Threats affecting pkg:golang/github.com/klauspost/compress

A vulnerability (CVE-2026-116591) exists in the klauspost compress library's Zstandard (zstd) decompression implementation. A remote attacker can submit a specially crafted zstd compressed stream that triggers an integer handling flaw, causing the decoder to perform an out-of-bounds read and crash the application with an unhandled panic. This results in a denial of service (DoS) for applications decompressing untrusted inputs. The flaw affects applications using the klauspost/compress library for zstd decompression, including the Red Hat Trusted Artifact Signer Operator used with OpenShift Container Platform versions 4.17 through 5.0. No direct configuration workaround exists within the library itself. Mitigations include rejecting or filtering untrusted zstd payloads at ingress or restricting decompression to trusted clients. A fix is available in klauspost/compress version 1.20.2 and corresponding Red Hat builds.

compress provides various compression algorithms. Prior to version 1.18.7, a signed integer overflow vulnerability in s2.NewDict() allows an attacker to bypass repeat index validation by supplying a dictionary with a uvarint-encoded repeat value exceeding MaxInt64. When Dict.Encode() is subsequently called, the overflowed negative repeat value causes an out-of-bounds memory access via unsafe.Pointer arithmetic, crashing the process with SIGSEGV. This issue has been patched in version 1.18.7.