{"id":"CVE-2026-116591","kind":"vulnerability","aliases":["CVE-2026-116591"],"related":[],"title":"Go compress: crafted zstd frame causes panic and application crash","description":"compress provides various compression algorithms. Prior to 1.20.2, the zstd DecodeAll and streaming decoder paths can panic when a crafted two-block frame reaches huff0.ReadTable with an FSE normalized count of 32768 that readNCount stores in int16 as -32768. The wrapped count allows buildDtable to retain stale fse.Scratch decode-table state from the prior block, and nextFast then derives an out-of-range state and indexes beyond the table instead of returning a decode error. Both blocks are required to preserve and then reuse the stale state, allowing untrusted zstd input to crash an application. This issue is fixed in version 1.20.2.","summary":"The compress Go library's zstd decoder can be made to panic by a crafted two-block frame, because a wrapped Huffman table count leaves stale decode state that is read out of bounds. An attacker who supplies untrusted zstd input can crash any application that decodes it.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["backend","go","package","zstd"],"not_affected_if":["no-zstd-decoding","trusted-input-only"],"how_to_check":"- Run `go list -m github.com/klauspost/compress` in the project to see the version in use (the module that provides compress algorithms; confirm the module path against the go.mod file).\n- Search go.sum and go.mod for `klauspost/compress` and check whether it is a direct or transitive dependency.","fix":"- Upgrade the module to `1.20.2` or later with `go get github.com/klauspost/compress@v1.20.2` followed by `go mod tidy`.\n- Rebuild and redeploy services that decode untrusted zstd input.","status":"open","published_at":"2026-10-26T22:16:55+00:00","first_seen_at":"2026-10-26T22:25:33+00:00","triaged_at":"2026-10-26T22:27:35+00:00","updated_at":"2026-10-26T22:27:35+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-26T22:27:35Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade the module to `1.20.2` or later with `go get github.com/klauspost/compress@v1.20.2` followed by `go mod tidy`.\n- Rebuild and redeploy services that decode untrusted zstd input.","reach":"network","title":"Go compress: crafted zstd frame causes panic and application crash","impact":"low","summary":"The compress Go library's zstd decoder can be made to panic by a crafted two-block frame, because a wrapped Huffman table count leaves stale decode state that is read out of bounds. An attacker who supplies untrusted zstd input can crash any application that decodes it.","category":"package","nicknames":[],"who_cares":["go","zstd","backend"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Untrusted input crashes the decoding application with a panic.","analyst_note":"Confirm the Go module path and affected version range from the NVD entry or the upstream advisory; sources give only the 1.20.2 fix version and a description.","how_to_check":"- Run `go list -m github.com/klauspost/compress` in the project to see the version in use (the module that provides compress algorithms; confirm the module path against the go.mod file).\n- Search go.sum and go.mod for `klauspost/compress` and check whether it is a direct or transitive dependency.","needs_analyst":true,"not_affected_if":["no-zstd-decoding","trusted-input-only"],"who_is_affected":"Go services that decode zstd data from untrusted sources (uploads, network streams, package or log inputs) using the zstd DecodeAll or streaming decoder are exposed. Programs that only handle trusted zstd data or do not use zstd decoding can skip it.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.00065,"input_tokens":3411,"output_tokens":618,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-116591':13A,16A '-2026':12A,15A '-32768':108C '1.20.2':76C,173C '32768':101C 'algorithm':73C 'allow':112C,159C 'applic':9A,66B,166C 'attack':57B 'backend':17B 'beyond':138C 'block':38B,91C,125C,148C 'bound':55B 'builddtabl':113C 'caus':6A 'compress':2A,22B,69C,72C 'count':45B,99C,111C 'craft':3A,35B,88C 'crash':10A,64B,164C 'cve':11A,14A 'decod':27B,48B,68B,82C,119C,145C 'decode-t':118C 'decodeal':79C 'deriv':129C 'error':146C 'fix':170C 'frame':5A,39B,92C 'fse':97C 'fse.scratch':117C 'go':1A,18B,23B 'huff0.readtable':94C 'huffman':43B 'index':137C 'input':62B,162C 'instead':141C 'int16':106C 'issu':168C 'leav':46B 'librari':24B 'made':30B 'nextfast':127C 'normal':98C 'out-of-rang':131C 'packag':19B 'panic':7A,32B,85C 'path':83C 'preserv':152C 'prior':74C,124C 'provid':70C 'rang':134C 'reach':93C 'read':52B 'readncount':103C 'requir':150C 'retain':115C 'return':143C 'reus':155C 'stale':47B,116C,157C 'state':49B,121C,135C,158C 'store':104C 'stream':81C 'suppli':59B 'tabl':44B,120C,140C 'two':37B,90C 'two-block':36B,89C 'untrust':60B,160C 'various':71C 'version':172C 'wrap':42B,110C 'zstd':4A,20B,26B,61B,78C,161C","nicknames":[],"mitigations":[],"who_affected":"Go services that decode zstd data from untrusted sources (uploads, network streams, package or log inputs) using the zstd DecodeAll or streaming decoder are exposed. Programs that only handle trusted zstd data or do not use zstd decoding can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T22:16:55+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116591","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116591","severity":null,"published_at":"2026-10-26T22:16:55+00:00","modified_at":"2026-10-26T22:16:55+00:00","first_seen_at":"2026-10-26T22:25:33+00:00","fetched_at":"2026-10-26T22:25:33+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}