CVE-2026-116591

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-116591
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-116591.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-116591
Aliases
Downstream
ALPINE (1)
AZL (29)
BELL (1)
CGA (3604)
CLEANSTART (2)
DEBIAN (1)
MINI (106)
openSUSE (15)
ROOT (1)
SUSE (2)
UBUNTU (1)
Related
openSUSE (15)
SUSE (2)
Published
2026-10-26T21:54:33Z
Modified
2026-11-12T17:28:18Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
compress zstd: Panic on two-block frames
Details

compress provides various compression algorithms. Prior to 1.20.2, the zstd DecodeAll and streaming decoder paths can panic when a crafted two-block frame reaches huff0.ReadTable with an FSE normalized count of 32768 that readNCount stores in int16 as -32768. The wrapped count allows buildDtable to retain stale fse.Scratch decode-table state from the prior block, and nextFast then derives an out-of-range state and indexes beyond the table instead of returning a decode error. Both blocks are required to preserve and then reuse the stale state, allowing untrusted zstd input to crash an application. This issue is fixed in version 1.20.2.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-190"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/116xxx/CVE-2026-116591.json"
}
References

Affected packages

Git / github.com/klauspost/compress

Affected ranges

Type
GIT
Repo
https://github.com/klauspost/compress
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
7f5d8528720c895a6106f201719f87eb030a565d
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "1.20.2"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "fixed": "7f5d8528720c895a6106f201719f87eb030a565d"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "original_tag": "v1.20.2",
            "range": [
                {
                    "fixed": "7f5d8528720c895a6106f201719f87eb030a565d"
                }
            ],
            "source": "REFERENCES_TAG"
        },
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "1.20.2"
                }
            ],
            "source": "DESCRIPTION"
        }
    ]
}

Affected versions

v1.*
v1.0
v1.1
v1.10.0
v1.10.1
v1.10.10
v1.10.11
v1.10.2
v1.10.3
v1.10.4
v1.10.5
v1.10.6
v1.10.7
v1.10.8
v1.10.9
v1.11.0
v1.11.1
v1.11.10
v1.11.11
v1.11.12
v1.11.13
v1.11.2
v1.11.3
v1.11.4
v1.11.5
v1.11.6
v1.11.7
v1.11.8
v1.11.9
v1.12.1
v1.12.2
v1.12.3
v1.13.0
v1.13.1
v1.13.2
v1.13.3
v1.13.4
v1.13.5
v1.13.6
v1.14.0
v1.14.1
v1.14.2
v1.14.3
v1.14.4
v1.15.0
v1.15.1
v1.15.10
v1.15.11
v1.15.12
v1.15.13
v1.15.14
v1.15.15
v1.15.2
v1.15.3
v1.15.4
v1.15.5
v1.15.6
v1.15.7
v1.15.8
v1.15.9
v1.16.0
v1.16.1
v1.16.2
v1.16.3
v1.16.4
v1.16.5
v1.16.6
v1.16.7
v1.17.0
v1.17.1
v1.17.10
v1.17.11
v1.17.2
v1.17.3
v1.17.4
v1.17.5
v1.17.6
v1.17.7
v1.17.8
v1.17.9
v1.18.0
v1.18.1
v1.18.2
v1.18.4
v1.18.5
v1.18.6
v1.19.0
v1.19.1
v1.19.2
v1.2
v1.2.1
v1.20.0
v1.20.1
v1.3.0
v1.4.0
v1.4.1
v1.5.0
v1.6.0
v1.6.1
v1.6.2
v1.7.0
v1.7.1
v1.7.2
v1.7.3
v1.7.4
v1.7.5
v1.7.6
v1.8.0
v1.8.1
v1.8.2
v1.8.3
v1.8.4
v1.8.5
v1.8.6
v1.9.0
v1.9.1
v1.9.2
v1.9.3
v1.9.4
v1.9.5
v1.9.6
v1.9.7
v1.9.8

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-116591.json"