Skip to content

Update module github.com/klauspost/compress to v1.18.7 [SECURITY] - #323

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/go-github.com-klauspost-compress-vulnerability
Open

Update module github.com/klauspost/compress to v1.18.7 [SECURITY]#323
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/go-github.com-klauspost-compress-vulnerability

Conversation

@renovate

@renovate renovate Bot commented Oct 21, 2026

Copy link
Copy Markdown

This PR contains the following updates:

Package Change Age Confidence
github.com/klauspost/compress v1.17.9 → v1.18.7 age confidence

Compress/s2: Integer Overflow or Wraparound and Out-of-bounds Write in compress

CVE-2026-63209 / GHSA-259r-337f-4rfw

More information

Details

Signed Integer Overflow in s2.NewDict
Summary

A signed integer overflow vulnerability in s2.NewDict() allows an attacker to bypass repeat index validation by supplying a dictionary with a uvarint-encoded repeat value exceeding MaxInt64. When Dict.Encode() is subsequently called, the overflowed negative repeat value causes an out-of-bounds memory access via unsafe.Pointer arithmetic, crashing the process with SIGSEGV.

Package
  • Name: github.com/klauspost/compress/s2
  • Ecosystem: Go
  • Affected versions: <= v1.18.6 (all versions with NewDict function)
Severity

High (7.5) — CVSS v3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Vulnerability
Type
  • CWE-190: Integer Overflow or Wraparound
  • CWE-787: Out-of-bounds Write (via unsafe.Pointer)
Description

The NewDict() function reads a uvarint from dictionary data and converts it to int:

r, n := binary.Uvarint(dict)
// ...
d.repeat = int(r)
if d.repeat > len(dict) {
    return nil
}

When r exceeds MaxInt64 (9223372036854775807), int(r) overflows to a negative value. Since a negative number is never greater than a positive length, the validation check is bypassed.

When Dict.Encode() is called, the negative repeat value causes an integer overflow in encodeBlockDictGo():

repeat := len(dict.dict) - dict.repeat  // overflows: 62 - (-5758978476775341977) = huge positive
candidate := len(dict.dict) - repeat + s // underflows to negative
load32(dict.dict, candidate)             // OOB via unsafe.Pointer

load32 calls le.Load32 which uses unsafe.Pointer arithmetic without bounds checking:

func Load32[I Indexer](b []byte, i I) uint32 {
    return *(*uint32)(unsafe.Add(unsafe.Pointer(unsafe.SliceData(b)), i))
}

This causes a segmentation fault (SIGSEGV) when the negative index is dereferenced.

PoC
package main

import (
    "encoding/binary"
    "fmt"
    "github.com/klauspost/compress/s2"
)

func main() {
    var dictData []byte
    buf := make([]byte, binary.MaxVarintLen64)
    n := binary.PutUvarint(buf, 12687765596934209639) // > MaxInt64
    dictData = append(dictData, buf[:n]...)
    dictData = append(dictData, make([]byte, 16)...) // minimum dict size

    dict := s2.NewDict(dictData)
    // dict is non-nil despite invalid repeat value (overflow bypassed validation)

    src := make([]byte, 64)
    for i := range src { src[i] = byte(i) }
    dict.Encode(nil, src) // SIGSEGV: OOB access via unsafe.Pointer
}
Impact
  • Denial of Service: The process crashes immediately with SIGSEGV
Attack Vector

Any application that:

  1. Accepts user-supplied S2 dictionary data via s2.NewDict()
  2. Calls Dict.Encode() on any data ≥32 bytes
Suggested Fix

Validate the uvarint value before converting to int:

if r > math.MaxInt64 {
    return nil
}
d.repeat = int(r)

Or use uint for the repeat field and validate against uint(len(dict)).

References
  • Source: s2/dict.go lines 59-61 (vulnerability), s2/encode_all.go line 947 (crash site)
  • Commit: 539243b (v1.18.6 + 4 commits)
Credits

Christopher Linke / https://github.com/celinke97/

Severity

  • CVSS Score: 7.5 / 10 (High)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

klauspost/compress (github.com/klauspost/compress)

v1.18.7

Compare Source

  • Fix s2.NewDict OOB read.

Security release without other changes.

Full Changelog: klauspost/compress@v1.18.6...v1.18.7

v1.18.6

Compare Source

What's Changed

New Contributors

Full Changelog: klauspost/compress@v1.18.5...v1.18.6

v1.18.5

Compare Source

What's Changed

Full Changelog: klauspost/compress@v1.18.4...v1.18.5

v1.18.4

Compare Source

What's Changed

New Contributors

Full Changelog: klauspost/compress@v1.18.2...v1.18.4

v1.18.3

Compare Source

Downstream CVE-2025-61728

See golang/go#77102

Full Changelog: klauspost/compress@v1.18.2...v1.18.3

v1.18.2

Compare Source

What's Changed

v1.18.1 is marked "retracted" due to invalid flate/zip/gzip encoding.

New Contributors

Full Changelog: klauspost/compress@v1.18.1...v1.18.2

v1.18.1

Compare Source

What's Changed

New Contributors

Full Changelog: klauspost/compress@v1.18.0...v1.18.1

v1.18.0

Compare Source

What's Changed

New Contributors

Full Changelog: klauspost/compress@v1.17.11...v1.18.0

v1.17.11

Compare Source

What's Changed

New Contributors

Full Changelog: klauspost/compress@v1.17.10...v1.17.11

v1.17.10

Compare Source

What's Changed

New Contributors

Full Changelog: klauspost/compress@v1.17.9...v1.17.10

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot requested review from Danielius1922 and jkralik October 21, 2026 00:29
@renovate

renovate Bot commented Oct 21, 2026

Copy link
Copy Markdown
Author

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • The go directive was updated for compatibility reasons

Details:

Package Change
go 1.22.5 -> 1.24

@coderabbitai

coderabbitai Bot commented Oct 21, 2026

Copy link
Copy Markdown

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration
  • Configuration used: defaults
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: f0108a10-2ed5-484f-8965-14b03227d8d3

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Danielius1922 Danielius1922 Awaiting requested review from Danielius1922
@jkralik jkralik Awaiting requested review from jkralik

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants