CVE catalog

CVE-2026-63209

compress provides various compression algorithms. Prior to version 1.18.7, a signed integer overflow vulnerability in s2.NewDict() allows an attacker to bypass repeat index validation by supplying a d

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
Updated
Source
[NVD] · [CVE record]
EPSS
0.50% · Oct 25, 2026

compress provides various compression algorithms. Prior to version 1.18.7, a signed integer overflow vulnerability in s2.NewDict() allows an attacker to bypass repeat index validation by supplying a dictionary with a uvarint-encoded repeat value exceeding MaxInt64. When Dict.Encode() is subsequently called, the overflowed negative repeat value causes an out-of-bounds memory access via unsafe.Pointer arithmetic, crashing the process with SIGSEGV. This issue has been patched in version 1.18.7.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiangolang-github-klauspost-compresssid1.20.0+ds1-1fixed
Debiangolang-github-klauspost-compressforky1.20.0+ds1-1fixed
Debiangolang-github-klauspost-compresstrixie1.18.0+ds1-1vulnerable
Debiangolang-github-klauspost-compressbookworm1.15.12+ds1-3not affected
Gogithub.com/klauspost/compressNot reported1.18.7fixed
Opensusedistributionleap 16.03.1.1-160000.5.1fixed
Susegoogle-osconfig-agentlinux enterprise module for public cloud 1220260928.01-1.63.1fixed
Opensusehelmtumbleweed4.3.0-4.1fixed
Opensusehelm3tumbleweed3.22.0-3.1fixed
Opensusego-containerregistrytumbleweed0.22.1-2.1fixed
Opensusedistributiontumbleweed3.1.1-9.1fixed
Opensusegoogle-osconfig-agenttumbleweed20260928.01-1.1fixed
Opensusehaulertumbleweed2.1.1-1.1fixed
Opensusecadvisortumbleweed0.60.6-1.1fixed
Opensusealiyun-clitumbleweed3.5.1-2.1fixed
Opensuseamazon-cloudwatch-agenttumbleweed1.300073.0-1.1fixed
Susegoogle-osconfig-agentlinux enterprise server 16.020260928.01-160000.1.1fixed
Susegoogle-osconfig-agentlinux enterprise server for sap applications 16.020260928.01-160000.1.1fixed
Susehelmlinux enterprise server 16.04.3.0-160000.2.1fixed
Susehelmlinux enterprise server for sap applications 16.04.3.0-160000.2.1fixed
Opensusecadvisorleap 16.00.60.6-bp160.1.1fixed
Opensusegoogle-osconfig-agentleap 16.020260928.01-160000.1.1fixed
Opensusehelmleap 16.04.3.0-160000.2.1fixed
Opensuserqlitetumbleweed10.6.1-1.1fixed
Susealiyun-clilinux enterprise server 16.03.5.1-160000.1.1fixed
Susealiyun-clilinux enterprise server for sap applications 16.03.5.1-160000.1.1fixed
Opensusealiyun-clileap 16.03.5.1-160000.1.1fixed
Susegoogle-osconfig-agentlinux micro 6.120260928.01-slfo.1.1_1.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiangolang-github-klauspost-compresssourcesid1.19.0+ds1-1not yet assignedNot reportedNot reported
Debiangolang-github-klauspost-compresssourceforky1.19.0+ds1-1not yet assignedNot reportedNot reported
Debiangolang-github-klauspost-compresssourcetrixie(unfixed)not yet assignedNot reportedNot reported
Debiangolang-github-klauspost-compresssourcebookwormNot affectedunimportantNot reportedNot reported
Gogithub.com/klauspost/compressgoNot reported1.18.7Not reportedGHSA-259R-337F-4RFWNot reported
Opensusedistributionrpmleap 16.03.1.1-160000.5.1Not reportedOPENSUSE-SU-2026:22039-1Not reported
Susegoogle-osconfig-agentrpmlinux enterprise module for public cloud 1220260928.01-1.63.1Not reportedSUSE-SU-2026:4554-1Not reported
Opensusehelmrpmtumbleweed4.3.0-4.1Not reportedOPENSUSE-SU-2026:11963-1Not reported
Opensusehelm3rpmtumbleweed3.22.0-3.1Not reportedOPENSUSE-SU-2026:11964-1Not reported
Opensusego-containerregistryrpmtumbleweed0.22.1-2.1Not reportedOPENSUSE-SU-2026:11960-1Not reported
Opensusedistributionrpmtumbleweed3.1.1-9.1Not reportedOPENSUSE-SU-2026:11957-1Not reported
Opensusegoogle-osconfig-agentrpmtumbleweed20260928.01-1.1Not reportedOPENSUSE-SU-2026:11961-1Not reported
Opensusehaulerrpmtumbleweed2.1.1-1.1Not reportedOPENSUSE-SU-2026:11962-1Not reported
Opensusecadvisorrpmtumbleweed0.60.6-1.1Not reportedOPENSUSE-SU-2026:11955-1Not reported
Opensusealiyun-clirpmtumbleweed3.5.1-2.1Not reportedOPENSUSE-SU-2026:11953-1Not reported
Opensuseamazon-cloudwatch-agentrpmtumbleweed1.300073.0-1.1Not reportedOPENSUSE-SU-2026:11939-1Not reported
Susegoogle-osconfig-agentrpmlinux enterprise server 16.020260928.01-160000.1.1Not reportedSUSE-SU-2026:24222-1Not reported
Susegoogle-osconfig-agentrpmlinux enterprise server for sap applications 16.020260928.01-160000.1.1Not reportedSUSE-SU-2026:24222-1Not reported
Susehelmrpmlinux enterprise server 16.04.3.0-160000.2.1Not reportedSUSE-SU-2026:24247-1Not reported
Susehelmrpmlinux enterprise server for sap applications 16.04.3.0-160000.2.1Not reportedSUSE-SU-2026:24247-1Not reported
Opensusecadvisorrpmleap 16.00.60.6-bp160.1.1Not reportedOPENSUSE-SU-2026:22117-1Not reported
Opensusegoogle-osconfig-agentrpmleap 16.020260928.01-160000.1.1Not reportedOPENSUSE-SU-2026:22078-1Not reported
Opensusehelmrpmleap 16.04.3.0-160000.2.1Not reportedOPENSUSE-SU-2026:22057-1Not reported
Opensuserqliterpmtumbleweed10.6.1-1.1Not reportedOPENSUSE-SU-2026:12186-1Not reported
Susealiyun-clirpmlinux enterprise server 16.03.5.1-160000.1.1Not reportedSUSE-SU-2026:24261-1Not reported
Susealiyun-clirpmlinux enterprise server for sap applications 16.03.5.1-160000.1.1Not reportedSUSE-SU-2026:24261-1Not reported
Opensusealiyun-clirpmleap 16.03.5.1-160000.1.1Not reportedOPENSUSE-SU-2026:22140-1Not reported
Susegoogle-osconfig-agentrpmlinux micro 6.120260928.01-slfo.1.1_1.1Not reportedSUSE-SU-2026:24277-1Not reported

