419) - **RHSA-2026:70031** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:70031) - **RHSA-2026:72570** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-28 · [advisory](https://access.redhat.com/errata/RHSA-2026:72570) - **RHSA-2026:72496** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-28 · [advisory](https://access.redhat.com/errata/RHSA-2026:72496) - **Red Hat VEX** · Important · affected: Compliance Operator, File Integrity Operator, Multicluster Engine for Kubernetes, Multicluster Global Hub, Network Observability Operator, OpenShift API for Data Protection, … · no fix planned: Red Hat Hardened Images, Red Hat OpenShift GitOps, Compliance Operator, File Integrity Operator, … · updated 2026-10-26 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-63209.json) - **RHSA-2026:83013** · Red Hat · fixed in: Logging Subsystem for Red Hat OpenShift 6.0 · released 2026-10-14 · [advisory](https://access.redhat.com/errata/RHSA-2026:83013) - **RHSA-2026:85227** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.16 · released 2026-10-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:85227)