data/reports/GO-2026-5841.yaml

id: GO-2026-5841
modules:
    - module: github.com/klauspost/compress
      versions:
        - introduced: 1.16.0
        - fixed: 1.18.7
      vulnerable_at: 1.18.6
      packages:
        - package: github.com/klauspost/compress/s2
          symbols:
            - NewDict
summary: OOB read in github.com/klauspost/compress/s2
description: |-
    Providing a specially crafted dictionary to s2.NewDict and using it to encode
    data can make the encoder read out of bounds.
ghsas:
    - GHSA-259r-337f-4rfw
references:
    - advisory: https://github.com/klauspost/compress/security/advisories/GHSA-259r-337f-4rfw
    - fix: https://github.com/klauspost/compress/commit/8668e357e776d5152ed62f33c17f21b8690664fa
source:
    id: go-security-team
    created: 2026-07-21T19:12:59.938197-04:00
review_status: REVIEWED