CVE-2026-116591

HighCVSS 8.7

Published: 26/10/2026(UTC)Updated: 27/10/2026(UTC)Translated: 26/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.33%

26th percentile - higher than 26% of all known CVEs

Summary

compress prior to 1.20.2 has a flaw in the zstd DecodeAll and streaming decoder paths that can panic when a crafted two-block frame reaches huff0.ReadTable with an FSE normalized count of 32768 stored in int16 as -32768. The wrapped count lets buildDtable retain stale decode-table state from the prior block, and nextFast derives an out-of-range state and indexes beyond the table instead of returning a decode error.

Risk Assessment

Untrusted zstd input can cause a panic and crash the application, leading to denial of service. The risk affects services that process compressed data from untrusted sources.

Recommendation

Upgrade the compress library to version 1.20.2 or later. Until then, consider limiting processing of untrusted zstd streams.

Other vulnerabilities in compress

CVE-2026-63209High
Prior to version 1.18.7, a signed integer overflow vulnerability in s2.NewDict() allows an attacker to bypass repeat index validation by supplying a dictionary with a uvarint-encoded repeat value exceeding MaxInt64. When Dict.Encode() is subsequently called, the overflowed negative repeat value causes an out-of-bounds memory access via unsafe.Pointer arithmetic, crashing the process with SIGSEGV. This issue has been patched in version 1.18.7.

Original NVD description (English source)

compress provides various compression algorithms. Prior to 1.20.2, the zstd DecodeAll and streaming decoder paths can panic when a crafted two-block frame reaches huff0.ReadTable with an FSE normalized count of 32768 that readNCount stores in int16 as -32768. The wrapped count allows buildDtable to retain stale fse.Scratch decode-table state from the prior block, and nextFast then derives an out-of-range state and indexes beyond the table instead of returning a decode error. Both blocks are required to preserve and then reuse the stale state, allowing untrusted zstd input to crash an application. This issue is fixed in version 1.20.2.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS