Skip to content
Fencer Vulns
high 7.5

CVE-2026-63209 json

Integer Overflow or Wraparound and Out-of-bounds Write in compress

published 2026-07-27 3 mo ago modified 2026-10-20 19 d ago also GHSA-259r-337f-4rfw , GO-2026-5841 , EUVD-2026-88977

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.6%
EPSS 0.6% chance of exploitation in 30 days, percentile 47%
public exploits
0
none known

Summary

compress provides various compression algorithms. Prior to version 1.18.7, a signed integer overflow vulnerability in s2.NewDict() allows an attacker to bypass repeat index validation by supplying a dictionary with a uvarint-encoded repeat value exceeding MaxInt64. When Dict.Encode() is subsequently called, the overflowed negative repeat value causes an out-of-bounds memory access via unsafe.Pointer arithmetic, crashing the process with SIGSEGV. This issue has been patched in version 1.18.7.

Patch / fix

  • go github.com/klauspost/compress 1.18.7
  • golang-github-klauspost-compress Debian 14 1.19.0+ds1-1

debian advisories DEBIAN-CVE-2026-63209

  • loki3.6 hummingbird 1 3.6.17-0.3.hum1
  • loki3.6-canary hummingbird 1 3.6.17-0.3.hum1
  • loki3.6-logcli hummingbird 1 3.6.17-0.3.hum1
  • loki3.7 hummingbird 1 3.7.8-0.3.hum1
  • loki3.7-canary hummingbird 1 3.7.8-0.3.hum1
  • loki3.7-logcli hummingbird 1 3.7.8-0.3.hum1
  • trivy hummingbird 1 0.74.0-0.4.hum1
  • spire1.15 hummingbird 1 1.15.3-0.2.hum1

red hat advisories RHSA-2026:72570RHSA-2026:72496RHSA-2026:72492RHSA-2026:72493RHSA-2026:72490RHSA-2026:72491

  • helm SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +10 more 3.22.1-150000.1.104.1
  • aliyun-cli SLES for SAP applications 16.0, SLES 16.0 3.5.1-160000.1.1
  • helm Linux Micro 6.1 4.3.0-slfo.1.1_1.1
  • google-osconfig-agent Linux Micro 6.1 20260928.01-slfo.1.1_1.1
  • amazon-cloudwatch-agent SLE Module for Public Cloud 15 SP7, SLE Module for Public Cloud 15 SP6, SLE Module for Public Cloud 15 SP5 +1 more 1.300073.0-150400.9.18.1
  • google-osconfig-agent SLE Module for Public Cloud 15 SP7, SLE Module for Public Cloud 15 SP6, SLE Module for Public Cloud 15 SP5 +2 more 20260928.01-150000.1.70.1
  • google-osconfig-agent SLES for SAP applications 16.0, SLES 16.0 20260928.01-160000.1.1
  • google-osconfig-agent Linux Micro 6.0 20260928.01-159998.1.1

suse advisories SUSE-SU-2026:5119-1SUSE-SU-2026:24261-1SUSE-SU-2026:24282-1SUSE-SU-2026:24277-1SUSE-SU-2026:4662-1SUSE-SU-2026:4661-1

  • rqlite openSUSE Leap 16.0 10.6.6-bp160.1.1
  • go-containerregistry openSUSE Leap 16.0 0.22.1-bp160.1.1
  • gh openSUSE Leap 16.0 2.102.0-bp160.1.1
  • aliyun-cli openSUSE Leap 16.0 3.5.1-160000.1.1
  • rqlite openSUSE Tumbleweed 10.6.1-1.1
  • gh openSUSE Tumbleweed 2.102.0-1.1
  • cadvisor openSUSE Leap 16.0 0.60.6-bp160.1.1
  • hauler openSUSE Leap 16.0 2.1.1-bp160.1.1

opensuse advisories openSUSE-SU-2026:22224-1openSUSE-SU-2026:22227-1openSUSE-SU-2026:22134-1openSUSE-SU-2026:22140-1openSUSE-SU-2026:12186-1openSUSE-SU-2026:12163-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-63209 updated cvss 7.5

github.com/klauspost/compress: klauspost/compress: Denial of Service via integer overflow in dictionary processing

