Go/github.com/klauspost/compress CVE-2026-63209: high 7.5

Compress/s2: Integer Overflow or Wraparound and Out-of-bounds Write in compress

Action: Upgrade github.com/klauspost/compress to 1.18.7 or later.

go get github.com/klauspost/compress@v1.18.7

Affected

Fixed versions

Sources

• osv: GHSA-259r-337f-4rfw
• https://github.com/klauspost/compress/security/advisories/GHSA-259r-337f-4rfw
• https://nvd.nist.gov/vuln/detail/CVE-2026-63209
• https://github.com/klauspost/compress/pull/1163
• https://github.com/klauspost/compress/commit/539243b8823ee8f03e49969823d57c348c917536
• https://github.com/klauspost/compress/commit/8668e357e776d5152ed62f33c17f21b8690664fa
• https://github.com/klauspost/compress
• https://github.com/klauspost/compress/releases/tag/v1.18.7

CVE-2026-63209 · published 2026-10-20T14:33:33Z · modified 2026-10-20T14:45:03.782718646Z · JSON