CVE-2026-63209 Integer Overflow or Wraparound and Out-of-bounds Write in compress
An attacker can cause a denial of service by triggering an integer overflow that leads to an out-of-bounds write and process crash in the compress library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-63209?
CVE-2026-63209 is a high-severity vulnerability in klauspost compress, published on 29 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
compress provides various compression algorithms. Prior to version 1.18.7, a signed integer overflow vulnerability in s2.NewDict() allows an attacker to bypass repeat index validation by supplying a dictionary with a uvarint-encoded repeat value exceeding MaxInt64. When Dict.Encode() is subsequently called, the overflowed negative repeat value causes an out-of-bounds memory access via unsafe.Pointer arithmetic, crashing the process with SIGSEGV. This issue has been patched in version 1.18.7.
Which versions are affected by CVE-2026-63209?
3 open source packages ship an affected version, including github.com/klauspost/compress.
| Package | Affected | Fixed in |
|---|---|---|
github.com/klauspost/compress Go | All versions | 1.18.7 |
github.com/klauspost/compress Go | All versions | 1.18.7 |
github.com/klauspost/compress Go | From 1.16.0 | 1.18.7 |
Linux distribution packages (37)
k6v1 Red Hat:hummingbird:1 | All versions | 0:1.8.1-0.1.hum1 |
nats-server2.12 Red Hat:hummingbird:1 | All versions | 0:2.12.15-0.1.hum1 |
nats-server2.14 Red Hat:hummingbird:1 | All versions | 0:2.14.7-0.1.hum1 |
podman Red Hat:hummingbird:1 | All versions | 0:6.1.2-1.hum1 |
podman-docker Red Hat:hummingbird:1 | All versions | 0:6.1.2-1.hum1 |
podman-machine Red Hat:hummingbird:1 | All versions | 0:6.1.2-1.hum1 |
podman-remote Red Hat:hummingbird:1 | All versions | 0:6.1.2-1.hum1 |
podmansh Red Hat:hummingbird:1 | All versions | 0:6.1.2-1.hum1 |
skopeo Red Hat:hummingbird:1 | All versions | 0:1.24.1-1.hum1 |
skopeo-tests Red Hat:hummingbird:1 | All versions | 0:1.24.1-1.hum1 |
google-osconfig-agent SUSE:Linux Enterprise Micro 5.5 | All versions | 20260928.01-150000.1.70.1 |
google-osconfig-agent SUSE:Linux Enterprise Module for Public Cloud 12 | All versions | 20260928.01-1.63.1 |
amazon-cloudwatch-agent SUSE:Linux Enterprise Module for Public Cloud 15 SP4 | All versions | 1.300073.0-150400.9.18.1 |
google-osconfig-agent SUSE:Linux Enterprise Module for Public Cloud 15 SP4 | All versions | 20260928.01-150000.1.70.1 |
amazon-cloudwatch-agent SUSE:Linux Enterprise Module for Public Cloud 15 SP5 | All versions | 1.300073.0-150400.9.18.1 |
google-osconfig-agent SUSE:Linux Enterprise Module for Public Cloud 15 SP5 | All versions | 20260928.01-150000.1.70.1 |
amazon-cloudwatch-agent SUSE:Linux Enterprise Module for Public Cloud 15 SP6 | All versions | 1.300073.0-150400.9.18.1 |
google-osconfig-agent SUSE:Linux Enterprise Module for Public Cloud 15 SP6 | All versions | 20260928.01-150000.1.70.1 |
amazon-cloudwatch-agent SUSE:Linux Enterprise Module for Public Cloud 15 SP7 | All versions | 1.300073.0-150400.9.18.1 |
google-osconfig-agent SUSE:Linux Enterprise Module for Public Cloud 15 SP7 | All versions | 20260928.01-150000.1.70.1 |
aliyun-cli SUSE:Linux Enterprise Server 16.0 | All versions | 3.5.1-160000.1.1 |
distribution SUSE:Linux Enterprise Server 16.0 | All versions | 3.1.1-160000.5.1 |
google-osconfig-agent SUSE:Linux Enterprise Server 16.0 | All versions | 20260928.01-160000.1.1 |
aliyun-cli SUSE:Linux Enterprise Server for SAP applications 16.0 | All versions | 3.5.1-160000.1.1 |
distribution SUSE:Linux Enterprise Server for SAP applications 16.0 | All versions | 3.1.1-160000.5.1 |
google-osconfig-agent SUSE:Linux Enterprise Server for SAP applications 16.0 | All versions | 20260928.01-160000.1.1 |
google-osconfig-agent SUSE:Linux Micro 6.0 | All versions | 20260928.01-159998.1.1 |
google-osconfig-agent SUSE:Linux Micro 6.1 | All versions | 20260928.01-slfo.1.1_1.1 |
aliyun-cli openSUSE:Leap 16.0 | All versions | 3.5.1-160000.1.1 |
cadvisor openSUSE:Leap 16.0 | All versions | 0.60.6-bp160.1.1 |
distribution openSUSE:Leap 16.0 | All versions | 3.1.1-160000.5.1 |
google-osconfig-agent openSUSE:Leap 16.0 | All versions | 20260928.01-160000.1.1 |
aliyun-cli openSUSE:Tumbleweed | All versions | 3.5.1-2.1 |
amazon-cloudwatch-agent openSUSE:Tumbleweed | All versions | 1.300073.0-1.1 |
cadvisor openSUSE:Tumbleweed | All versions | 0.60.6-1.1 |
distribution openSUSE:Tumbleweed | All versions | 3.1.1-9.1 |
go-containerregistry openSUSE:Tumbleweed | All versions | 0.22.1-2.1 |
How do I fix CVE-2026-63209?
Upgrade github.com/klauspost/compress to 1.18.7 or later.
Is CVE-2026-63209 being exploited?
There is no known exploitation of CVE-2026-63209 in the wild and no public exploit code.
Sources
Also known as AZL-105534, AZL-105906, CLEANSTART-2026-AH15669, CLEANSTART-2026-CC29276, CLEANSTART-2026-IP24198, CLEANSTART-2026-IQ41446 and 952 more.