Skip to content

fix(deps): update module github.com/klauspost/compress to v1.18.7 [security] - #6

Open
alaudaa-renovate[bot] wants to merge 1 commit into
mainfrom
renovate/go-github.com-klauspost-compress-vulnerability
Open

fix(deps): update module github.com/klauspost/compress to v1.18.7 [security]#6
alaudaa-renovate[bot] wants to merge 1 commit into
mainfrom
renovate/go-github.com-klauspost-compress-vulnerability

Conversation

@alaudaa-renovate

@alaudaa-renovate alaudaa-renovate Bot commented Jul 29, 2026 •
edited
Loading

Copy link
Copy Markdown

This PR contains the following updates:

Package Change Age Confidence
github.com/klauspost/compress v1.18.0 -> v1.18.7 age confidence

GitHub Vulnerability Alerts

CVE-2026-63209

Signed Integer Overflow in s2.NewDict

Summary

A signed integer overflow vulnerability in s2.NewDict() allows an attacker to bypass repeat index validation by supplying a dictionary with a uvarint-encoded repeat value exceeding MaxInt64. When Dict.Encode() is subsequently called, the overflowed negative repeat value causes an out-of-bounds memory access via unsafe.Pointer arithmetic, crashing the process with SIGSEGV.

Package

  • Name: github.com/klauspost/compress/s2
  • Ecosystem: Go
  • Affected versions: <= v1.18.6 (all versions with NewDict function)

Severity

High (7.5) — CVSS v3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Vulnerability

Type

  • CWE-190: Integer Overflow or Wraparound
  • CWE-787: Out-of-bounds Write (via unsafe.Pointer)

Description

The NewDict() function reads a uvarint from dictionary data and converts it to int:

r, n := binary.Uvarint(dict)
// ...
d.repeat = int(r)
if d.repeat > len(dict) {
    return nil
}

When r exceeds MaxInt64 (9223372036854775807), int(r) overflows to a negative value. Since a negative number is never greater than a positive length, the validation check is bypassed.

When Dict.Encode() is called, the negative repeat value causes an integer overflow in encodeBlockDictGo():

repeat := len(dict.dict) - dict.repeat  // overflows: 62 - (-5758978476775341977) = huge positive
candidate := len(dict.dict) - repeat + s // underflows to negative
load32(dict.dict, candidate)             // OOB via unsafe.Pointer

load32 calls le.Load32 which uses unsafe.Pointer arithmetic without bounds checking:

func Load32[I Indexer](b []byte, i I) uint32 {
    return *(*uint32)(unsafe.Add(unsafe.Pointer(unsafe.SliceData(b)), i))
}

This causes a segmentation fault (SIGSEGV) when the negative index is dereferenced.

PoC

package main

import (
    "encoding/binary"
    "fmt"
    "github.com/klauspost/compress/s2"
)

func main() {
    var dictData []byte
    buf := make([]byte, binary.MaxVarintLen64)
    n := binary.PutUvarint(buf, 12687765596934209639) // > MaxInt64
    dictData = append(dictData, buf[:n]...)
    dictData = append(dictData, make([]byte, 16)...) // minimum dict size

    dict := s2.NewDict(dictData)
    // dict is non-nil despite invalid repeat value (overflow bypassed validation)

    src := make([]byte, 64)
    for i := range src { src[i] = byte(i) }
    dict.Encode(nil, src) // SIGSEGV: OOB access via unsafe.Pointer
}

Impact

  • Denial of Service: The process crashes immediately with SIGSEGV

Attack Vector

Any application that:

  1. Accepts user-supplied S2 dictionary data via s2.NewDict()
  2. Calls Dict.Encode() on any data ≥32 bytes

Suggested Fix

Validate the uvarint value before converting to int:

if r > math.MaxInt64 {
    return nil
}
d.repeat = int(r)

Or use uint for the repeat field and validate against uint(len(dict)).

References

  • Source: s2/dict.go lines 59-61 (vulnerability), s2/encode_all.go line 947 (crash site)
  • Commit: 539243b (v1.18.6 + 4 commits)

Credits

Christopher Linke / https://github.com/celinke97/

OOB read in github.com/klauspost/compress/s2

GHSA-259r-337f-4rfw / GO-2026-5841

More information

Details

Providing a specially crafted dictionary to s2.NewDict and using it to encode data can make the encoder read out of bounds.

Severity

Unknown

References

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

Release Notes

klauspost/compress (github.com/klauspost/compress)

v1.18.7

Compare Source

  • Fix s2.NewDict OOB read.

Security release without other changes.

Full Changelog: klauspost/compress@v1.18.6...v1.18.7

v1.18.6

Compare Source

What's Changed

New Contributors

Full Changelog: klauspost/compress@v1.18.5...v1.18.6

v1.18.5

Compare Source

What's Changed

Full Changelog: klauspost/compress@v1.18.4...v1.18.5

v1.18.4

Compare Source

What's Changed

New Contributors

Full Changelog: klauspost/compress@v1.18.2...v1.18.4

v1.18.3

Compare Source

Downstream CVE-2025-61728

See https://github.com/golang/go/issues/77102

Full Changelog: klauspost/compress@v1.18.2...v1.18.3

v1.18.2

Compare Source

What's Changed

v1.18.1 is marked "retracted" due to invalid flate/zip/gzip encoding.

New Contributors

Full Changelog: klauspost/compress@v1.18.1...v1.18.2

v1.18.1

Compare Source

What's Changed

New Contributors

Full Changelog: klauspost/compress@v1.18.0...v1.18.1

Configuration

📅 Schedule: Branch creation - "" in timezone UTC, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

@alaudaa-renovate
fix(deps): update module github.com/klauspost/compress to v1.18.7 [se…
a529e6d 
…curity]

Signed-off-by: alaudaa-renovate[bot] <219066560+alaudaa-renovate[bot]@users.noreply.github.com>
@alaudaa-renovate

alaudaa-renovate Bot commented Jul 29, 2026

Copy link
Copy Markdown
Author

ℹ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • The go directive was updated for compatibility reasons

Details:

Package Change
go 1.23.0 -> 1.24

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies security

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants