AIKIDO-2026-288845
github.com/klauspost/compress is vulnerable to Denial of Service (DoS)
87
CVE Score
High
Denial of Service (DoS)
TL;DR
A crafted zstd frame can crash applications using the zstd decoder in github.com/klauspost/compress. An oversized FSE normalized count overflows its int16 storage, allowing a malformed Huffman weight table to reuse decoding state from a previous block or frame. Decoding then panics on an out-of-range table index instead of returning an error.
How do I fix this?
Upgrade the github.com/klauspost/compress Go module to a patched release. The fix rejects normalized counts that exceed int16 capacity and enforces the format limit for FSE-compressed Huffman weight tables.
Who does this affect?
You are affected if your application uses github.com/klauspost/compress/zstd to decompress attacker-controlled data through DecodeAll or the streaming decoder. An attacker can supply a small crafted frame to trigger a panic and cause denial of service. Checking the returned error does not prevent the crash, and the streaming decoder can panic in its own goroutine.
Versions
1.15.0 - 1.20.1
Fixed in 1.20.2Background info
github.com/klauspost/compress is vulnerable to Denial of Service (DoS) in versions 1.15.0 - 1.20.1.
Links
GitHub Release
Get secure today,
quickly and for free.
Secure your code, cloud, and runtime in one central system. Connect a repo to discover what the reasoning agents find in your codebase.
No credit card required | Scan results in 32 seconds.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPAuthorized© All Intel data is openly available and commercially licensed.