{"id":"EUVD-2026-110497","enisaUuid":"e8531b88-0b7d-3f2b-a1c3-2b716c6edb60","description":"compress provides various compression algorithms. Prior to 1.20.2, the zstd DecodeAll and streaming decoder paths can panic when a crafted two-block frame reaches huff0.ReadTable with an FSE normalized count of 32768 that readNCount stores in int16 as -32768. The wrapped count allows buildDtable to retain stale fse.Scratch decode-table state from the prior block, and nextFast then derives an out-of-range state and indexes beyond the table instead of returning a decode error. Both blocks are required to preserve and then reuse the stale state, allowing untrusted zstd input to crash an application. This issue is fixed in version 1.20.2.","datePublished":"Oct 26, 2026, 9:54:33 PM","dateUpdated":"Oct 27, 2026, 2:16:30 PM","baseScore":8.7,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/klauspost/compress/security/advisories/GHSA-fpmh-frq8-7rj8\nhttps://github.com/klauspost/compress/commit/7f5d8528720c895a6106f201719f87eb030a565d\nhttps://github.com/klauspost/compress/releases/tag/v1.20.2\n","aliases":"CVE-2026-116591\nGHSA-fpmh-frq8-7rj8\n","assigner":"GitHub_M","epss":0.0,"enisaIdProduct":[{"id":"5c9d56ca-d94d-3cae-bfaa-c52734f7c836","product":{"name":"compress","vendor":{"name":"klauspost"}},"product_version":"\u003c 1.20.2"}],"enisaIdVendor":[{"id":"4f935ebe-f9c6-3867-8659-4bf92704687a","vendor":{"name":"klauspost"}}],"enisaIdVulnerability":[{"id":"362cb5b7-1b93-3f6a-b4a7-074ed64ef9a5","vulnerability":{"id":"CVE-2026-116591","description":"compress provides various compression algorithms. Prior to 1.20.2, the zstd DecodeAll and streaming decoder paths can panic when a crafted two-block frame reaches huff0.ReadTable with an FSE normalized count of 32768 that readNCount stores in int16 as -32768. The wrapped count allows buildDtable to retain stale fse.Scratch decode-table state from the prior block, and nextFast then derives an out-of-range state and indexes beyond the table instead of returning a decode error. Both blocks are required to preserve and then reuse the stale state, allowing untrusted zstd input to crash an application. This issue is fixed in version 1.20.2.","datePublished":"Oct 26, 2026, 9:54:33 PM","dateUpdated":"Oct 27, 2026, 2:16:30 PM","status":"PUBLISHED","baseScore":8.7,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/klauspost/compress/security/advisories/GHSA-fpmh-frq8-7rj8\nhttps://github.com/klauspost/compress/commit/7f5d8528720c895a6106f201719f87eb030a565d\nhttps://github.com/klauspost/compress/releases/tag/v1.20.2\n","enisa_id":"EUVD-2026-110497\n","assigner":"GitHub_M","epss":0.0,"dataProcessed":"Oct 28, 2026, 2:00:19 AM","vulnerabilityProduct":[{"id":"cfa5df02-aa5e-32ec-b63b-1e2443cfbc20","product":{"name":"compress","vendor":{"name":"klauspost"}},"product_version":"\u003c 1.20.2"}],"vulnerabilityVendor":[{"id":"da0825e4-cb63-387c-a133-24c62d111734","vendor":{"name":"klauspost"}}]}},{"id":"7cb29c9d-78f0-3dc8-a154-35658cf4151b","vulnerability":{"id":"GHSA-fpmh-frq8-7rj8","description":"compress zstd: Panic on two-block frames","datePublished":"Oct 27, 2026, 3:38:14 PM","dateUpdated":"Oct 27, 2026, 3:38:15 PM","baseScore":0.0,"references":"https://github.com/klauspost/compress/security/advisories/GHSA-fpmh-frq8-7rj8\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-116591\nhttps://github.com/klauspost/compress/commit/7f5d8528720c895a6106f201719f87eb030a565d\nhttps://github.com/klauspost/compress\nhttps://github.com/klauspost/compress/releases/tag/v1.20.2\n","enisa_id":"EUVD-2026-110497\n","aliases":"GHSA-fpmh-frq8-7rj8\nCVE-2026-116591\n","epss":0.0,"dataProcessed":"Oct 28, 2026, 2:02:34 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}