CVE-2026-116591 in compress
Summary
by MITRE • 10/27/2026
compress provides various compression algorithms. Prior to 1.20.2, the zstd DecodeAll and streaming decoder paths can panic when a crafted two-block frame reaches huff0.ReadTable with an FSE normalized count of 32768 that readNCount stores in int16 as -32768. The wrapped count allows buildDtable to retain stale fse.Scratch decode-table state from the prior block, and nextFast then derives an out-of-range state and indexes beyond the table instead of returning a decode error. Both blocks are required to preserve and then reuse the stale state, allowing untrusted zstd input to crash an application. This issue is fixed in version 1.20.2.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/27/2026
The compress library provides various compression algorithms including support for the Zstandard format which has become widely adopted due to its high performance and efficiency. In versions prior to 1.20.2 a critical vulnerability exists within the zstd decoding implementation specifically affecting both the DecodeAll function and streaming decoder paths. This flaw allows an attacker who can supply crafted input data to cause a denial of service by triggering a panic in the application processing the compressed stream. The root cause lies in how the library handles frame structures containing multiple blocks particularly when specific malformed parameters are present within those blocks.
The technical flaw originates during the parsing of Huffman tables within the zstd format specification. When decoding a crafted two-block frame, the huff0.ReadTable function processes an FSE normalized count value of 32768. This integer is stored in an int16 variable which results in an overflow condition where the value wraps around to -32768 due to signed integer representation limits. This wrapped negative count bypasses expected validation checks that would normally reject such malformed data structures. Consequently, the subsequent buildDtable function retains stale state from a previous decode table operation rather than initializing fresh and correct decoding parameters for the current block.
This retention of stale state creates an exploitable condition where the nextFast decoder routine derives an out-of-range internal state value. Instead of detecting this invalid configuration and returning a proper decode error as intended by the specification, the code proceeds to use this corrupted state to index into lookup tables beyond their allocated bounds. This out-of-bounds access leads directly to memory corruption or illegal instruction execution resulting in a runtime panic that crashes the application. The vulnerability requires two specific blocks within the frame structure to function correctly with one block preserving invalid state and the second block reusing it, making exploitation dependent on precise crafting of the compressed input stream.
From an industry standards perspective this issue aligns closely with CWE-120 Buffer Copy without Checking Size of Input which describes situations where data is copied into a buffer without verifying that the size fits within the allocated memory space although in this specific case the manifestation is through logical state corruption leading to out-of-bounds access rather than simple buffer overflow. Additionally it relates to CWE-682 Incorrect Calculation as the integer wrapping and subsequent logic errors stem from miscalculations regarding data structure constraints and bounds checking during decoding operations. In terms of adversarial tactics this vulnerability supports techniques associated with ATT&CK T1499 Endpoint Denial of Service where attackers aim to disrupt availability by exhausting resources or crashing services through malformed inputs rather than gaining unauthorized access or executing arbitrary code directly though the crash itself constitutes a significant service disruption risk especially for long-running servers processing untrusted compressed data.
The operational impact of this vulnerability is primarily focused on denial of service scenarios affecting any application that utilizes the affected compress library version to decompress user-supplied zstd streams. Services such as web servers accepting file uploads database systems storing compressed logs or message queues handling serialized payloads are particularly at risk if they do not implement strict input validation prior to passing data to the decoder. An attacker can craft a small but specifically structured two-block frame that triggers the panic condition reliably causing immediate termination of the processing thread or process depending on how panics are handled by the surrounding runtime environment. This leads to service unavailability and potential cascading failures in distributed systems relying on consistent availability from affected components.
Mitigation strategies center primarily on upgrading to version 1.20.2 or later where this integer overflow and subsequent state corruption issue has been resolved through improved validation of normalized counts and stricter bounds checking during table construction. Organizations should audit their dependency trees for usage of the compress library and apply patches promptly given that many downstream projects may depend on it transitively without explicit awareness of its direct exposure to untrusted input. Additionally implementing defense-in-depth measures such as running decompression operations in isolated processes with limited privileges can reduce the blast radius if a vulnerability is encountered before patching occurs. Input validation layers should also be considered for applications processing external compressed data ensuring that only expected and validated streams are passed to internal decoding functions thereby adding an extra layer of protection against malformed input attacks.