What is the CVSS score of EUVD-2026-88977?

EUVD-2026-88977 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.4%.

How to fix or mitigate EUVD-2026-88977?

Within 24 hours, inventory every Go service and build artifact that depends on github.com/klauspost/compress, using go.mod/go.sum, SBOM, or dependency-scanning output, and identify anything pinned below v1.18.7; prioritise services where untrusted or attacker-influenced bytes are passed into s2.NewDict() and the resulting dictionary is subsequently encoded, since those are the only realistically exposed paths. Within 7 days, upgrade all affected modules and their vendored or containerized copies to v1.18.7 (the vendor-released patch), rebuild, retest, and redeploy, and as an interim measure for anything that cannot be upgraded immediately, block untrusted input from reaching dictionary construction or disable s2 dictionary encoding on externally facing endpoints; confirm the fix by re-running dependency scans against the rebuilt artifacts. Within 30 days, add automated dependency-pinning and alerting for klauspost/compress and comparable low-level libraries into the CI/CD pipeline, add monitoring and alerting for abnormal process termination or SIGSEGV events in Go services that handle untrusted input, and add regression tests covering dictionary construction from hostile payloads so this class of flaw is caught before release.

klauspost/compress EUVD-2026-88977

Q: Which versions of klauspost/compress are affected by EUVD-2026-88977?

A high-severity availability flaw in the widely used Go compression library klauspost/compress (versions before 1.18.7) allows an attacker-influenced dictionary to crash the consuming application…. A patch is available.

| CVE-2026-63209 HIGH

Integer Overflow or Wraparound (CWE-190)

2026-09-29 security-advisories@github.com

Denial Of Service Golang Integer Overflow Red Hat Suse

7.5

CVSS 3.1 · Vendor: github

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Supply crafted s2 dictionary with oversized uvarint repeat
Exploit

Overflow bypasses repeat index validation in s2.NewDict()
Execution

Negative repeat drives OOB unsafe.Pointer arithmetic in Dict.Encode()
Impact

Process crashes with SIGSEGV (DoS)

Vulnerability Assessment

Weakness	CWE CWE-190 ASVS 5.0 V15 - Secure Coding and Architecture Integer overflow checks MITRE ATT&CK 1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Requires that the consuming Go application invoke s2.NewDict() on an attacker-influenced dictionary containing a uvarint-encoded repeat value greater than MaxInt64, and subsequently call Dict.Encode(). Exploitation is limited to applications that accept untrusted dictionary data through this specific s2 API path - it is not triggered by ordinary compression/decompression of arbitrary data, so despite the AV:N/PR:N/UI:N vector, real-world exposure depends on the application exposing dictionary construction to external input. Impact is confined to a crash of the affected process (availability only); versions prior to 1.18.7 are affected and 1.18.7 fixes it.
Impact	This is a genuine but bounded availability-only issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) reflects a pure denial-of-service: no confidentiality or integrity impact, only a SIGSEGV process crash. The 7.5 score is driven entirely by A:H combined with a network-reachable, low-complexity, unauthenticated vector - but that AV:N rating is optimistic for a compression LIBRARY: exploitation requires that the consuming application actually feed attacker-controlled dictionary bytes into s2.NewDict() and then call Dict.Encode(), which is a specific and uncommon API path, not a default network service. No EPSS score, no CISA KEV listing, and no public POC were provided in the input, so per precision rules this is 'no public exploit identified at time of analysis.' The GHSA advisory (GHSA-259r-337f-4rfw) is authored by GitHub's security advisory database and the fix is confirmed in release v1.18.7. Net: real and worth patching in Go dependency trees given the library's popularity, but the impact ceiling is a crash, not code execution or data exposure, so it is a medium-priority hygiene fix rather than an emergency. Note a data conflict below regarding the supplied source evidence.
Exploit ScenarioDerived	An application uses klauspost/compress s2 and constructs a dictionary from untrusted input by calling s2.NewDict() with a dictionary whose uvarint-encoded repeat value exceeds MaxInt64. The signed integer overflow bypasses repeat-index validation, and when Dict.Encode() runs the negative repeat value drives out-of-bounds unsafe.Pointer arithmetic, crashing the process with SIGSEGV. No public exploit code was identified in the provided data.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.4% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 29, 2026

