High, CVSS 7.5GoAmendedPublished
Compress/s2: Integer Overflow or Wraparound and Out-of-bounds Write in compress
CVE-2026-63209 · GHSA-259r-337f-4rfw
- Affected
- Go github.com/klauspost/compress <= 1.18.6
- Fixed in
- 1.18.7· Vendor fix available
- Issue
- Signed Integer Overflow in s2.NewDict Summary A signed integer overflow vulnerability in s2.NewDict() allows an attacker to bypass repeat index validation by supplying a dictionary with a uvarint-encoded repeat value exceeding MaxInt64. When Dict.Encode() is subsequently called, the overflowed negative repeat value causes an out-of-bounds memory access via unsafe.Pointer arithmetic, crashing the process with SIGSEGV. Package - Name: github.com/klauspost/compress/s2 - Ecosystem: Go - Affected versions: <= v1.18.6 (all versions with NewDict function) Severity High (7.5) — CVSS v3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Vulnerability Type - CWE-190: Integer Overflow or Wraparound - CWE-787: Out-of-bounds Write (via unsafe.Pointer) Description The NewDict() function reads a uvarint from dictionary data and converts it to int: When r exceeds MaxInt64 (9223372036854775807), int(r) overflows to a negative value. Since a negative number is never greater than a positive length, the validation…
Recommended action: Upgrade to 1.18.7 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.