Bug 2543236 (CVE-2026-63209)

Summary: CVE-2026-63209 github.com/klauspost/compress: klauspost/compress: Denial of Service via integer overflow in dictionary processing
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: aazores, akhatavk, akoudelk, amctagga, anjoseph, aoconnor, aos-team-art-private, asdas, bniver, cmah, doconnor, dpaolell, dymurray, eaguilar, ebaron, eborisov, flucifre, gmeno, gparvin, groman, jbalunas, jcantril, jdelft, jmatsuok, jmatthew, jprabhak, jtolenti, jupierce, kaycoth, lball, lbragsta, lchilton, lgarciaa, mbenjamin, mbiarnes, mhackett, mwringe, ngough, pjindal, ppalepu, ppostler, prdhamdh, rhaigner, rhel-process-autobot, rjohnson, rojacob, sfeifer, sghai, sidsharm, sostapov, suppawar, tsze, vereddy, veshanka, vlaad, watson-tool-maintainers, wenshen, whayutin, wtam
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the klauspost/compress package. A remote attacker can exploit this vulnerability by supplying a specially crafted compression dictionary with an excessively large repeat value, triggering an integer overflow. When the dictionary is subsequently processed, this overflow leads to out-of-bounds memory access, crashing the application and resulting in a Denial of Service (DoS).
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-09-29 15:13:49 UTC 
compress provides various compression algorithms. Prior to version 1.18.7, a signed integer overflow vulnerability in s2.NewDict() allows an attacker to bypass repeat index validation by supplying a dictionary with a uvarint-encoded repeat value exceeding MaxInt64. When Dict.Encode() is subsequently called, the overflowed negative repeat value causes an out-of-bounds memory access via unsafe.Pointer arithmetic, crashing the process with SIGSEGV. This issue has been patched in version 1.18.7.