[deckhouse-BOaTswain]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/klauspost/compress	v1.18.5 -> v1.20.2

GitHub Vulnerability Alerts

CVE-2026-63209

Signed Integer Overflow in s2.NewDict

Summary

A signed integer overflow vulnerability in s2.NewDict() allows an attacker to bypass repeat index validation by supplying a dictionary with a uvarint-encoded repeat value exceeding MaxInt64. When Dict.Encode() is subsequently called, the overflowed negative repeat value causes an out-of-bounds memory access via unsafe.Pointer arithmetic, crashing the process with SIGSEGV.

Package

• Name: github.com/klauspost/compress/s2
• Ecosystem: Go
• Affected versions: <= v1.18.6 (all versions with NewDict function)

Severity

High (7.5) — CVSS v3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Vulnerability

Type

• CWE-190: Integer Overflow or Wraparound
• CWE-787: Out-of-bounds Write (via unsafe.Pointer)

Description

The NewDict() function reads a uvarint from dictionary data and converts it to int:

r, n := binary.Uvarint(dict)
// ...
d.repeat = int(r)
if d.repeat > len(dict) {
    return nil
}

When r exceeds MaxInt64 (9223372036854775807), int(r) overflows to a negative value. Since a negative number is never greater than a positive length, the validation check is bypassed.

When Dict.Encode() is called, the negative repeat value causes an integer overflow in encodeBlockDictGo():

repeat := len(dict.dict) - dict.repeat  // overflows: 62 - (-5758978476775341977) = huge positive
candidate := len(dict.dict) - repeat + s // underflows to negative
load32(dict.dict, candidate)             // OOB via unsafe.Pointer

load32 calls le.Load32 which uses unsafe.Pointer arithmetic without bounds checking:

func Load32[I Indexer](b []byte, i I) uint32 {
    return *(*uint32)(unsafe.Add(unsafe.Pointer(unsafe.SliceData(b)), i))
}

This causes a segmentation fault (SIGSEGV) when the negative index is dereferenced.

PoC

package main

import (
    "encoding/binary"
    "fmt"
    "github.com/klauspost/compress/s2"
)

func main() {
    var dictData []byte
    buf := make([]byte, binary.MaxVarintLen64)
    n := binary.PutUvarint(buf, 12687765596934209639) // > MaxInt64
    dictData = append(dictData, buf[:n]...)
    dictData = append(dictData, make([]byte, 16)...) // minimum dict size

    dict := s2.NewDict(dictData)
    // dict is non-nil despite invalid repeat value (overflow bypassed validation)

    src := make([]byte, 64)
    for i := range src { src[i] = byte(i) }
    dict.Encode(nil, src) // SIGSEGV: OOB access via unsafe.Pointer
}

Impact

• Denial of Service: The process crashes immediately with SIGSEGV

Attack Vector

Any application that:

1. Accepts user-supplied S2 dictionary data via s2.NewDict()
2. Calls Dict.Encode() on any data ≥32 bytes

Suggested Fix

Validate the uvarint value before converting to int:

if r > math.MaxInt64 {
    return nil
}
d.repeat = int(r)

Or use uint for the repeat field and validate against uint(len(dict)).

References

• Source: s2/dict.go lines 59-61 (vulnerability), s2/encode_all.go line 947 (crash site)
• Commit: 539243b (v1.18.6 + 4 commits)

Credits

Christopher Linke / https://github.com/celinke97/

---

Compress/s2: Integer Overflow or Wraparound and Out-of-bounds Write in compress

CVE-2026-63209 / GHSA-259r-337f-4rfw / GO-2026-5841

More information

Details

Signed Integer Overflow in s2.NewDict

Summary

A signed integer overflow vulnerability in s2.NewDict() allows an attacker to bypass repeat index validation by supplying a dictionary with a uvarint-encoded repeat value exceeding MaxInt64. When Dict.Encode() is subsequently called, the overflowed negative repeat value causes an out-of-bounds memory access via unsafe.Pointer arithmetic, crashing the process with SIGSEGV.

Package

• Name: github.com/klauspost/compress/s2
• Ecosystem: Go
• Affected versions: <= v1.18.6 (all versions with NewDict function)

Severity

High (7.5) — CVSS v3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Vulnerability

Type

• CWE-190: Integer Overflow or Wraparound
• CWE-787: Out-of-bounds Write (via unsafe.Pointer)

Description

The NewDict() function reads a uvarint from dictionary data and converts it to int:

r, n := binary.Uvarint(dict)
// ...
d.repeat = int(r)
if d.repeat > len(dict) {
    return nil
}

When r exceeds MaxInt64 (9223372036854775807), int(r) overflows to a negative value. Since a negative number is never greater than a positive length, the validation check is bypassed.

