Compress
Monthly
Untrusted zstd input can crash any Go application that decompresses it with klauspost/compress 1.20.1 or earlier: a crafted two-block frame of roughly 27 KB drives the FSE decoder used by huff0.ReadTable into an out-of-range slice index, producing a runtime panic instead of a decode error. Both default decode paths - DecodeAll and the streaming decoder - are affected, and the flaw requires no authentication or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), so impact is availability only; there is no memory corruption, code execution or data exposure. Exploitation is not confirmed (CISA KEV not listed, SSVC exploitation: none), EPSS is a low 0.33%, and a public PoC reference exists in the GitHub advisory as a Go test reproducer; it is not verified as working exploit code beyond that panic reproduction. The vendor ships a fix in 1.20.2, and the issue is assessed as a bounded but genuine denial-of-service, prioritised 'this week'.
Insecure embedded zlib in Compress::Raw::Zlib through 2.219 for Perl.
Untrusted zstd input can crash any Go application that decompresses it with klauspost/compress 1.20.1 or earlier: a crafted two-block frame of roughly 27 KB drives the FSE decoder used by huff0.ReadTable into an out-of-range slice index, producing a runtime panic instead of a decode error. Both default decode paths - DecodeAll and the streaming decoder - are affected, and the flaw requires no authentication or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), so impact is availability only; there is no memory corruption, code execution or data exposure. Exploitation is not confirmed (CISA KEV not listed, SSVC exploitation: none), EPSS is a low 0.33%, and a public PoC reference exists in the GitHub advisory as a Go test reproducer; it is not verified as working exploit code beyond that panic reproduction. The vendor ships a fix in 1.20.2, and the issue is assessed as a bounded but genuine denial-of-service, prioritised 'this week'.
Insecure embedded zlib in Compress::Raw::Zlib through 2.219 for Perl.