compress vulnerabilities

2 known vulnerabilities in compress from Klauspost. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.7 High severity

  compress: Integer Overflow or Wraparound

  CVE-2026-116591Oct 26, 2026Klauspost

  compress provides various compression algorithms. Prior to 1.20.2, the zstd DecodeAll and streaming decoder paths can panic when a crafted two-block frame reaches huff0.ReadTable with an FSE normalized count of 32768 that readNCount stores in int16 as -32768.

• 7.5 High severity

  compress: Integer Overflow or Wraparound

  CVE-2026-63209Sep 29, 2026Klauspost

  compress provides various compression algorithms. Prior to version 1.18.7, a signed integer overflow vulnerability in s2.NewDict() allows an attacker to bypass repeat index validation by supplying a dictionary with a uvarint-encoded repeat value exceeding MaxI