When Dict.Encode() is called, the negative repeat value causes an integer overflow in encodeBlockDictGo():

repeat := len(dict.dict) - dict.repeat  // overflows: 62 - (-5758978476775341977) = huge positive
candidate := len(dict.dict) - repeat + s // underflows to negative
load32(dict.dict, candidate)             // OOB via unsafe.Pointer

load32 calls le.Load32 which uses unsafe.Pointer arithmetic without bounds checking:

func Load32[I Indexer](b []byte, i I) uint32 {
    return *(*uint32)(unsafe.Add(unsafe.Pointer(unsafe.SliceData(b)), i))
}

This causes a segmentation fault (SIGSEGV) when the negative index is dereferenced.

PoC

package main

import (
    "encoding/binary"
    "fmt"
    "github.com/klauspost/compress/s2"
)

func main() {
    var dictData []byte
    buf := make([]byte, binary.MaxVarintLen64)
    n := binary.PutUvarint(buf, 12687765596934209639) // > MaxInt64
    dictData = append(dictData, buf[:n]...)
    dictData = append(dictData, make([]byte, 16)...) // minimum dict size

    dict := s2.NewDict(dictData)
    // dict is non-nil despite invalid repeat value (overflow bypassed validation)

    src := make([]byte, 64)
    for i := range src { src[i] = byte(i) }
    dict.Encode(nil, src) // SIGSEGV: OOB access via unsafe.Pointer
}

Impact

• Denial of Service: The process crashes immediately with SIGSEGV

Attack Vector

Any application that:

1. Accepts user-supplied S2 dictionary data via s2.NewDict()
2. Calls Dict.Encode() on any data ≥32 bytes

Suggested Fix

Validate the uvarint value before converting to int:

if r > math.MaxInt64 {
    return nil
}
d.repeat = int(r)

Or use uint for the repeat field and validate against uint(len(dict)).

References

• Source: s2/dict.go lines 59-61 (vulnerability), s2/encode_all.go line 947 (crash site)
• Commit: 539243b (v1.18.6 + 4 commits)

Credits

Christopher Linke / https://github.com/celinke97/

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

• https://github.com/klauspost/compress/security/advisories/GHSA-259r-337f-4rfw
• https://nvd.nist.gov/vuln/detail/CVE-2026-63209
• https://github.com/klauspost/compress/pull/1163
• https://github.com/klauspost/compress/commit/539243b8823ee8f03e49969823d57c348c917536
• https://github.com/klauspost/compress/commit/8668e357e776d5152ed62f33c17f21b8690664fa
• https://github.com/klauspost/compress
• https://github.com/klauspost/compress/releases/tag/v1.18.7

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

OOB read in github.com/klauspost/compress/s2

CVE-2026-63209 / GHSA-259r-337f-4rfw / GO-2026-5841

More information

Details

Providing a specially crafted dictionary to s2.NewDict and using it to encode data can make the encoder read out of bounds.

Severity

Unknown

References

• https://github.com/klauspost/compress/security/advisories/GHSA-259r-337f-4rfw
• https://github.com/klauspost/compress/commit/8668e357e776d5152ed62f33c17f21b8690664fa

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

---

Panic on two-block frames in github.com/klauspost/compress

CVE-2026-116591 / GHSA-fpmh-frq8-7rj8 / GO-2026-6865

More information

Details

Panic on two-block frames in github.com/klauspost/compress

Severity

Unknown

References

• https://github.com/klauspost/compress/security/advisories/GHSA-fpmh-frq8-7rj8
• https://github.com/klauspost/compress/commit/7f5d8528720c895a6106f201719f87eb030a565d
• https://github.com/klauspost/compress/releases/tag/v1.20.2

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

---

Release Notes

klauspost/compress (github.com/klauspost/compress)

v1.20.2

Compare Source

• zstd: Fix DecodeAll crash on specially crafted input. GHSA-fpmh-frq8-7rj8.
• s2: fix LZ4 block conversion writing past dst by @​klauspost in #​1244
• dict: Stricter input validation by @​klauspost in #​1250
• zstd: reject snappy copy shorter than minimum match by @​Raghuvardhan-Reddy78 in #​1235

Full Changelog: klauspost/compress@v1.20.1...v1.20.2

v1.20.1

Compare Source

What's Changed

• zstd: apply reset options to reused frame decoders by @​pellared in #​1226
• flate: Report unexpected EOF for truncated Huffman extra bits by @​rupayon123 in #​1229
• flate: avoid FMA in EstimatedBits for portable rounding by @​malt3 in #​1224
• gzhttp: preserve caller request headers in Transport by @​jakezwang in #​1225
• gzhttp: only decompress a request when gzip is the outermost coding by @​youdie006 in #​1223
• zstd/huff0: Optimizations by @​lizthegrey in #​1203 #​1205 #​1207 #​1204 #​1208 #​1211 #​1209 #​1210
• flate: Speed improvements by @​alex in #​1220 #​1218 #​1216 #​1215 #​1214 #​1217

New Contributors

• @​xingyaner made their first contribution in #​1222
• @​jakezwang made their first contribution in #​1225
• @​youdie006 made their first contribution in #​1223
• @​pellared made their first contribution in #​1226
• @​malt3 made their first contribution in #​1224
• @​rupayon123 made their first contribution in #​1229

