{"id":"EUVD-2026-88977","revision":"a495a5797b8f425a87e1bf781620089f","records":[{"revision":"a495a5797b8f425a87e1bf781620089f","observedAt":"2026-10-30T10:55:39.34+00:00","statement":{"source":"euvd","id":"EUVD-2026-88977","aliases":["CVE-2026-63209","GHSA-259r-337f-4rfw"],"title":"compress provides various compression algorithms. Prior to version 1.18.7, a signed integer overflow vulnerability in s2.NewDict() allows an attacker to bypass repeat index validation by supplying a dictionary with a uvarint-encoded repeat …","description":"compress provides various compression algorithms. Prior to version 1.18.7, a signed integer overflow vulnerability in s2.NewDict() allows an attacker to bypass repeat index validation by supplying a dictionary with a uvarint-encoded repeat value exceeding MaxInt64. When Dict.Encode() is subsequently called, the overflowed negative repeat value causes an out-of-bounds memory access via unsafe.Pointer arithmetic, crashing the process with SIGSEGV. This issue has been patched in version 1.18.7.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5,"severity":null}],"references":["https://github.com/klauspost/compress/security/advisories/GHSA-259r-337f-4rfw","https://github.com/klauspost/compress/commit/539243b8823ee8f03e49969823d57c348c917536","https://github.com/klauspost/compress/releases/tag/v1.18.7"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-88977","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Sep 29, 2026, 2:58:53 PM","dateUpdated":"Sep 29, 2026, 4:32:32 PM"},"relatedAdvisories":[{"id":"SUSE-SU-2026:24277-1","title":"Security update for google-osconfig-agent","vulnerabilityIds":["CVE-2026-63209"]},{"id":"openSUSE-SU-2026:22134-1","title":"Security update for gh","vulnerabilityIds":["CVE-2026-41178","CVE-2026-59831","CVE-2026-63209","CVE-2026-72924","CVE-2026-78669","CVE-2026-84303","CVE-2026-84304","CVE-2026-84445"]},{"id":"openSUSE-SU-2026:22116-1","title":"Security update for hauler","vulnerabilityIds":["CVE-2026-53495","CVE-2026-63209"]},{"id":"RHSA-2026:68806","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","vulnerabilityIds":["CVE-2026-63209","CVE-2026-71557"]},{"id":"openSUSE-SU-2026:11939-1","title":"amazon-cloudwatch-agent-1.300073.0-1.1 on GA media","vulnerabilityIds":["CVE-2026-63209"]},{"id":"SUSE-SU-2026:24153-1","title":"Security update for distribution","vulnerabilityIds":["CVE-2026-63209"]},{"id":"SUSE-SU-2026:24120-1","title":"Security update for helm","vulnerabilityIds":["CVE-2026-63209","CVE-2026-81870","CVE-2026-85732"]},{"id":"RHSA-2026:68717","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","vulnerabilityIds":["CVE-2026-56851","CVE-2026-63209","CVE-2026-81871","CVE-2026-81872","CVE-2026-93450"]},{"id":"RHSA-2026:72493","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","vulnerabilityIds":["CVE-2024-24786","CVE-2026-63209","CVE-2026-93450"]},{"id":"RHSA-2026:70726","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","vulnerabilityIds":["CVE-2026-63209"]},{"id":"openSUSE-SU-2026:11957-1","title":"distribution-registry-3.1.1-9.1 