Package
opentofu-fips-1.9
Component
github.com/klauspost/compress
Latest update
7.5
CVSS V3
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Justification
Impact
GHSA-259r-337f-4rfw (CVE-2026-63209, GO-2026-5841) is a signed integer overflow in s2.NewDict in github.com/klauspost/compress, which permits an out-of-bounds read when Dict.Encode is subsequently called.
The Go vulnerability database records the affected range as 1.16.0 up to 1.18.7, with the vulnerable symbol being github.com/klauspost/compress/s2.NewDict. This artifact ships github.com/klauspost/compress v1.15.11, which predates that range. The s2 dictionary implementation, including NewDict, was introduced in v1.16.0 and is not present in v1.15.11.
The detection arises from the GitHub advisory recording the affected range as all versions up to and including 1.18.6 with no lower bound, which matches versions that do not contain the vulnerable function.