compress

A denial of service vulnerability exists in the klauspost compress library's Zstandard (zstd) decompression implementation used by Red Hat OpenShift distributed tracing platform (Tempo). A remote attacker can submit a specially crafted zstd compressed stream that triggers an out-of-bounds read due to an integer handling flaw, causing the application to crash. This vulnerability does not involve data confidentiality or integrity impacts but results in service disruption. The issue is addressed in klauspost/compress version 1.20.2 and corresponding Red Hat builds.

Red Hat Security Advisory: Red Hat OpenShift distributed tracing platform (Tempo) 3.11.4 release

A vulnerability in the klauspost compress library's Zstandard (zstd) decompression implementation allows a remote attacker to cause a denial of service by submitting a specially crafted compressed stream. The flaw is due to an integer handling error that leads to an out-of-bounds read and an unhandled panic, crashing the application. This affects applications using the vulnerable decompression routines, including Red Hat Hardened Images RPMs with grafana13.1. A security update is available addressing CVE-2026-116591 and CVE-2026-116689.

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

CVE-2026-116591 is a vulnerability in the compress zstd component of Microsoft software version 3.0 that causes a panic when processing two-block frames. The issue relates to an integer overflow or similar error classified under CWE-190. No CVSS score or detailed impact information is provided.

compress zstd: Panic on two-block frames

A vulnerability (CVE-2026-116591) exists in the klauspost compress library's Zstandard (zstd) decompression implementation used in Red Hat Hardened Images RPMs. An integer handling flaw in the decompression logic can be exploited by a remote attacker supplying a specially crafted compressed stream, causing an out-of-bounds read and an unhandled panic that crashes the application, resulting in a denial of service (DoS). The issue affects applications decompressing untrusted inputs using this library. No direct configuration workaround exists within the library itself. Mitigations include rejecting or filtering untrusted zstd-compressed payloads at ingress or restricting decompression to trusted clients. A fixed version is available in klauspost/compress 1.20.2 and corresponding Red Hat builds.

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Red Hat has issued a security advisory for Red Hat Hardened Images RPMs, specifically updating the loki3.7 packages to address CVE-2026-116591. The advisory includes updated RPMs for multiple architectures and source code. No detailed technical description of the vulnerability is provided beyond the CVE identifier. No fixed versions are explicitly stated in the advisory.

A vulnerability (CVE-2026-116591) exists in the klauspost compress library's Zstandard (zstd) decompression implementation used in Red Hat Hardened Images RPMs. An integer handling flaw in the decompression logic allows a remote attacker to submit a specially crafted compressed stream that triggers an out-of-bounds read and causes an unhandled panic, resulting in a denial of service (DoS). The impact is limited to application crashes without escalation beyond container or non-root boundaries. No direct fix is available within the library itself, but Red Hat has issued updated RPMs addressing this issue.

git-lfs

A security update has been issued by Red Hat for the Red Hat Hardened Images RPMs, specifically addressing a vulnerability in the git-lfs package identified as CVE-2026-116591. The update includes git-lfs version 3.8.1-0.2.hum1 for multiple architectures. No fixed versions are explicitly stated in the advisory. The vulnerability is classified with a CWE-125 identifier and is rated as high severity.

A vulnerability (CVE-2026-116591) was found in the klauspost compress library's Zstandard (zstd) decompression implementation used in Red Hat Hardened Images RPMs. The flaw is an integer handling error that causes the decompression logic to retain stale internal state and perform an out-of-bounds read, leading to an unhandled panic that crashes the application. This results in a denial of service (DoS) when processing specially crafted compressed streams. The vulnerability affects the grype package versions updated to 0.121.0-0.3.hum1. No direct workaround exists within the library itself, but filtering untrusted inputs or restricting decompression to trusted clients can mitigate the risk.