on GA media","vulnerabilityIds":["CVE-2026-63209"]},{"id":"RHSA-2026:72570","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","vulnerabilityIds":["CVE-2024-24786","CVE-2026-21729","CVE-2026-56851","CVE-2026-63209","CVE-2026-93450"]},{"id":"RHSA-2026:79368","title":"Red Hat Security Advisory: Red Hat OpenShift distributed tracing platform (Tempo) 3.11.2 release","vulnerabilityIds":["CVE-2026-63209","CVE-2026-83663","CVE-2026-84445","CVE-2026-94637"]},{"id":"RHSA-2026:72498","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","vulnerabilityIds":["CVE-2026-61709","CVE-2026-63209","CVE-2026-93450","CVE-2026-102422"]},{"id":"RHSA-2026:68729","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","vulnerabilityIds":["CVE-2026-56851","CVE-2026-63209","CVE-2026-81871","CVE-2026-81872","CVE-2026-93450"]},{"id":"openSUSE-SU-2026:12186-1","title":"rqlite-10.6.1-1.1 on GA media","vulnerabilityIds":["CVE-2026-63209","CVE-2026-84304","CVE-2026-84445","CVE-2026-89090"]},{"id":"RHSA-2026:72496","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","vulnerabilityIds":["CVE-2024-24786","CVE-2026-56851","CVE-2026-63209","CVE-2026-93450"]},{"id":"openSUSE-SU-2026:11955-1","title":"cadvisor-0.60.6-1.1 on GA media","vulnerabilityIds":["CVE-2026-63209"]},{"id":"openSUSE-SU-2026:12163-1","title":"gh-2.102.0-1.1 on GA media","vulnerabilityIds":["CVE-2026-41178","CVE-2026-59831","CVE-2026-63209","CVE-2026-72924","CVE-2026-78669","CVE-2026-84304","CVE-2026-84445"]},{"id":"openSUSE-SU-2026:22117-1","title":"Security update for cadvisor","vulnerabilityIds":["CVE-2026-63209"]},{"id":"RHSA-2026:70670","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","vulnerabilityIds":["CVE-2026-63209"]},{"id":"openSUSE-SU-2026:11964-1","title":"helm3-3.22.0-3.1 on GA media","vulnerabilityIds":["CVE-2026-63209"]},{"id":"RHSA-2026:54419","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","vulnerabilityIds":["CVE-2026-63209"]},{"id":"RHSA-2026:68272","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","vulnerabilityIds":["CVE-2026-63209","CVE-2026-81872","CVE-2026-93450"]},{"id":"SUSE-SU-2026:24282-1","title":"Security update for helm","vulnerabilityIds":["CVE-2026-33814","CVE-2026-35204","CVE-2026-35205","CVE-2026-35206","CVE-2026-41178","CVE-2026-41888","CVE-2026-48978","CVE-2026-50151","CVE-2026-50163","CVE-2026-56852","CVE-2026-56854","CVE-2026-56855","CVE-2026-56864","CVE-2026-56865","CVE-2026-63209","CVE-2026-78662","CVE-2026-81870","CVE-2026-81871","CVE-2026-81872","CVE-2026-85732"]},{"id":"SUSE-SU-2026:24247-1","title":"Security update for helm","vulnerabilityIds":["CVE-2026-63209","CVE-2026-81870","CVE-2026-85732"]},{"id":"openSUSE-SU-2026:11961-1","title":"google-osconfig-agent-20260928.01-1.1 on GA media","vulnerabilityIds":["CVE-2026-63209"]},{"id":"RHSA-2026:87410","title":"Red Hat Security Advisory: RHOAI 2.25.12 - Red Hat OpenShift