Threats affecting pkg:github/klauspost/compress

A vulnerability (CVE-2026-116591) exists in the klauspost compress library's Zstandard (zstd) decompression implementation used in Red Hat Hardened Images RPMs. An integer handling flaw in the decompression logic can be exploited by a remote attacker supplying a specially crafted compressed stream, causing an out-of-bounds read and an unhandled panic that crashes the application, resulting in a denial of service (DoS). The issue affects applications decompressing untrusted inputs using this library. No direct configuration workaround exists within the library itself. Mitigations include rejecting or filtering untrusted zstd-compressed payloads at ingress or restricting decompression to trusted clients. A fixed version is available in klauspost/compress 1.20.2 and corresponding Red Hat builds.