  • Red Hat File Integrity Operator compliance/openshift-file-integrity-rhel8-operator, compliance/openshift-file-integrity-operator-bundle Red Hat Multicluster Engine for Kubernetes multicluster-engine/assisted-service-8-rhel8, multicluster-engine/assisted-service-9-rhel9 Red Hat Network Observability Operator network-observability/network-observability-ebpf-agent-rhel9, network-observability/network-observability-flowlogs-pipeline-rhel9 Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/prometheus-rhel9, rhacm2/insights-metrics-rhel9
    affected: workaround, no fix available
  • Red Hat Hardened Images prometheus3.5 3.5.5-0.8.hum1, opentofu1.11 1.11.14-0.1.hum1
    affected: workaround, no fix planned “Will not fix”
  • Red Hat OpenShift AI (RHOAI) rhoai/odh-kserve-agent-rhel9, rhoai/odh-kserve-router-rhel9, rhoai/odh-spark-operator-rhel9, rhoai/odh-kserve-controller-rhel9, rhoai/odh-training-operator-rhel9, rhoai/odh-codeflare-operator-rhel9, +14 more Red Hat OpenShift Container Platform 4 openshift4/ose-thanos-rhel8, openshift4/ose-agent-installer-api-server-rhel9 Red Hat OpenShift Container Platform 5 openshift5/ose-thanos-rhel9, openshift5/ose-prometheus-rhel9, openshift5/ose-cluster-monitoring-rhel9-operator Red Hat OpenShift distributed tracing 3 rhosdt/tempo-rhel9, rhosdt/tempo-query-rhel9, rhosdt/opentelemetry-rhel9-operator, rhosdt/opentelemetry-collector-rhel9, rhosdt/opentelemetry-target-allocator-rhel9
    affected: workaround, no fix available
  • Red Hat OpenShift GitOps microshift-gitops, openshift-gitops-argocd-cli, openshift-gitops-1/argocd-rhel8, openshift-gitops-1/argocd-rhel9, openshift-gitops-1/gitops-rhel8, openshift-gitops-1/argocd-agent-rhel8, +2 more
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Cryostat 4 cryostat/cryostat-storage-rhel9 Red Hat Ceph Storage 6 rhceph/rhceph-6-dashboard-rhel9 Red Hat Ceph Storage 7 rhceph/grafana-rhel9 Red Hat Ceph Storage 8 rhceph/grafana-rhel9 Red Hat Ceph Storage 9 rhceph-ci/alloy, rhceph-ci/grafana, rhceph/alloy-rhel10, rhceph/grafana-rhel10 Red Hat Enterprise Linux 9 opentelemetry-collector
    +3 more products
    Red Hat Enterprise Linux 10 grafana, opentelemetry-collector Red Hat Openshift Data Foundation 4 rhceph-dev/odf4-odf-multicluster-rhel9-operator Red Hat Trusted Artifact Signer rhtas/ec-rhel9
    under investigation
  • Red Hat Cluster Observability Operator 1.5 cluster-observability-operator/thanos-rhel9 1793660568, cluster-observability-operator/thanos-rhel9 1793821585
    fixed: vendor fix RHSA-2026:95081
  • Red Hat Logging Subsystem for Red Hat OpenShift 6.0 openshift-logging/logging-loki-rhel9 1791500729
    fixed: vendor fix RHSA-2026:83013
  • Red Hat Logging Subsystem for Red Hat OpenShift 6.6 openshift-logging/logging-loki-rhel9 1793041359
    fixed: vendor fix RHSA-2026:92515
show 16 more
  • Red Hat multicluster engine for Kubernetes 2.8 multicluster-engine/clusterclaims-controller-rhel9 1792862274
    fixed: vendor fix RHSA-2026:92303
  • Red Hat Multicluster Global Hub 1.7.4 multicluster-globalhub/multicluster-globalhub-grafana-rhel9 1793002792
    fixed: vendor fix RHSA-2026:95517
  • Red Hat OpenShift API for Data Protection 1.4 oadp/oadp-velero-rhel9 1793124668, oadp/oadp-rhel9-operator 1793138820, oadp/oadp-mustgather-rhel9 1793124243, oadp/oadp-cli-binaries-rhel9 1793132047, oadp/oadp-velero-restic-restore-helper-rhel9 1793124532
    fixed: vendor fix RHSA-2026:94498
  • Red Hat OpenShift Compliance Operator 1 compliance/openshift-compliance-rhel8-operator 1793223561
    fixed: vendor fix RHSA-2026:95612
  • Red Hat Advanced Cluster Management for Kubernetes 2.13 rhacm2/thanos-rhel9 1792872550, rhacm2/thanos-receive-controller-rhel9 1793042032, rhacm2/multicluster-operators-channel-rhel9 1792906953, rhacm2/multicluster-operators-subscription-rhel9 1792886460
