Vulnerability · CVE-2026-63209
Compress/s2: Integer Overflow or Wraparound and Out-of-bounds Write in compress
Published Oct 20, 2026 · catalog updated Oct 20, 2026 · Compress/s2: Integer Overflow or
Last checked Nov 5, 2026. A connected source was read within the last 7 days.
Check if you run it
No confirmed exploitation is on record for CVE-2026-63209. EPSS is 0.57%. Act only if a listed version of Compress/s2: Integer Overflow or is installed.
Gaps on this record
- The stored product name is a package slug. The name on this page is taken from the title (Compress/s2: Integer Overflow or).
- No vendor fix or required action is stored. Compare the linked advisory before you change production.
- Severity
- High7.5
- Known exploitation
- Not in CISA/VulnCheck KEV
- EPSS
- 0.57%
- Remediation
- Advisory link
- Affected products
- Go github.com/klauspost/compress
# Signed Integer Overflow in s2.NewDict ## Summary A signed integer overflow vulnerability in allows an attacker to bypass repeat index validation by supplying a dictionary with a uvarint-encoded repeat value exceeding . When is subsequently called, the overflowed negative repeat value causes an out-of-bounds memory access via arithmetic, crashing the process with SIGSEGV. ## Package - **Name:** - **Ecosystem:** Go - **Affected versions:** <= v1.18.6 (all versions with function) ## Severity **High (7.5)** — CVSS v3.1: ## Vulnerability ### Type - CWE-190: Integer Overflow or Wraparound - CWE-787: Out-of-bounds Write (via unsafe.Pointer) ### Description The function reads a uvarint from dictionary data and converts it to : When exceeds (9223372036854775807), overflows to a negative value. Since a negative number is never greater than a positive length, the validation check is bypassed. When is called, the negative value causes an integer overflow in : calls which uses arithmetic without bounds checking: This causes a segmentation fault (SIGSEGV) when the negative index is dereferenced. ## PoC ## Impact - **Denial of Service:** The process crashes immediately with SIGSEGV ## Attack Vector Any application that: 1. Accepts user-supplied S2 dictionary data via 2. Calls on any data ≥32 bytes ## Suggested Fix Validate the uvarint value before converting to int: Or use for the repeat field and validate against . ## References - Source: lines 59-61 (vulnerability), line 947 (crash site) - Commit: 539243b (v1.18.6 + 4 commits) ## Credits Christopher Linke / https://github.com/celinke97/
Are you affected?
Enter the version you run. The result uses only the ranges stored on this record.
The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.
- Go github.com/klauspost/compress0 → 1.18.7
How to fix CVE-2026-63209
Upgrade
CVE-2026-63209 lists a fix boundary at 1.18.7. Compare the installed build with that boundary before you change production.
Version check
Fixed in 1.18.7
Advisory
Open the cve_org record and follow its fix.
Official advisories
What to do
Three questions, each answered from this record only. Confirm the vendor advisory before you patch.
Should you patch?
No confirmed exploitation is on record for CVE-2026-63209. EPSS is 0.57%. Act only if a listed version of Compress/s2: Integer Overflow or is installed.
Which versions are affected?
Compare what you have installed with 0 → 1.18.7. Compare the installed version with the linked vendor advisory before you change production.
What should an analyst verify?
CWE-190: Integer Overflow; CWE-787: Out-of-bounds Write. EPSS 0.57%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Oct 20, 2026 · GitHub Advisory Database
Detected
# Signed Integer Overflow in s2.NewDict ## Summary A signed integer overflow vulnerability in allows an attacker to bypass repeat index validation by supplying a dictionary with a uvarint-encoded repeat value exceeding . When is subsequently called, the overflowed negative repeat value causes an out-of-bounds memory access via arithmetic, crashing the process with SIGSEGV. ## Package - **Name:** -
Oct 20, 2026 · GitHub Advisory Database
Fix available
github.com/klauspost/compress fixed in 1.18.7
Oct 20, 2026 · GitHub Advisory Database
Fix available
github.com/klauspost/compress fixed in 1.18.7
Oct 20, 2026 · GitHub Advisory Database
Updated
# Signed Integer Overflow in s2.NewDict ## Summary A signed integer overflow vulnerability in allows an attacker to bypass repeat index validation by supplying a dictionary with a uvarint-encoded repeat value exceeding . When is subsequently called, the overflowed negative repeat value causes an out-of-bounds memory access via arithmetic, crashing the process with SIGSEGV. ## Package - **Name:** -
Sources
- CVE.orgVulnerability recordCVE-2026-63209
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2026-63209
30-day exploitation probability 0.57%
first.org - GitHub Advisory DatabasePackage advisoryGHSA-259r-337f-4rfw
GitHub Advisory Database record mirrored by OSV.
github.com - Go Vulnerability DatabasePackage advisoryGHSA-259r-337f-4rfw
Compress/s2: Integer Overflow or Wraparound and Out-of-bounds Write in compress
osv.dev - OpenSSF OSV / OSV ScannerPackage advisoryGHSA-259r-337f-4rfw
Compress/s2: Integer Overflow or Wraparound and Out-of-bounds Write in compress
osv.dev
References
Freshness
Last verified in this catalog Nov 5, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.
- FIRST EPSSNov 5, 2026
- Go Vulnerability DatabaseOct 23, 2026
- CVE.orgOct 21, 2026
- GitHub Advisory DatabaseOct 21, 2026
- OpenSSF OSV / OSV ScannerOct 21, 2026