{"id":"GO-2026-5841","revision":"c23418ccbedb4ae4a0d1dac3af0f15ee","records":[{"revision":"c23418ccbedb4ae4a0d1dac3af0f15ee","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-5841","aliases":["CVE-2026-63209","GHSA-259r-337f-4rfw"],"title":"OOB read in github.com/klauspost/compress/s2","description":"Providing a specially crafted dictionary to s2.NewDict and using it to encode data can make the encoder read out of bounds.","state":0,"publishedAt":"2026-07-27T16:16:22+00:00","modifiedAt":"2026-09-30T03:55:34.839664+00:00","affected":[{"ecosystem":"Go","name":"github.com/klauspost/compress","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.16.0"},{"kind":"fixed","version":"1.18.7"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/klauspost/compress/security/advisories/GHSA-259r-337f-4rfw","https://github.com/klauspost/compress/commit/8668e357e776d5152ed62f33c17f21b8690664fa"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-5841","license":"OSV · upstream source license applies","key":"osv:GO-2026-5841","identifiers":["GO-2026-5841","CVE-2026-63209","GHSA-259r-337f-4rfw"]},"retained":false,"historicalAffected":[]}],"coverage":[]}