    fixed: vendor fix RHSA-2026:92307
  • Red Hat Advanced Cluster Management for Kubernetes 2.16 rhacm2/lighthouse-coredns-rhel9 1790670231
    fixed: vendor fix RHSA-2026:85227
  • Red Hat Hardened Images k6v1 1.8.1-0.1.hum1, k6v2 2.3.0-0.1.hum1, podman 6.1.2-1.hum1, helm4 4.3.0-0.2.hum1, rekor 1.5.4-0.1.hum1, skopeo 1.24.1-1.hum1, +31 more
    fixed: vendor fix RHSA-2026:70670
  • Red Hat OpenShift AI 2.25 rhoai/odh-kueue-controller-rhel9 1791854046
    fixed: vendor fix RHSA-2026:87410
  • Red Hat OpenShift AI 3.4 rhoai/odh-cli-rhel9 1792722177, rhoai/rhai-cli-rhel9 1792722177, rhoai/odh-feature-server-rhel9 1792685074, rhoai/odh-model-registry-rhel9 1791869365, rhoai/odh-kube-auth-proxy-rhel9 1792977829, rhoai/odh-model-metadata-collection-rhel9 1790958083, +19 more
    fixed: vendor fix RHSA-2026:92510
  • Red Hat OpenShift AI 3.5 rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9 1791817064, rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9 1791816223, rhoai/odh-workbench-jupyter-trustyai-cpu-py312-rhel9 1791816316, rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9 1791903880, rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9 1791899290, rhoai/odh-workbench-jupyter-tensorflow-rocm-py312-rhel9 1791816175, +1 more
    fixed: vendor fix RHSA-2026:86891
  • Red Hat OpenShift Container Platform 4.21 openshift4/ose-thanos-rhel9 1793135500
    fixed: vendor fix RHSA-2026:92994
  • Red Hat OpenShift Container Platform 4.22 openshift4/ose-thanos-rhel9 1792770418
    fixed: vendor fix RHSA-2026:89198
  • Red Hat OpenShift distributed tracing 3.11 rhosdt/tempo-jaeger-query-rhel9 1791452569
    fixed: vendor fix RHSA-2026:79368
  • Red Hat Cluster Observability Operator 1.5 cluster-observability-operator/perses-rhel9 1793661985, cluster-observability-operator/perses-rhel9 1793825744, cluster-observability-operator/korrel8r-rhel9 1793661297, cluster-observability-operator/korrel8r-rhel9 1793822079, cluster-observability-operator/prometheus-rhel9 1793662399, cluster-observability-operator/prometheus-rhel9 1793822854, +42 more
    not affected: vulnerable code not present
  • Red Hat Custom Metric Autoscaler operator for Red Hat Openshift custom-metrics-autoscaler/custom-metrics-autoscaler-rhel9, custom-metrics-autoscaler/custom-metrics-autoscaler-adapter-rhel9, custom-metrics-autoscaler/custom-metrics-autoscaler-rhel9-operator, custom-metrics-autoscaler/custom-metrics-autoscaler-admission-webhooks-rhel9
    not affected: vulnerable code not in execute path
  • Red Hat Logging Subsystem for Red Hat OpenShift openshift-logging/cluster-logging-rhel9-operator Red Hat Logging Subsystem for Red Hat OpenShift 6.0 openshift-logging/vector-rhel9 1791777198, openshift-logging/eventrouter-rhel9 1791500947, openshift-logging/loki-rhel9-operator 1791499216, openshift-logging/opa-openshift-rhel9 1791500883, openshift-logging/loki-operator-bundle 1791504713, openshift-logging/lokistack-gateway-rhel9 1791500864, +3 more Red Hat Logging Subsystem for Red Hat OpenShift 6.6 openshift-logging/vector-rhel9 1793051738, openshift-logging/eventrouter-rhel9 1792998256, openshift-logging/loki-rhel9-operator 1793051099, openshift-logging/opa-openshift-rhel9 1793051110, openshift-logging/loki-operator-bundle 1793055216, openshift-logging/lokistack-gateway-rhel9 1792906475, +3 more
    not affected: vulnerable code not present

20 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
40 d ago

Exploit prediction

0.57% chance of exploitation in the next 30 days, higher than 47% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/klauspost/compress/security/advisories/GHSA-259r-337f-4rfw referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
go github.com/klauspost/compress
<1.18.7
>=1.16.0, <1.18.7
1.18.7

Affected products

  • klauspost compress

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.