klauspost compress: Denial of service via panic in zstd decoder
Summary
The Go compression library klauspost/compress contains a flaw in its zstd decoder. A crafted zstd frame with two blocks can make the DecodeAll or streaming decoder panic, which terminates the affected application. An attacker only needs to submit crafted zstd data to an application that decodes untrusted input, and no authentication is required. The impact is limited to denial of service; no code execution or data disclosure is reported.
Affected
- klauspost/compress (Go module github.com/klauspost/compress) versions before 1.20.2
- The advisory reproduced the issue on v1.20.0 and v1.20.1
Fixed in
- Upgrade to v1.20.2 or later
Workaround
- Unknown. No vendor workaround is published.
- Interim measure (not vendor guidance): ensure panics in request handlers are recovered so that one crafted input does not stop the whole process, and limit which inputs reach the zstd decoder.
Exploitation
- Not known to be exploited in the wild.
- Not listed in CISA KEV; EPSS below 1%.
- CISA SSVC: exploitation none, automatable yes.
- Downstream projects have published regression tests that reproduce the crash.
Our recommendation
- Check whether your applications or dependencies use github.com/klauspost/compress, often indirectly (for example via go.sum or an SBOM).
- Upgrade to v1.20.2 or later; check whether your Go toolchain must be updated first.
- Prioritise applications that decode zstd data from untrusted sources.
- Ensure that panics in services are recovered and monitor for unexpected crashes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-fpmh-frq8-7rj8 github.com
- Release v1.20.2 github.com
- Fix commit 7f5d852 github.com
- OSV GHSA-fpmh-frq8-7rj8 osv.dev
- OpenCVE CVE-2026-116591 app.opencve.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 00:06.
Original description (NVD)
compress provides various compression algorithms. Prior to 1.20.2, the zstd DecodeAll and streaming decoder paths can panic when a crafted two-block frame reaches huff0.ReadTable with an FSE normalized count of 32768 that readNCount stores in int16 as -32768. The wrapped count allows buildDtable to retain stale fse.Scratch decode-table state from the prior block, and nextFast then derives an out-of-range state and indexes beyond the table instead of returning a decode error. Both blocks are required to preserve and then reuse the stale state, allowing untrusted zstd input to crash an application. This issue is fixed in version 1.20.2.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.