CVE-2026-116591 compress zstd: Panic on two-block frames
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-116591?
CVE-2026-116591 is a high-severity vulnerability in klauspost compress, published on 26 Oct 2026.
Official description
compress provides various compression algorithms. Prior to 1.20.2, the zstd DecodeAll and streaming decoder paths can panic when a crafted two-block frame reaches huff0.ReadTable with an FSE normalized count of 32768 that readNCount stores in int16 as -32768. The wrapped count allows buildDtable to retain stale fse.Scratch decode-table state from the prior block, and nextFast then derives an out-of-range state and indexes beyond the table instead of returning a decode error. Both blocks are required to preserve and then reuse the stale state, allowing untrusted zstd input to crash an application. This issue is fixed in version 1.20.2.
Weakness: CWE-190
Which versions are affected by CVE-2026-116591?
2 open source packages ship an affected version, including github.com/klauspost/compress/zstd.
| Package | Affected | Fixed in |
|---|---|---|
github.com/klauspost/compress/zstd Go | All versions | 1.20.2 |
github.com/klauspost/compress/zstd Go | All versions | 1.20.2 |
Linux distribution packages (5)
aliyun-cli openSUSE:Tumbleweed | All versions | 3.5.2-2.1 |
distribution openSUSE:Tumbleweed | All versions | 3.1.2-4.1 |
go-containerregistry openSUSE:Tumbleweed | All versions | 0.22.1-3.1 |
hauler openSUSE:Tumbleweed | All versions | 2.1.2-3.1 |
helm3 openSUSE:Tumbleweed | All versions | 3.22.1-2.1 |
How do I fix CVE-2026-116591?
Upgrade github.com/klauspost/compress/zstd to 1.20.2 or later.
Is CVE-2026-116591 being exploited?
There is no known exploitation of CVE-2026-116591 in the wild and no public exploit code.
Sources
Also known as GHSA-fpmh-frq8-7rj8, MINI-25p4-9jh6-8q47, MINI-2h2p-h44v-pjhp, MINI-2h8x-r7pp-hj94, MINI-2ph5-2wgr-6g3f, MINI-2qj9-7848-v74f and 91 more.