# CVE-2026-63209: klauspost compress signed integer overflow in s2.NewDict

Source: https://junglewise.ai/threats/cve-2026-63209-compress-provides-various-compression-algorithms-prior-to-version  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-29. Updated: 2026-09-29  
License: CC BY 4.0 with a link back

CVE-2026-63209 · Severity: high · CVSS 7.5 · Published 2026-09-29

The compress library provides data compression algorithms used by applications to reduce file and network data sizes. A signed integer overflow vulnerability in the s2 compression format allows an attacker to crash an application by supplying a malicious dictionary that triggers an out-of-bounds memory access when encoding data. This results in denial of service via process crash.

Technologies: [github.com/klauspost/compress (Go)](https://junglewise.ai/threats/technologies/github-com-klauspost-compress). Vendors: [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-63209 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-63209 being exploited in the wild.

**How severe is CVE-2026-63209?** High severity, with a CVSS score of 7.5, published 29 September 2026.

**Which products and versions are affected?** github.com/klauspost/compress (Go) <= 1.18.6, SEMVER:introduced=0,fixed=1.18.7; Klauspost Compress before 1.18.7.

**Is there a fix for CVE-2026-63209?** Yes. github.com/klauspost/compress (Go): upgrade to 1.18.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-63209 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-63209?** Check whether you run github.com/klauspost/compress (Go) or Klauspost Compress at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/klauspost/compress (Go): upgrade to 1.18.7 or later

  ```sh
  go get github.com/klauspost/compress@v1.18.7
  ```


## Technical details

A signed integer overflow in s2.NewDict() allows bypass of repeat index validation when a uvarint-encoded repeat value exceeds MaxInt64. The overflowed negative repeat value subsequently causes an out-of-bounds memory access via unsafe.Pointer arithmetic in Dict.Encode(), resulting in SIGSEGV. The vulnerability requires attacker-controlled dictionary input and is patched in version 1.18.7.

## Affected products

- klauspost compress before 1.18.7

## Identifiers

- CVE-2026-63209
- GHSA-259r-337f-4rfw
- GO-2026-5841

## Timeline

- 2026-09-29: disclosed
- 2026-06-30: patched: version 1.18.7 released

## References

- [https://github.com/klauspost/compress/commit/539243b8823ee8f03e49969823d57c348c917536](https://github.com/klauspost/compress/commit/539243b8823ee8f03e49969823d57c348c917536)
- [https://github.com/klauspost/compress/releases/tag/v1.18.7](https://github.com/klauspost/compress/releases/tag/v1.18.7)

## Related threats

- [Klaus Post compress zstd decoder panic on crafted input](https://junglewise.ai/threats/cve-2026-116591-compress-provides-various-compression-algorithms-prior-to-1-20-2)
- [GO-2026-5841 - OOB read in github.com/klauspost/compress/s2](https://junglewise.ai/threats/go-2026-5841-oob-read-in-github-com-klauspost-compress-s2-bc43eef4)