Notes

[trixie] golang-github-klauspost-compress: Minor issue

OpenFactory catalog packages

[Debian 13 (Trixie)]

[openSUSE Tumbleweed]

  • [aliyun-cli]Affected

    Source package: [aliyun-cli]

    Details (1)

    • 3.4.11-1.1 · x86_64 · tumbleweed

      Affected · Fixed: 3.5.1-2.1

      nvd · aliyun-cli · opensuse · tumbleweed

  • [amazon-cloudwatch-agent]Affected

    Source package: [amazon-cloudwatch-agent]

    Details (1)

    • 1.300071.0-2.1 · x86_64 · tumbleweed

      Affected · Fixed: 1.300073.0-1.1

      nvd · amazon-cloudwatch-agent · opensuse · tumbleweed

  • [cadvisor]Affected

    Source package: [cadvisor]

    Details (1)

    • 0.60.5-2.1 · x86_64 · tumbleweed

      Affected · Fixed: 0.60.6-1.1

      nvd · cadvisor · opensuse · tumbleweed

  • [go-containerregistry]Affected

    Source package: [go-containerregistry]

    Details (1)

    • 0.22.0-1.1 · x86_64 · tumbleweed

      Affected · Fixed: 0.22.1-2.1

      nvd · go-containerregistry · opensuse · tumbleweed

  • [google-osconfig-agent]Affected

    Source package: [google-osconfig-agent]

