UBUNTU-CVE-2026-116591: High severity ubuntu/golang-github-klauspost-compress vulnerability

Published Oct 26, 2026

Updated

compress provides various compression algorithms. Prior to 1.20.2, the zstd DecodeAll and streaming decoder paths can panic when a crafted two-block frame reaches huff0.ReadTable with an FSE normalized count of 32768 that readNCount stores in int16 as -32768. The wrapped count allows buildDtable to retain stale fse.Scratch decode-table state from the prior block, and nextFast then derives an out-of-range state and indexes beyond the table instead of returning a decode error. Both blocks are required to preserve and then reuse the stale state, allowing untrusted zstd input to crash an application. This issue is fixed in version 1.20.2.

Affected Software

7 affected components

ubuntu/golang-github-klauspost-compress*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade compress to a version that resolves this vulnerability.
Fixed in 1.20.2

Event History

Oct 26, 2026

CVE Published

via OSV·10:16 PM

Data Sourced

via OSV·10:16 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What applications are realistically exposed to this issue?

Applications using the affected compress package's zstd DecodeAll API or streaming decoder on untrusted zstd-compressed input are exposed. The impact is an application crash, so network-reachable services that automatically decode attacker-supplied zstd data are a primary concern.

What does an attacker need to trigger the crash?

No privileges or user interaction are required, but the attacker must be able to supply a crafted zstd frame to an affected decoder. The frame must contain two blocks arranged to preserve stale decode-table state in the first block and reuse it in the second.

Are default deployments affected?

The available information identifies affected decoder code paths rather than a product-wide default configuration. A deployment is affected if it uses zstd DecodeAll or the streaming decoder from a version before 1.20.2 to process untrusted input.

What can be done if upgrading is not immediately possible?

Do not decode untrusted zstd input with the affected APIs until the dependency can be updated. Where decoding cannot be disabled, restrict zstd input to trusted sources to reduce exposure to crafted frames.

How can I determine whether an application is affected?

Check whether the application depends on golang-github-klauspost-compress and uses its zstd DecodeAll or streaming decoder paths. Versions prior to 1.20.2 are affected according to the provided information.

UBUNTU-CVE-2026-116591: High severity ubuntu/golang-github-klauspost-compress vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

What applications are realistically exposed to this issue?

What does an attacker need to trigger the crash?

Are default deployments affected?

What can be done if upgrading is not immediately possible?

How can I determine whether an application is affected?

Company

Resources

Contact

Frequently Asked Questions

What applications are realistically exposed to this issue?

What does an attacker need to trigger the crash?

Are default deployments affected?

What can be done if upgrading is not immediately possible?

How can I determine whether an application is affected?