Package
dogstatsd-7.80
Component
github.com/klauspost/compress
Latest update
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Justification
Impact
GO-2026-5841 (GHSA-259r-337f-4rfw) is an out-of-bounds read in github.com/klauspost/compress/s2, triggered only when an application passes an attacker-controlled dictionary to s2.NewDict and uses it to encode data (fixed in klauspost/compress 1.18.7). This image links klauspost/compress for general compression but does not use the S2 dictionary-encoding path; the vulnerable s2.NewDict symbol is not present in the built binary, so the vulnerability is not exploitable here.
Status