GO-2026-5841
OOB read in github.com/klauspost/compress/s2
At a glance
- Published
- Updated
- CVE
- CVE-2026-63209
- Aliases
- GHSA-259r-337f-4rfw
Description
Providing a specially crafted dictionary to s2.NewDict and using it to encode data can make the encoder read out of bounds.
Affected packages
| Package | Versions |
|---|---|
| Go · github.com/klauspost/compress | introduced 1.16.0, fixed 1.18.7 |
References
- https://github.com/klauspost/compress/security/advisories/GHSA-259r-337f-4rfw ADVISORY
- https://github.com/klauspost/compress/commit/8668e357e776d5152ed62f33c17f21b8690664fa FIX
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — Go Vulnerability Database |