Signed integer overflow in the s2 dictionary API of klauspost/compress before 1.18.7 lets an attacker crash a consuming Go process: a dictionary carrying a uvarint-encoded repeat value larger than MaxInt64 slips past repeat-index validation, and a subsequent call to Dict.Encode() converts the overflowed negative repeat value into an out-of-bounds unsafe.Pointer access that aborts the process with SIGSEGV. The issue is availability-only (C:N/I:N, A:H) on a CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector, but real exposure hinges on the application - it only matters where untrusted, attacker-influenced bytes reach s2.NewDict() and the resulting dictionary is then encoded, not in ordinary compression or decompression of arbitrary data. No public exploit code and no CISA KEV entry were identified at time of analysis; the vendor-released patch is v1.18.7.

RemediationAI

Upgrade the dependency to the patched release, for example go get github.com/klauspost/compress@v1.18.7 and confirm the module version resolves to >= v1.18.7 (vendor advisory: https://github.com/klauspost/compress/security/advisories/GHSA-259r-337f-4rfw, release notes: https://github.com/klauspost/compress/releases/tag/v1.18.7, fix commit: https://github.com/klauspost/compress/commit/539243b8823ee8f03e49969823d57c348c917536). If an immediate upgrade is not possible, the most effective compensating control is to stop passing untrusted bytes into s2.NewDict(): only construct dictionaries from trusted, application-owned data, and validate or pre-parse dictionary uvarints to reject repeat values exceeding MaxInt64 before a dictionary is built - the trade-off is that untrusted-dictionary features must be disabled or heavily sanitized, which may break legitimate third-party dictionary formats. Keep Dict.Encode() off any dictionary derived from external input, since the overflow only becomes memory-unsafe at encode time. Because the impact is confined to a crash (availability only, no confirmed confidentiality or integrity effect), running the decode/encode path in a child process or container with memory limits and a restart-on-crash policy bounds the outage, at the cost of added operational complexity and restart latency. Organizations also using the bundled s2sx unpack CLI should update it, since the same commit hardens that helper's symlink and hardlink path handling against extraction outside the destination directory.

Affected VersionsENISA

compress < 1.18.7

Affected Packages

go github.com/klauspost/compress fix: 1.18.7

euvd compress fix: 1.18.7

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 2 packages in go, euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The affected component is the s2 package of the Go module github.com/klauspost/compress, an extension of Snappy-style compression. The root cause is CWE-190 (integer overflow): s2.NewDict() decodes a repeat value from a uvarint, and because the decoded value can exceed MaxInt64 it wraps to a negative signed integer that is not caught by the repeat-index validation logic. That negative repeat count is later consumed by Dict.Encode(), where dictionary copy routines perform unsafe.Pointer arithmetic; the negative length walks the pointer outside the allocated buffer, producing an out-of-bounds access and a SIGSEGV that terminates the process. The assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H and its PR:N component mean no authentication is required per the vector, and exploitation requires no user interaction, but the practical precondition is that the consuming application exposes s2 dictionary construction to external input and then calls Encode() on it - a narrow, API-specific path rather than a flaw in normal decompression of attacker-supplied payloads. Note that the linked upstream commit also modifies the s2sx unpack helper's archive handling (symlink and hardlink target containment via a new within() check), a separate hardening change landing in the same release.

Know when Golang gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (github) PRIMARY 7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI 7.5 HIGH

Agree with 7.5: attacker-supplied dictionary bytes can arrive over the network with low complexity and no auth, yielding a crash (A:H) with no C/I impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE HIGH

Red Hat 7.5 HIGH

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch available

Sep 29, 2026 - 16:02 EUVD

CVE Published

Sep 29, 2026 - 15:17 cve.org

HIGH 7.5

DescriptionCVE.org

compress provides various compression algorithms. Prior to version 1.18.7, a signed integer overflow vulnerability in s2.NewDict() allows an attacker to bypass repeat index validation by supplying a dictionary with a uvarint-encoded repeat value exceeding MaxInt64. When Dict.Encode() is subsequently called, the overflowed negative repeat value causes an out-of-bounds memory access via unsafe.Pointer arithmetic, crashing the process with SIGSEGV. This issue has been patched in version 1.18.7.