AI","vulnerabilityIds":["CVE-2024-12224","CVE-2025-14920","CVE-2025-14921","CVE-2025-14924","CVE-2025-14925","CVE-2025-14926","CVE-2025-14927","CVE-2025-14928","CVE-2025-14929","CVE-2025-14930","CVE-2025-61726","CVE-2025-61729","CVE-2026-5241","CVE-2026-5497","CVE-2026-6734","CVE-2026-8643","CVE-2026-9697","CVE-2026-11822","CVE-2026-11824","CVE-2026-12151","CVE-2026-12860","CVE-2026-15143","CVE-2026-15574","CVE-2026-15679","CVE-2026-15925","CVE-2026-16221","CVE-2026-18427","CVE-2026-18446","CVE-2026-18949","CVE-2026-19481","CVE-2026-19484","CVE-2026-19534","CVE-2026-25681","CVE-2026-25960","CVE-2026-27136","CVE-2026-28390","CVE-2026-28684","CVE-2026-31812","CVE-2026-32283","CVE-2026-33186","CVE-2026-33805","CVE-2026-33811","CVE-2026-33814","CVE-2026-34993","CVE-2026-39821","CVE-2026-39852","CVE-2026-39892","CVE-2026-40682","CVE-2026-41178","CVE-2026-42502","CVE-2026-42561","CVE-2026-44431","CVE-2026-44432","CVE-2026-44660","CVE-2026-44705","CVE-2026-45820","CVE-2026-47219","CVE-2026-48526","CVE-2026-48710","CVE-2026-48746","CVE-2026-49114","CVE-2026-49825","CVE-2026-49855","CVE-2026-50559","CVE-2026-54283","CVE-2026-54399","CVE-2026-54428","CVE-2026-55831","CVE-2026-55833","CVE-2026-56121","CVE-2026-56746","CVE-2026-56819","CVE-2026-56853","CVE-2026-56858","CVE-2026-56859","CVE-2026-56860","CVE-2026-56862","CVE-2026-58059","CVE-2026-59296","CVE-2026-59879","CVE-2026-59884","CVE-2026-59885","CVE-2026-59886","CVE-2026-59899","CVE-2026-62243","CVE-2026-62384","CVE-2026-63209","CVE-2026-63374","CVE-2026-65898","CVE-2026-65918","CVE-2026-66007","CVE-2026-67213","CVE-2026-67214","CVE-2026-67312","CVE-2026-68494","CVE-2026-68497","CVE-2026-68770","CVE-2026-69097","CVE-2026-69112","CVE-2026-69152","CVE-2026-69153","CVE-2026-69243","CVE-2026-69244","CVE-2026-71281","CVE-2026-73086","CVE-2026-73088","CVE-2026-73089","CVE-2026-73415","CVE-2026-73417","CVE-2026-73502","CVE-2026-73508","CVE-2026-73620","CVE-2026-73622","CVE-2026-73623","CVE-2026-73624","CVE-2026-73625","CVE-2026-73627","CVE-2026-73646","CVE-2026-75838","CVE-2026-75899","CVE-2026-75931","CVE-2026-75975","CVE-2026-76098","CVE-2026-76169","CVE-2026-76172","CVE-2026-76222","CVE-2026-76905","CVE-2026-77354","CVE-2026-77874","CVE-2026-78676","CVE-2026-78677","CVE-2026-78679","CVE-2026-78682","CVE-2026-79674","CVE-2026-79675","CVE-2026-80205","CVE-2026-81722","CVE-2026-81724","CVE-2026-81727","CVE-2026-82397","CVE-2026-82417","CVE-2026-84292","CVE-2026-84375","CVE-2026-84394","CVE-2026-84428","CVE-2026-84445","CVE-2026-84469","CVE-2026-84504","CVE-2026-84782","CVE-2026-84961","CVE-2026-85124","CVE-2026-85152","CVE-2026-85525","CVE-2026-86049","CVE-2026-86332","CVE-2026-87776","CVE-2026-87817","CVE-2026-87819","CVE-2026-88029","CVE-2026-88031","CVE-2026-89418","CVE-2026-89425","CVE-2026-91777","CVE-2026-91990","CVE-2026-92599","CVE-2026-93599","CVE-2026-93657","CVE-2026-93749","CVE-2026-96749","CVE-2026-102831","CVE-2026-102925","CVE-2026-102930","CVE-2026-102937","CVE-2026-102938","CVE-2026-103262","CVE-2026-104851","CVE-2026-105744"]},{"id":"RHSA-2026:86891","title":"Red Hat Security Advisory: RHOAI 3.5.2 - Red Hat OpenShift AI","vulnerabilityIds":["CVE-2024-14029","CVE-2026-13697","CVE-2026-15679","CVE-2026-15789","CVE-2026-18427","CVE-2026-19534","CVE-2026-37237","CVE-2026-49825","CVE-2026-49855","CVE-2026-54284","CVE-2026-56859","CVE-2026-59296","CVE-2026-59893","CVE-2026-62243","CVE-2026-62384","CVE-2026-63209","CVE-2026-63374","CVE-2026-66007","CVE-2026-68494","CVE-2026-68497","CVE-2026-69097","CVE-2026-69112","CVE-2026-69152","CVE-2026-69243","CVE-2026-69244","CVE-2026-71281","CVE-2026-71491","CVE-2026-73417","CVE-2026-73502","CVE-2026-73508","CVE-2026-73646","CVE-2026-75838","CVE-2026-75899","CVE-2026-75931","CVE-2026-75975","CVE-2026-76098","CVE-2026-76169","CVE-2026-76172","CVE-2026-76222","CVE-2026-76905","CVE-2026-77354","CVE-2026-77874","CVE-2026-78676","CVE-2026-78677","CVE-2026-78679","CVE-2026-78682","CVE-2026-79674","CVE-2026-79675","CVE-2026-80205","CVE-2026-81722","CVE-2026-81724","CVE-2026-81725","CVE-2026-81726","CVE-2026-81727","CVE-2026-82397","CVE-2026-82417","CVE-2026-84292","CVE-2026-84375","CVE-2026-84381","CVE-2026-84382","CVE-2026-84394","CVE-2026-84428","CVE-2026-84445","CVE-2026-84469","CVE-2026-84504","CVE-2026-84782","CVE-2026-84961","CVE-2026-85124","CVE-2026-85152","CVE-2026-85525","CVE-2026-86332","CVE-2026-87776","CVE-2026-87817","CVE-2026-87819","CVE-2026-88029","CVE-2026-88031","CVE-2026-89425","CVE-2026-91990","CVE-2026-93348","CVE-2026-93599","CVE-2026-93657","CVE-2026-93749","CVE-2026-96749","CVE-2026-96775","CVE-2026-102925","CVE-2026-102930","CVE-2026-102937","CVE-2026-102938","CVE-2026-102990","CVE-2026-104851","CVE-2026-104852","CVE-2026-104861","CVE-2026-104873"]},{"id":"RHSA-2026:70031","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","vulnerabilityIds":["CVE-2026-63209"]},{"id":"openSUSE-SU-2026:22140-1","title":"Security update for aliyun-cli","vulnerabilityIds":["CVE-2026-63209"]},{"id":"RHSA-2026:68808","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","vulnerabilityIds":["CVE-2026-63209","CVE-2026-71557"]},{"id":"SUSE-SU-2026:24131-1","title":"Security update for google-osconfig-agent","vulnerabilityIds":["CVE-2026-63209"]},{"id":"RHSA-2026:83013","title":"Red Hat Security Advisory: Logging for Red Hat OpenShift - 6.0.17","vulnerabilityIds":["CVE-2026-18140","CVE-2026-25681","CVE-2026-27136","CVE-2026-29181","CVE-2026-32283","CVE-2026-32285","CVE-2026-33186","CVE-2026-33818","CVE-2026-35469","CVE-2026-41178","CVE-2026-42151","CVE-2026-42154","CVE-2026-42499","CVE-2026-42502","CVE-2026-46600","CVE-2026-56852","CVE-2026-56853","CVE-2026-56858","CVE-2026-56859","CVE-2026-56860","CVE-2026-56862","CVE-2026-63209","CVE-2026-84445"]},{"id":"SUSE-SU-2026:24261-1","title":"Security update for aliyun-cli","vulnerabilityIds":["CVE-2026-63209"]},{"id":"RHSA-2026:72491","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","vulnerabilityIds":["CVE-2026-63209","CVE-2026-93450"]},{"id":"RHSA-2026:72507","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","vulnerabilityIds":["CVE-2026-63209","CVE-2026-81842","CVE-2026-93450","CVE-2026-102422"]},{"id":"RHSA-2026:54413","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","vulnerabilityIds":["CVE-2026-63209"]},{"id":"openSUSE-SU-2026:22039-1","title":"Security