Zero Radar
← feed
HighVulnerabilityCVE-2026-116591updated 27 Oct 2026, 15:38 UTC

Go zstd decompressor can be crashed by a crafted compressed file

A specially crafted compressed file can make a Go program that unpacks zstd data crash instead of rejecting the file. Anything that accepts zstd input from outside can be knocked offline this way.

Fix availableOfficial, 2 sources
SeverityHighCVSS 8.7 of 10
Being exploited?UnclearNo reports either way yet
Fix available?Yesgithub.com/klauspost/compress/zstd 1.20.2 · since 27 Oct 2026
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Attacker crafts fileTwo-block zstd frame, about 27 KB
  2. 2Sent to applicationUploaded or received as input
  3. 3Go decoder reads itDecodeAll or streaming decoder
  4. 4Invalid table reusedWrapped count leaves stale state
  5. 5Program panicsOut-of-range index, process crashes
  6. ResultApplication crashes on untrusted input

What happened

In the Go library klauspost/compress, the zstd decoder (DecodeAll and streaming paths) panics with an out-of-range index when a crafted two-block frame causes an FSE table with a wrapped count of -32768 to be built on stale state from the previous block, instead of returning a decode error.

Why it is dangerous: Any service or tool that decompresses untrusted zstd input can be made to crash (denial of service), which can take down the application or its worker process.

Are you affected?

You are affected if your Go application uses github.com/klauspost/compress/zstd at version 1.20.1 or earlier to decompress zstd data from untrusted sources.

Package / productAffected versionsFixed in
github.com/klauspost/compress/zstd · go<= 1.20.11.20.2

What to do

  1. Update github.com/klauspost/compress to 1.20.2 or later (go get github.com/klauspost/compress@v1.20.2)
  2. Rebuild and redeploy services that decompress zstd input
  3. If you cannot update right away, restrict or validate zstd input from untrusted sources

Timeline

  1. 26 Oct 2026, 22:16 UTC
    Publicly disclosed
  2. 26 Oct 2026, 22:16 UTC
    Reported by NVD · NVD
  3. 26 Oct 2026, 22:19 UTC
    Picked up by Zero Radar
  4. 27 Oct 2026, 15:38 UTC
    GitHub Advisory reported on it · GitHub Advisory
  5. 27 Oct 2026, 15:38 UTC
    Fixed version published: github.com/klauspost/compress/zstd 1.20.2 · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-116591 · GHSA-fpmh-frq8-7rj8
CVSS
8.7 / 10
EPSS
0.3% chance of exploitation within 30 days
Disclosed
26 Oct 2026, 22:16 UTC
On Zero Radar
26 Oct 2026, 22:19 UTC (3 min after disclosure)
Last change
27 Oct 2026, 15:38 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Go zstd decompressor can be crashed by a crafted compressed file · Zero Radar