---
id: "CVE-2026-116591"
kind: "vulnerability"
aliases: ["CVE-2026-116591"]
title: "Go compress: crafted zstd frame causes panic and application crash"
severity: "high"
cvss: 8.7
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["backend", "go", "package", "zstd"]
not_affected_if: ["no-zstd-decoding", "trusted-input-only"]
published_at: "2026-10-26T22:16:55+00:00"
first_seen_at: "2026-10-26T22:25:33+00:00"
updated_at: "2026-10-26T22:27:35+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116591", "first_seen_at": "2026-10-26T22:25:33+00:00"}]
---

# Go compress: crafted zstd frame causes panic and application crash

The compress Go library's zstd decoder can be made to panic by a crafted two-block frame, because a wrapped Huffman table count leaves stale decode state that is read out of bounds. An attacker who supplies untrusted zstd input can crash any application that decodes it.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `go list -m github.com/klauspost/compress` in the project to see the version in use (the module that provides compress algorithms; confirm the module path against the go.mod file).
- Search go.sum and go.mod for `klauspost/compress` and check whether it is a direct or transitive dependency.

## Fix

- Upgrade the module to `1.20.2` or later with `go get github.com/klauspost/compress@v1.20.2` followed by `go mod tidy`.
- Rebuild and redeploy services that decode untrusted zstd input.

## Timeline

- 2026-10-26T22:25:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116591

## From the sources

compress provides various compression algorithms. Prior to 1.20.2, the zstd DecodeAll and streaming decoder paths can panic when a crafted two-block frame reaches huff0.ReadTable with an FSE normalized count of 32768 that readNCount stores in int16 as -32768. The wrapped count allows buildDtable to retain stale fse.Scratch decode-table state from the prior block, and nextFast then derives an out-of-range state and indexes beyond the table instead of returning a decode error. Both blocks are required to preserve and then reuse the stale state, allowing untrusted zstd input to crash an application. This issue is fixed in version 1.20.2.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_