Full Changelog: klauspost/compress@v1.20.0...v1.20.1

v1.20.0

Compare Source

What's Changed

• Add lzw reader/writer by @​klauspost in #​1189
• xpress: add Microsoft XPRESS (MS-XCA) decompression by @​MP-GOWTHAM in #​1195
• s2: arm64 assembly encoders, lowered from the amd64 avo program by @​lizthegrey in #​1187
• zstd, huff0: improved arm64 lowering, and narrow two table loads to MOVWQZX by @​lizthegrey in #​1175
• gzhttp: limit jitter hash to jitterBuffer bytes by @​VedantMadane in #​1192
• s2: clamp the Go EncodeBetter skip to match the assembly by @​lizthegrey in #​1190
• xxhash: bound input of non-preemptive assembly by @​AskAlexSharov in #​1196
• zstd/huff0: fold two ISA-gap x86 idioms in the avo arm64 lowering by @​lizthegrey in #​1199
• ci: test against go1.27.x, drop go1.24.x by @​lizthegrey in #​1198
• zstd/huff0: break false partial-register dependencies in seqdec/4X decoders by @​lizthegrey in #​1197
• flate: Writer L7-9 with dictionary can emit the dictionary to stream by @​klauspost in #​1201

New Contributors

• @​VedantMadane made their first contribution in #​1192
• @​AskAlexSharov made their first contribution in #​1196
• @​MP-GOWTHAM made their first contribution in #​1195

Full Changelog: klauspost/compress@v1.19.2...v1.20.0

v1.19.2

Compare Source

What's Changed

• huff0: add arm64 assembly for Decompress4X/1X via avo lowering by @​lizthegrey in #​1172
• zstd: Re-enable unsafe decodeSync memory copies (#​1168) by @​lizthegrey in #​1171
• zstd: fix arm64 asm frame offsets placing locals on the saved LR slot by @​lizthegrey in #​1176
• zstd: avoid racing MaxDecodedSize write on shared dict litEnc by @​zanarellidev in #​1182
• zstd: keep BuildDict recent-offsets positive and loadable by @​zanarellidev in #​1184
• zstd: handle zero-literal BuildDict corpus by @​cyphercodes in #​1178
• zstd: don't clear the registered dictionary when decoding past the window by @​sueun-dev in #​1177

New Contributors

• @​zanarellidev made their first contribution in #​1183
• @​cyphercodes made their first contribution in #​1178
• @​sueun-dev made their first contribution in #​1177

Full Changelog: klauspost/compress@v1.19.1...v1.19.2

v1.19.1

Compare Source

What's Changed

• zstd: Validate SnappyConverter literal copies by @​klauspost in #​1170
• flate: use Peek instead of ReadByte for the bufio.Reader decode path by @​joechenrh in #​1169
• zstd: bump avo pin, regenerate arm64 asm by @​lizthegrey in #​1167

New Contributors

• @​joechenrh made their first contribution in #​1169

Full Changelog: klauspost/compress@v1.19.0...v1.19.1

v1.19.0

Compare Source

What's Changed

• zstd: Add true concurrent stream encoding by @​klauspost in #​1136
• zstd: arm64 decoder asm by @​lizthegrey in #​1160
• zstd: avoid unused BuildDict encoder allocation by @​snissn in #​1147
• flate: Add inflate checkpoints by @​klauspost in #​1154
• snappy/s2: Limit length of varint in decodedLen by @​eustas in #​1148
• gzhttp: match qvalue parameter case-insensitively (RFC 7231) by @​z9z in #​1149
• zip: add NameDecoder callback for legacy encoding rewrite by @​SAY-5 in #​1150
• huff0: Allow building tables from histogram. by @​klauspost in #​1155
• huff0: Allow building table from oversized histogram. by @​klauspost in #​1156
• s2sx: Clean symlink targets by @​klauspost in #​1163

New Contributors

• @​snissn made their first contribution in #​1147
• @​eustas made their first contribution in #​1148
• @​z9z made their first contribution in #​1149
• @​SAY-5 made their first contribution in #​1150
• @​HNO3Miracle made their first contribution in #​1165

Full Changelog: klauspost/compress@v1.18.6...v1.19.0

v1.18.7

Compare Source

• Fix s2.NewDict OOB read.

Security release without other changes.

Full Changelog: klauspost/compress@v1.18.6...v1.18.7

v1.18.6

Compare Source

What's Changed

• s2: Fix amd64 stack frame corruption by @​klauspost in #​1145
• gzhttp: Canonicalize ETag header by @​justinmayhew in #​1139
• perf: pool hash tables in Go encode paths to reduce allocations by @​huynhanx03 in #​1143

New Contributors

• @​justinmayhew made their first contribution in #​1139
• @​huynhanx03 made their first contribution in #​1143
• @​thaJeztah made their first contribution in #​1144

Full Changelog: klauspost/compress@v1.18.5...v1.18.6

---

Configuration

📅 Schedule: Branch creation - "" in timezone UTC, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.