Technical POC Analysis

CWE-190 integer overflow (the advisory also assigns CWE-787 for the resulting access) in s2.NewDict() in s2/dict.go (advisory cites lines 59-61).

Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.

Executive ViewAI

Why It Matters

A high-severity availability flaw in the widely used Go compression library klauspost/compress (versions before 1.18.7) allows an attacker-influenced dictionary to crash the consuming application process with a memory-access fault. Only services that construct s2 dictionaries from untrusted bytes and then encode with them are exposed; ordinary compression or decompression traffic is unaffected. Because the library is a common transitive dependency across Go services, leadership should treat this as a targeted denial-of-service risk to specific ingestion pipelines rather than a broad compromise of confidentiality or integrity.

Business Impact: Medium

Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score

0.4%

Top 72% exploitable

Prevalence

High

klauspost/compress is a very widely used Go compression library and transitive dependency

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment MSRC Vendor

GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.4%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Yes

Human Impact

Medium

Technical Impact

Partial

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +38

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Integer Overflow MEDIUM

Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

More in Golang

View all

CVE-2023-44487 HIGH Act Now POC

7.5 Oct 10

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour

CVE-2023-48795 MEDIUM This Month POC

5.9 Dec 18

The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remot

CVE-2016-5386 HIGH Act Now

8.1 Jul 19

The net/http package in Go through 1.6 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and there

CVE-2026-24897 CRITICAL Act Now POC

10.0 Jan 28

Erugo file-sharing platform up to version 0.2.14 has a CVSS 10.0 path traversal allowing authenticated users to read any

CVE-2025-68121 CRITICAL Act Now POC

10.0 Feb 05

Critical certificate validation bypass in Go crypto/tls during session resumption. If ClientCAs or RootCAs fields are mu

CVE-2022-50926 CRITICAL Act Now POC

9.8 Jan 13

WAGO PFC200 G2 PLC (firmware affected) allows privilege escalation through cookie manipulation. Users can modify cookie

CVE-2026-28408 CRITICAL Act Now POC

9.8 Feb 27

Authentication bypass in WeGIA charitable institution management system before 3.6.5. The adicionar_tipo_docs_atendido.p

CVE-2026-24895 CRITICAL Act Now POC

9.8 Feb 12

CGI path splitting vulnerability in FrankenPHP before 1.11.2 — Unicode characters bypass path validation during CGI proc

CVE-2019-14809 CRITICAL Act Now POC

9.8 Aug 13

net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an authorization by

CVE-2025-66719 CRITICAL Act Now POC

9.1 Jan 23

Free5gc NRF 1.4.0 has an authorization bypass in access token generation that allows authenticated users to request toke

CVE-2022-50909 HIGH This Week POC

8.8 Jan 13

Algo 8028 Control Panel version 3.3.3 contains a command injection vulnerability in the fm-data.lua endpoint that allows

CVE-2026-82410 HIGH This Week POC

8.7 Sep 16

Denial of service in PocketBase versions prior to 0.22.48 (0.22.x branch) and 0.23.0 through 0.39.6 (0.23.0+ branch) all

Same weakness CWE-190 – Integer Overflow or Wraparound

View all

CVE-2013-2729 CRITICAL POC

9.8

CVE-2015-8651 HIGH

8.8

CVE-2012-5054 HIGH POC

8.8

CVE-2014-0569 CRITICAL POC

9.3

CVE-2023-21716 CRITICAL POC

9.8

CVE-2017-3599 HIGH POC

7.5

CVE-2017-7529 HIGH

7.5

CVE-2016-1010 HIGH

8.8

Same technique Denial Of Service

View all

CVE-2015-5119 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2011-0611 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

CVE-2012-0507 CRITICAL POC

9.8

CVE-2014-1761 HIGH POC

7.8

CVE-2015-5122 CRITICAL POC

9.8

CVE-2011-0609 HIGH POC

7.8

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
openSUSE Tumbleweed	Fixed
SUSE Linux Enterprise Micro 5.5	Affected
SUSE Linux Enterprise Module for Public Cloud 12	Affected
SUSE Linux Enterprise Server 12	Affected
SUSE Linux Enterprise Server for SAP Applications 12	Affected

References

Advisories & patches

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back