CVE-2026-116591: compress zstd: Panic on two-block frames

October 27, 2026

A crafted ~27 KB two-block zstd frame makes DecodeAll and the streaming decoder panic with an out-of-range slice index instead of returning a decode error. The same bytes decode fine with the reference zstd. Any program that decompresses untrusted zstd input can be crashed by it. Reproduced on v1.20.0 and v1.20.1.

Released in https://github.com/klauspost/compress/releases/tag/v1.20.2

References

github.com/advisories/GHSA-fpmh-frq8-7rj8
github.com/klauspost/compress/commit/7f5d8528720c895a6106f201719f87eb030a565d
github.com/klauspost/compress/releases/tag/v1.20.2
github.com/klauspost/compress/security/advisories/GHSA-fpmh-frq8-7rj8
nvd.nist.gov/vuln/detail/CVE-2026-116591

Code Behaviors & Features

Detect and mitigate CVE-2026-116591 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →