ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2026-116591

compress zstd: Panic on two-block frames

Published Oct 26, 2026 · catalog updated Oct 27, 2026 · compress zstd: Panic on

Last checked Nov 5, 2026. A connected source was read within the last 7 days.

Check if you run it

No confirmed exploitation is on record for CVE-2026-116591. EPSS is 0.33%. Act only if a listed version of compress zstd: Panic on is installed.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (compress zstd: Panic on).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
High8.7
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.33%
Remediation
Fix linked
Affected products
Go github.com/klauspost/compress/zstd · go github.com/klauspost/compress/zstd · golang github.com · vendor klauspost compress

### Summary A crafted ~27 KB two-block zstd frame makes DecodeAll and the streaming decoder panic with an out-of-range slice index instead of returning a decode error. The same bytes decode fine with the reference zstd. Any program that decompresses untrusted zstd input can be crashed by it. Reproduced on v1.20.0 and v1.20.1. Released in https://github.com/klauspost/compress/releases/tag/v1.20.2 ### Details The panic is in the FSE decoder that uses to read a block's Huffman-weight table. Three conditions have to hold at once, and the crafted frame arranges all three. **1. A count that doesn't fit is accepted.** permits a tableLog up to 15 ([ ](https://github.com/klauspost/compress/blob/v1.20.0/fse/decompress.go#L9), checked at [ ](https://github.com/klauspost/compress/blob/v1.20.0/fse/decompress.go#L54)), so a symbol's normalized count can reach 32768 (2^15). The count is stored in an at [ ](https://github.com/klauspost/compress/blob/v1.20.0/fse/decompress.go#L126), where 32768 wraps to −32768. The validation only looks at the running totals ( and ), which still match, so the bad value passes. The crafted second block produces , . **2. The decode table is built empty, with no error.** In , −32768 isn't the −1 that flags a low-probability symbol, so it skips that branch, and the spread loop [ ](https://github.com/klauspost/compress/blob/v1.20.0/fse/decompress.go#L221) runs zero times for a negative . never advances, so the [ ](https://github.com/klauspost/compress/blob/v1.20.0/fse/decompress.go#L230) guard passes as well. **3. Stale state from the previous block is reused.** shares one across both blocks, and [ ](https://github.com/klauspost/compress/blob/v1.20.0/fse/decompress.go#L173-L189) reuses and without clearing them. So the table is rebuilt on top of block 1's symbols and values. Many cells end up with , because the leftover is ≥ 32768. At decode time, every symbol's count is below , so stays false and takes the [ ](https://github.com/klauspost/compress/blob/

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • Go github.com/klauspost/compress/zstd0 → 1.20.2
  • go github.com/klauspost/compress/zstd<= 1.20.1
  • golang github.comversion unspecified
  • vendor klauspost compressversion unspecified

How to fix CVE-2026-116591

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-116591. EPSS is 0.33%. Act only if a listed version of compress zstd: Panic on is installed.

Which versions are affected?

Compare what you have installed with 0 → 1.20.2, <= 1.20.1. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-190: Integer Overflow. EPSS 0.33%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Related Odoo Git fixes

Quoted Community commit messages that cite this CVE. Presence of a commit is not proof that every edition or backport includes the fix. Enterprise proprietary diffs are never shown here. Timeline

  • Oct 28, 2026 · referenced

    vendor: github.com/klauspost/compress v1.20.2

    vendor: github.com/klauspost/compress v1.20.2 includes a fix for CVE-2026-116591 / [GHSA-fpmh-frq8-7rj8] full diff: https://github.com/klauspost/compress/compare/v1.20.1...v1.20.2 [GHSA-fpmh-frq8-7rj8]: https://github.com/klauspost/compress/security/advisories/GHSA-fpmh-frq8-7rj8
    https://github.com/moby/moby/commit/8e8a8a575697550919fdb9183cddcf86cb0daf22

Timeline

Detection, updates, and resolution for this record.

  1. Oct 27, 2026 · GitHub Advisory Database

    Detected

    ### Summary A crafted ~27 KB two-block zstd frame makes DecodeAll and the streaming decoder panic with an out-of-range slice index instead of returning a decode error. The same bytes decode fine with the reference zstd. Any program that decompresses untrusted zstd input can be crashed by it. Reproduced on v1.20.0 and v1.20.1. Released in https://github.com/klauspost/compress/releases/tag/v1.20.2 #

  2. Oct 27, 2026 · GitHub Advisory Database

    Updated

    ### Summary A crafted ~27 KB two-block zstd frame makes DecodeAll and the streaming decoder panic with an out-of-range slice index instead of returning a decode error. The same bytes decode fine with the reference zstd. Any program that decompresses untrusted zstd input can be crashed by it. Reproduced on v1.20.0 and v1.20.1. Released in https://github.com/klauspost/compress/releases/tag/v1.20.2 #

  3. Oct 27, 2026 · Go Vulnerability Database

    Fix available

    github.com/klauspost/compress/zstd fixed in 1.20.2

  4. Oct 27, 2026 · Go Vulnerability Database

    Fix available

    github.com/klauspost/compress/zstd fixed in 1.20.2

  5. Oct 27, 2026 · Go Vulnerability Database

    Updated

    ### Summary A crafted ~27 KB two-block zstd frame makes DecodeAll and the streaming decoder panic with an out-of-range slice index instead of returning a decode error. The same bytes decode fine with the reference zstd. Any program that decompresses untrusted zstd input can be crashed by it. Reproduced on v1.20.0 and v1.20.1. Released in https://github.com/klauspost/compress/releases/tag/v1.20.2 #

Sources

  • CVE.orgVulnerability recordCVE-2026-116591

    compress provides various compression algorithms. Prior to 1.20.2, the zstd DecodeAll and streaming decoder paths can panic when a crafted two-block frame reaches huff0.ReadTable with an FSE normalized count of 32768 that readNCount stores in int16 as -32768. The wrapped count al

    cve.org
  • GitHub Advisory DatabasePackage advisoryGHSA-fpmh-frq8-7rj8

    compress zstd: Panic on two-block frames

    github.com
  • GitLab Advisory DatabasePackage advisoryCVE-2026-116591

    A crafted ~27 KB two-block zstd frame makes DecodeAll and the streaming decoder panic with an out-of-range slice index instead of returning a decode error. The same bytes decode fine with the reference zstd. Any program that decompresses untrusted zstd input can be crashed by it. Reproduced on v1.20.0 and v1.20.1. Released in https://github.com/klauspost/compress/releases/tag/v1.20.2

    advisories.gitlab.com
  • Go Vulnerability DatabasePackage advisoryGHSA-fpmh-frq8-7rj8

    compress zstd: Panic on two-block frames

    osv.dev

References

Freshness

Last verified in this catalog Nov 5, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

  • Go Vulnerability DatabaseOct 28, 2026
  • GitLab Advisory DatabaseOct 28, 2026
  • GitHub Advisory DatabaseOct 28, 2026
  • CVE.orgOct 27, 2026