{"schema":"threatline.record/2","record":{"id":"CVE-2026-116591","aliases":["GHSA-fpmh-frq8-7rj8"],"summary":"compress zstd: Panic on two-block frames","details":"compress provides various compression algorithms. Prior to 1.20.2, the zstd DecodeAll and streaming decoder paths can panic when a crafted two-block frame reaches huff0.ReadTable with an FSE normalized count of 32768 that readNCount stores in int16 as -32768. The wrapped count allows buildDtable to retain stale fse.Scratch decode-table state from the prior block, and nextFast then derives an out-of-range state and indexes beyond the table instead of returning a decode error. Both blocks are required to preserve and then reuse the stale state, allowing untrusted zstd input to crash an application. This issue is fixed in version 1.20.2.","categories":["Unclassified"],"product":"compress","vendor":"klauspost","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-116591","source_modified_at":"2026-10-26T21:55:20.476Z","fetched_at":"2026-10-26T23:45:56.352924Z","product":"compress","vendor":"klauspost","versions":[{"version":"< 1.20.2","status":"affected"}],"defaultStatus":null}],"fixed_versions":[],"cvss":8.7,"severity":"High","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-26T21:54:33.109Z","modified_at":"2026-10-26T21:55:20.476Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-116591","fetched_at":"2026-10-26T23:45:56.352924Z","source_modified_at":"2026-10-26T21:55:20.476Z"}],"sources":["CVE List"],"references":[{"source":"CVE List","url":"https://github.com/klauspost/compress/security/advisories/GHSA-fpmh-frq8-7rj8","tags":["x_refsource_CONFIRM"]},{"source":"CVE List","url":"https://github.com/klauspost/compress/commit/7f5d8528720c895a6106f201719f87eb030a565d","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/klauspost/compress/releases/tag/v1.20.2","tags":["x_refsource_MISC"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-26T21:55:20.476Z","content_hash":"76d232b90f9d21983d2145b31794cfa343ddb79ea7c662c816502f7c120e1f05"}}