Is CVE-2026-116591 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-116591 being exploited in the wild.

How severe is CVE-2026-116591?

High severity, with a CVSS score of 4, published 26 October 2026.

Which products and versions are affected?

github.com/klauspost/compress (Go) SEMVER:introduced=0,fixed=1.20.2; github.com/klauspost/compress/zstd (Go) <= 1.20.1, SEMVER:introduced=0,fixed=1.20.2; Klaus Post Compress prior to 1.20.2.

Is there a fix for CVE-2026-116591?

Yes. github.com/klauspost/compress (Go): upgrade to 1.20.2 or later; github.com/klauspost/compress/zstd (Go): upgrade to 1.20.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-116591 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-116591?

Check whether you run github.com/klauspost/compress (Go), github.com/klauspost/compress/zstd (Go) or Klaus Post Compress at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-116591: Klaus Post compress zstd decoder panic on crafted input

Q: Is there a fix for CVE-2026-116591?

Yes. github.com/klauspost/compress (Go): upgrade to 1.20.2 or later; github.com/klauspost/compress/zstd (Go): upgrade to 1.20.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-116591 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-116591?

Check whether you run github.com/klauspost/compress (Go), github.com/klauspost/compress/zstd (Go) or Klaus Post Compress at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-116591 · Severity: high · CVSS 4 · Published 2026-10-26

The compress library provides data compression algorithms used by Go applications. A specially crafted zstd-compressed file can crash applications using the decoder, causing a denial of service. An attacker could exploit this by sending malicious compressed data to any application that decompresses untrusted zstd streams.

Technologies: github.com/klauspost/compress (Go). Vendors: Go.

Quick answers

Is CVE-2026-116591 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-116591 being exploited in the wild.
How severe is CVE-2026-116591?: High severity, with a CVSS score of 4, published 26 October 2026.
Which products and versions are affected?: github.com/klauspost/compress (Go) SEMVER:introduced=0,fixed=1.20.2; github.com/klauspost/compress/zstd (Go) <= 1.20.1, SEMVER:introduced=0,fixed=1.20.2; Klaus Post Compress prior to 1.20.2.
Is there a fix for CVE-2026-116591?: Yes. github.com/klauspost/compress (Go): upgrade to 1.20.2 or later; github.com/klauspost/compress/zstd (Go): upgrade to 1.20.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-116591 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-116591?: Check whether you run github.com/klauspost/compress (Go), github.com/klauspost/compress/zstd (Go) or Klaus Post Compress at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/klauspost/compress (Go): upgrade to 1.20.2 or later
```
go get github.com/klauspost/compress@v1.20.2
```
github.com/klauspost/compress/zstd (Go): upgrade to 1.20.2 or later
```
go get github.com/klauspost/compress/zstd@v1.20.2
```

Technical details

The zstd DecodeAll and streaming decoder paths panic when processing a crafted two-block frame where the first block poisons the Huffman table state via an FSE normalized count of 32768 stored as -32768 in int16, and the second block reuses this stale state to derive an out-of-range index. This requires both blocks in sequence and impacts the huff0.ReadTable component. An attacker with ability to provide untrusted zstd input can trigger an unrecoverable panic.

Affected products

Klaus Post compress prior to 1.20.2

Identifiers

CVE-2026-116591
GHSA-fpmh-frq8-7rj8
GO-2026-6865

Timeline

2026-10-26: disclosed
2026-10-12: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.