Multiple security issues were addressed in the helm3-3.22.1-2.1 package for openSUSE Tumbleweed. The update fixes vulnerabilities present in earlier versions of the helm3 package distributed by SUSE. No specific details about the nature of the vulnerabilities or affected versions are provided.

helm3-3.22.1-2.1 on GA media

Multiple security issues affecting the helm package were addressed in the helm-4.3.1-3.1 update included in the GA media of openSUSE Tumbleweed. The specific vulnerabilities are identified by several CVE identifiers, but detailed impact and technical information are not provided.

helm-4.3.1-3.1 on GA media

Multiple security issues were addressed in the hauler-2.1.2-3.1 package included in the GA media of openSUSE Tumbleweed. The specific vulnerabilities fixed are not detailed in the available information.

hauler-2.1.2-3.1 on GA media

Multiple security issues were addressed in the crane-0.22.1-3.1 package for openSUSE Tumbleweed. These fixes are included in the GA media release of this package version. No specific details about the vulnerabilities or affected versions are provided.

crane-0.22.1-3.1 on GA media

Multiple security issues have been fixed in the distribution-registry-3.1.2-4.1 package included in the GA media of openSUSE Tumbleweed. The specific vulnerabilities addressed are not detailed in the provided information.

distribution-registry-3.1.2-4.1 on GA media

Multiple security issues were addressed in the cadvisor-0.60.6-5.1 package included in the GA media of openSUSE Tumbleweed. These fixes improve the security posture of the SUSE product by resolving vulnerabilities present in earlier versions.

cadvisor-0.60.6-5.1 on GA media

Multiple security issues were addressed in the aliyun-cli-3.5.2-2.1 package for openSUSE Tumbleweed. The update fixes vulnerabilities present in prior versions of the aliyun-cli tool. No specific details about the individual flaws or their impact are provided.

aliyun-cli-3.5.2-2.1 on GA media

A denial of service vulnerability (CVE-2026-116591) exists in the klauspost compress library's Zstandard decompression implementation used in Red Hat Hardened Images RPMs. The flaw is due to an integer handling error causing an out-of-bounds read and an unhandled panic when processing specially crafted compressed streams. This results in application crashes when decompressing untrusted inputs. The vulnerability affects prometheus3.13 RPMs included in the Red Hat Hardened Images. Mitigation involves rejecting or filtering untrusted Zstandard-compressed payloads or restricting decompression to trusted clients. No direct fix within the library configuration exists, but updated RPMs have been released.

Red Hat has issued a security update for its Hardened Images RPMs, specifically updating the caddy package to address CVE-2026-116591. The update includes caddy version 2.11.7-0.4.hum1 for multiple architectures. The advisory does not specify detailed technical information about the vulnerability but classifies it as high severity.

A vulnerability in the klauspost compress library's Zstandard (zstd) decompression implementation allows a remote attacker to cause a denial of service (DoS) by submitting a specially crafted compressed stream. The flaw is due to an integer handling error that leads to an out-of-bounds read and an unhandled panic, crashing the application. This affects applications decompressing untrusted inputs using the vulnerable library. Mitigation involves rejecting or filtering untrusted zstd payloads or restricting decompression to trusted clients. No direct fix within the library configuration exists.

A vulnerability in the klauspost compress library's Zstandard (zstd) decompression implementation allows a remote attacker to cause a denial of service by submitting a specially crafted compressed stream. The flaw is due to an integer handling error that leads to an out-of-bounds read and an unhandled panic, crashing the application. This affects applications that decompress untrusted inputs using this library.

A vulnerability (CVE-2026-116591) exists in the klauspost compress library's Zstandard (zstd) decompression implementation used in Red Hat Hardened Images RPMs. The flaw is an integer handling error in the decompression logic that causes an out-of-bounds read and an unhandled panic, leading to application crashes and denial of service. This affects applications decompressing untrusted inputs. The vulnerability is addressed in updated RPM packages provided by Red Hat.

Search: CVE-2026-116591