| id: GO-2026-5841 |
| modules: |
| - module: github.com/klauspost/compress |
| versions: |
| - introduced: 1.16.0 |
| - fixed: 1.18.7 |
| vulnerable_at: 1.18.6 |
| packages: |
| - package: github.com/klauspost/compress/s2 |
| symbols: |
| - NewDict |
| summary: OOB read in github.com/klauspost/compress/s2 |
| description: |- |
| Providing a specially crafted dictionary to s2.NewDict and using it to encode |
| data can make the encoder read out of bounds. |
| ghsas: |
| - GHSA-259r-337f-4rfw |
| references: |
| - advisory: https://github.com/klauspost/compress/security/advisories/GHSA-259r-337f-4rfw |
| - fix: https://github.com/klauspost/compress/commit/8668e357e776d5152ed62f33c17f21b8690664fa |
| source: |
| id: go-security-team |
| created: 2026-07-21T19:12:59.938197-04:00 |
| review_status: REVIEWED |
