{"id":"ghsa-ghsa-fpmh-frq8-7rj8","seq":1708787,"kind":"advisory","title":"compress zstd: Panic on two-block frames","url":"https://github.com/advisories/GHSA-fpmh-frq8-7rj8","permalink":"https://vulnpulse.app/items/ghsa-ghsa-fpmh-frq8-7rj8","summary":"影響: go:github.com/klauspost/compress/zstd <= 1.20.1 → 1.20.2\nA crafted ~27 KB two-block zstd frame makes DecodeAll and the streaming decoder panic with an out-of-range slice index instead of returning a decode error. The same bytes decode fine with the reference zstd. Any program that decompresses untrusted zstd input can be crashed by it. Reproduced on v1.20.0 and v1.20.1. Released in https://github.com/klauspost/compress/releases/tag/v1.20.2 Details The panic is in the FSE decoder that huff0.ReadTable uses to read a block's Huffman-weight table. Three…","severity":"high","techs":["go","github"],"cves":["CVE-2026-116591"],"tags":["GHSA-fpmh-frq8-7rj8","github.com/klauspost/compress/zstd"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-27T15:38:14.000Z","fetched_at":"2026-10-27T21:03:52.214Z"}