{"action":"Upgrade github.com/klauspost/compress to 1.18.7 or later.","affected":[{"fixed":"1.18.7","introduced":"0"}],"component":"github.com/klauspost/compress","cve_ids":["CVE-2026-63209"],"ecosystem":"Go","exploited":false,"fixed_versions":["1.18.7"],"ghsa_id":"GHSA-259r-337f-4rfw","id":"tcs_01M5JK7ZE8BH4W8YKGQ97A9HMZ","modified_at":"2026-10-20T14:45:03.782718646Z","published_at":"2026-10-20T14:33:33Z","references":["https://osv.dev/vulnerability/GHSA-259r-337f-4rfw","https://github.com/klauspost/compress/security/advisories/GHSA-259r-337f-4rfw","https://nvd.nist.gov/vuln/detail/CVE-2026-63209","https://github.com/klauspost/compress/pull/1163","https://github.com/klauspost/compress/commit/539243b8823ee8f03e49969823d57c348c917536","https://github.com/klauspost/compress/commit/8668e357e776d5152ed62f33c17f21b8690664fa","https://github.com/klauspost/compress","https://github.com/klauspost/compress/releases/tag/v1.18.7"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-259r-337f-4rfw","url":"https://osv.dev/vulnerability/GHSA-259r-337f-4rfw"}],"summary":"Compress/s2: Integer Overflow or Wraparound and Out-of-bounds Write in compress"}