A vulnerability (CVE-2026-116591) was found in the klauspost compress library's Zstandard (zstd) decompression implementation used in Red Hat Hardened Images. The flaw is an integer handling error that leads to an out-of-bounds read and an unhandled panic, causing a denial of service (DoS) when processing specially crafted compressed streams. The issue affects tempo3.0 RPMs updated to version 3.0.4-0.3.hum1. No direct workaround exists within the library; mitigation involves rejecting or filtering untrusted compressed payloads or restricting decompression to trusted clients.

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

CVE-2026-116591 is a denial of service vulnerability in the klauspost compress library's Zstandard (zstd) decompression implementation. A remote attacker can submit a specially crafted compressed stream that triggers an out-of-bounds read due to an integer handling error, causing the application to crash. This affects applications decompressing untrusted inputs using the vulnerable library. The issue is fixed in Red Hat Hardened Images RPMs with the jaeger package update to version 2.21.0-0.3.hum1.

A vulnerability (CVE-2026-116591) exists in the klauspost compress library's Zstandard (zstd) decompression implementation used in Red Hat Hardened Images RPMs. The flaw is an integer handling error in the decompression logic that causes an out-of-bounds read, leading to an unhandled panic and application crash when processing specially crafted compressed streams. This results in a denial of service (DoS) condition. The vulnerability affects the k6v2 package versions 2.3.0-0.4.hum1 for aarch64 and x86_64 architectures. No direct workaround exists within the library itself, but mitigation can be achieved by rejecting or filtering untrusted zstd compressed inputs or restricting decompression to trusted clients.

A denial of service vulnerability (CVE-2026-116591) exists in the klauspost compress library's Zstandard (zstd) decompression implementation used in Red Hat Hardened Images RPMs. The flaw is due to an integer handling error causing an out-of-bounds read and an unhandled panic that crashes applications processing specially crafted compressed streams. This affects applications decompressing untrusted inputs, leading to abrupt termination. The vulnerability is fixed in the updated k6v1 package version 1.8.2-0.3.hum1.

A vulnerability (CVE-2026-116591) exists in the klauspost compress library's Zstandard (zstd) decompression implementation used in Red Hat Hardened Images RPMs. The flaw is an integer handling error in the decompression logic that causes the decoder to retain stale internal state and perform an out-of-bounds read, leading to an unhandled panic that crashes the application. This results in a denial of service (DoS) when processing specially crafted compressed streams. The vulnerability affects applications decompressing untrusted inputs but container boundaries and non-root execution limit impact to the host. A security update including opentelemetry-collector-contrib-0.164.0-0.1.hum1 RPMs has been released by Red Hat. Mitigation includes rejecting or filtering untrusted zstd payloads or restricting decompression to trusted clients, as no direct workaround exists in the library itself.

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

A vulnerability (CVE-2026-116591) exists in the klauspost compress library's Zstandard (zstd) decompression implementation used in Red Hat Hardened Images RPMs. The flaw is an integer handling error in the decompression logic that causes an out-of-bounds read and an unhandled panic, leading to a denial of service (DoS) when processing specially crafted compressed streams. This affects the cosign package version 3.1.4-0.2.hum1. The vulnerability can be exploited remotely by submitting malicious zstd compressed data. Mitigations include rejecting or filtering untrusted compressed payloads or restricting decompression to trusted clients. No direct workaround exists within the library itself. A fixed package version is available from Red Hat.

A vulnerability (CVE-2026-116591) in the klauspost compress library's Zstandard decompression implementation allows a remote attacker to cause a denial of service (DoS) by submitting a specially crafted compressed stream. The flaw arises from an integer handling error that leads to an out-of-bounds read and an unhandled panic crashing the application. This affects Red Hat Hardened Images RPMs including podman packages. No direct workaround exists within the library; mitigation involves rejecting or filtering untrusted compressed payloads or restricting decompression to trusted clients.

A vulnerability in the klauspost compress library's Zstandard (zstd) decompression logic allows a remote attacker to cause a denial of service by submitting a specially crafted compressed stream. The flaw is due to an integer handling error that leads to an out-of-bounds read and an unhandled panic, crashing the application. This affects applications that decompress untrusted inputs using this library. The impact is isolated by container boundaries and non-root execution. No direct workaround exists within the library itself.

Red Hat has issued a security update for its Hardened Images RPMs, specifically addressing a vulnerability in the syft package (version 1.55.0-0.3.hum1). The vulnerability is identified as CVE-2026-116591 and is associated with CWE-125 (Out-of-bounds Read). No CVSS score is provided, but the severity is rated high.

A vulnerability (CVE-2026-116591) exists in the klauspost compress library's Zstandard (zstd) decompression implementation used by Red Hat Hardened Images RPMs, including skopeo. The flaw is an integer handling error in the decompression logic that leads to an out-of-bounds read and an unhandled panic, causing a denial of service (DoS) when processing specially crafted compressed streams. The vulnerability affects applications decompressing untrusted inputs, which may crash abruptly. Mitigation involves rejecting or filtering untrusted compressed payloads or restricting decompression to trusted clients. No direct fix is available within the library itself, but Red Hat has released updated skopeo RPMs addressing this issue.

github.com/klauspost/compress/zstd

A vulnerability in github.com/klauspost/compress/zstd versions prior to 1.20.2 causes a panic due to an out-of-range slice index when decompressing crafted two-block zstd frames. The flaw arises from improper handling of Huffman-weight tables in the FSE decoder, leading to reuse of stale state and an invalid decode table. This can crash any program decompressing untrusted zstd input. The issue is fixed in version 1.20.2.

compress zstd: Panic on two-block frames (CVE-2026-116591)

CVE-2026-116591 is an integer overflow vulnerability in the klauspost compress library prior to version 1.20.2. The flaw occurs in the zstd DecodeAll and streaming decoder paths when processing a crafted two-block frame, leading to a panic due to an out-of-range state derived from stale decode-table data. This can cause an application crash when handling untrusted zstd input. The issue is fixed in version 1.20.2.

CVE-2026-116591: CWE-190 Integer Overflow or Wraparound in klauspost compress

A vulnerability in the klauspost compress library's Zstandard (zstd) decompression implementation allows a remote attacker to cause a denial of service (DoS) by submitting a specially crafted compressed stream. The flaw is due to an integer handling error that leads to an out-of-bounds read and an unhandled panic, crashing the application. This affects applications that decompress untrusted inputs using the vulnerable library. The issue is addressed in Red Hat Hardened Images RPMs update including buildah-1.46.0-1.hum1.

A vulnerability in the klauspost compress library's Zstandard (zstd) decompression implementation allows a remote attacker to cause a denial of service (DoS) by submitting a specially crafted compressed stream. The flaw is due to an integer handling error that leads to an out-of-bounds read and an unhandled panic, crashing the application. This affects applications that decompress untrusted inputs using the vulnerable library. The issue is addressed in updated Red Hat Hardened Images RPMs containing a fixed version of the opentelemetry-collector-k8s package.

Search: CVE-2026-116591