CVE-2026-63209: CWE-190: Integer Overflow or Wraparound in klauspost compress
compress provides various compression algorithms. Prior to version 1.18.7, a signed integer overflow vulnerability in s2.NewDict() allows an attacker to bypass repeat index validation by supplying a dictionary with a uvarint-encoded repeat value exceeding MaxInt64. When Dict.Encode() is subsequently called, the overflowed negative repeat value causes an out-of-bounds memory access via unsafe.Pointer arithmetic, crashing the process with SIGSEGV. This issue has been patched in version 1.18.7.
AI Analysis
Technical Summary
The klauspost compress library, which provides various compression algorithms, contained a signed integer overflow vulnerability in versions before 1.18.7. Specifically, in the s2.NewDict() function, an attacker can bypass repeat index validation by providing a dictionary with a uvarint-encoded repeat value larger than MaxInt64. This causes the repeat value to overflow into a negative number. When Dict.Encode() is called, this negative repeat value results in unsafe.Pointer arithmetic that accesses memory out-of-bounds, leading to a crash (SIGSEGV). This vulnerability is tracked as CVE-2026-63209 and has been patched in version 1.18.7.
Potential Impact
Exploitation of this vulnerability results in a denial of service due to process crash (SIGSEGV). There is no indication of confidentiality or integrity impact. The CVSS v3.1 score is 7.5 (high), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and impact limited to availability.
Mitigation Recommendations
Upgrade to klauspost compress version 1.18.7 or later, where this integer overflow and out-of-bounds access issue has been fixed. No other mitigations are indicated or necessary.
CVE-2026-63209: CWE-190: Integer Overflow or Wraparound in klauspost compress
Description
compress provides various compression algorithms. Prior to version 1.18.7, a signed integer overflow vulnerability in s2.NewDict() allows an attacker to bypass repeat index validation by supplying a dictionary with a uvarint-encoded repeat value exceeding MaxInt64. When Dict.Encode() is subsequently called, the overflowed negative repeat value causes an out-of-bounds memory access via unsafe.Pointer arithmetic, crashing the process with SIGSEGV. This issue has been patched in version 1.18.7.
CVSS v3.1
Score 7.5high
Affected software
klauspost
compress
pkg:golang/github.com/klauspost/compressRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The klauspost compress library, which provides various compression algorithms, contained a signed integer overflow vulnerability in versions before 1.18.7. Specifically, in the s2.NewDict() function, an attacker can bypass repeat index validation by providing a dictionary with a uvarint-encoded repeat value larger than MaxInt64. This causes the repeat value to overflow into a negative number. When Dict.Encode() is called, this negative repeat value results in unsafe.Pointer arithmetic that accesses memory out-of-bounds, leading to a crash (SIGSEGV). This vulnerability is tracked as CVE-2026-63209 and has been patched in version 1.18.7.
Potential Impact
Exploitation of this vulnerability results in a denial of service due to process crash (SIGSEGV). There is no indication of confidentiality or integrity impact. The CVSS v3.1 score is 7.5 (high), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and impact limited to availability.
Mitigation Recommendations
Upgrade to klauspost compress version 1.18.7 or later, where this integer overflow and out-of-bounds access issue has been fixed. No other mitigations are indicated or necessary.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-07-15T22:19:06.906Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6abbd6c7f7a7c541068c0cf9
Added to database: 09/29/2026, 15:18:31 UTC
Last enriched: 09/29/2026, 15:32:48 UTC
Last updated: 09/29/2026, 18:20:12 UTC
Views: 10
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.