    Details (1)

    • 20260803.00-1.1 · x86_64 · tumbleweed

      Affected · Fixed: 20260928.01-1.1

      nvd · google-osconfig-agent · opensuse · tumbleweed

  • [hauler]Affected

    Source package: [hauler]

    Details (1)

    • 2.0.3-1.1 · x86_64 · tumbleweed

      Affected · Fixed: 2.1.1-1.1

      nvd · hauler · opensuse · tumbleweed

  • [helm]Affected

    Source package: [helm]

    Details (1)

    • 4.2.4-1.1 · x86_64 · tumbleweed

      Affected · Fixed: 4.3.0-4.1

      nvd · helm · opensuse · tumbleweed

  • [helm3]Affected

    Source package: [helm3]

    Details (1)

    • 3.21.3-6.1 · x86_64 · tumbleweed

      Affected · Fixed: 3.22.0-3.1

      nvd · helm3 · opensuse · tumbleweed

  • [rqlite]Affected

    Source package: [rqlite]

    Details (1)

    • 10.2.7-1.2 · x86_64 · tumbleweed

      Affected · Fixed: 10.6.1-1.1

      nvd · rqlite · opensuse · tumbleweed

  • [crane]Unknown

    Source package: [go-containerregistry]

    Details (1)

    • 0.22.0-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 0.22.1-2.1

      Version impact unknown

      nvd · go-containerregistry · opensuse · tumbleweed

  • [crane-bash-completion]Unknown

    Source package: [go-containerregistry]

    Details (1)

    • 0.22.0-1.1 · noarch · tumbleweed

      Unknown · Fixed: 0.22.1-2.1

      Version impact unknown

      nvd · go-containerregistry · opensuse · tumbleweed

  • [crane-fish-completion]Unknown

    Source package: [go-containerregistry]

    Details (1)

    • 0.22.0-1.1 · noarch · tumbleweed

      Unknown · Fixed: 0.22.1-2.1

      Version impact unknown

      nvd · go-containerregistry · opensuse · tumbleweed

  • [crane-zsh-completion]Unknown

    Source package: [go-containerregistry]

    Details (1)

    • 0.22.0-1.1 · noarch · tumbleweed

      Unknown · Fixed: 0.22.1-2.1

      Version impact unknown

      nvd · go-containerregistry · opensuse · tumbleweed

  • [distribution-registry]Unknown

    Source package: [distribution]

    Details (1)

    • 3.1.1-5.1 · x86_64 · tumbleweed

      Unknown · Fixed: 3.1.1-9.1

      Version impact unknown

      nvd · distribution · opensuse · tumbleweed

  • [gcrane]Unknown

    Source package: [go-containerregistry]

    Details (1)

    • 0.22.0-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 0.22.1-2.1

      Version impact unknown

      nvd · go-containerregistry · opensuse · tumbleweed

  • [gcrane-bash-completion]Unknown

    Source package: [go-containerregistry]

    Details (1)

    • 0.22.0-1.1 · noarch · tumbleweed

      Unknown · Fixed: 0.22.1-2.1

      Version impact unknown

      nvd · go-containerregistry · opensuse · tumbleweed

  • [gcrane-fish-completion]Unknown

    Source package: [go-containerregistry]

    Details (1)

    • 0.22.0-1.1 · noarch · tumbleweed

      Unknown · Fixed: 0.22.1-2.1

      Version impact unknown

      nvd · go-containerregistry · opensuse · tumbleweed

  • [gcrane-zsh-completion]Unknown

    Source package: [go-containerregistry]

    Details (1)

    • 0.22.0-1.1 · noarch · tumbleweed

      Unknown · Fixed: 0.22.1-2.1

      Version impact unknown

      nvd · go-containerregistry · opensuse · tumbleweed

  • [helm3-bash-completion]Unknown

    Source package: [helm3]

    Details (1)

    • 3.21.3-6.1 · noarch · tumbleweed

      Unknown · Fixed: 3.22.0-3.1

      Version impact unknown

      nvd · helm3 · opensuse · tumbleweed

Next results

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [GitHub Advisory Database] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]