update for distribution","vulnerabilityIds":["CVE-2026-63209"]},{"id":"RHSA-2026:58472","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","vulnerabilityIds":["CVE-2026-56851","CVE-2026-63209"]},{"id":"RHSA-2026:72492","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","vulnerabilityIds":["CVE-2026-63209","CVE-2026-93450","CVE-2026-104994"]},{"id":"RHSA-2026:70684","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","vulnerabilityIds":["CVE-2026-63209"]},{"id":"openSUSE-SU-2026:22057-1","title":"Security update for helm","vulnerabilityIds":["CVE-2026-63209","CVE-2026-81870","CVE-2026-85732"]},{"id":"RHSA-2026:72497","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","vulnerabilityIds":["CVE-2026-9496","CVE-2026-63209","CVE-2026-93450"]},{"id":"openSUSE-SU-2026:11962-1","title":"hauler-2.1.1-1.1 on GA media","vulnerabilityIds":["CVE-2026-63209"]},{"id":"RHSA-2026:68591","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","vulnerabilityIds":["CVE-2026-63209","CVE-2026-81872","CVE-2026-93450"]},{"id":"openSUSE-SU-2026:11960-1","title":"crane-0.22.1-2.1 on GA media","vulnerabilityIds":["CVE-2026-63209"]},{"id":"openSUSE-SU-2026:11953-1","title":"aliyun-cli-3.5.1-2.1 on GA media","vulnerabilityIds":["CVE-2026-63209"]},{"id":"SUSE-SU-2026:24222-1","title":"Security update for google-osconfig-agent","vulnerabilityIds":["CVE-2026-63209"]},{"id":"RHSA-2026:72490","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","vulnerabilityIds":["CVE-2026-63209","CVE-2026-93450"]},{"id":"msrc_CVE-2026-63209","title":"Integer Overflow or Wraparound and Out-of-bounds Write in compress","vulnerabilityIds":["CVE-2026-63209"]},{"id":"openSUSE-SU-2026:12114-1","title":"alloy-1.20.1-1.1 on GA media","vulnerabilityIds":["CVE-2026-14362","CVE-2026-63209","CVE-2026-81871","CVE-2026-81872","CVE-2026-84303","CVE-2026-84304","CVE-2026-84445"]},{"id":"openSUSE-SU-2026:22078-1","title":"Security update for google-osconfig-agent","vulnerabilityIds":["CVE-2026-63209"]},{"id":"RHSA-2026:68290","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","vulnerabilityIds":["CVE-2026-63209","CVE-2026-77403","CVE-2026-77404","CVE-2026-77406","CVE-2026-77407","CVE-2026-77409","CVE-2026-77410","CVE-2026-77412","CVE-2026-81872","CVE-2026-93450"]},{"id":"SUSE-SU-2026:4554-1","title":"Security update for google-osconfig-agent","vulnerabilityIds":["CVE-2026-63209"]},{"id":"openSUSE-SU-2026:11963-1","title":"helm-4.3.0-4.1 on GA media","vulnerabilityIds":["CVE-2026-63209","CVE-2026-81870"]},{"id":"RHSA-2026:68256","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","vulnerabilityIds":["CVE-2026-63209"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-88977","identifiers":["EUVD-2026-88977","CVE-2026-63209","GHSA-259r-337f-4rfw"]},"retained":false,"historicalAffected":[]}],"coverage":[]}