CVE-2026-116591: 
cAdvisor Schwachstellenanalyse und -minderung

CVE-2026-116591 is a Denial of Service vulnerability in the klauspost/compress Go library's zstd decoder, dubbed "Panic on two-block frames." A crafted ~27 KB two-block zstd frame causes both the DecodeAll and streaming decoder paths to panic with an out-of-range slice index rather than returning a decode error, crashing any application that decompresses untrusted zstd input. All versions up to and including v1.20.1 are affected; the issue is fixed in v1.20.2. It carries a CVSS v3.1 score of 7.5 (High) and a CVSS v4.0 score of 8.7 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is an integer overflow (CWE-190) combined with an out-of-bounds read (CWE-125) in the FSE decoder used by huff0.ReadTable. Three conditions must hold simultaneously: (1) readNCount permits a tableLog up to 15, allowing a normalized count of 32768 (2^15), which is stored in an int16 and wraps to −32768 — passing int32-based validation checks; (2) buildDtable treats −32768 as neither a low-probability symbol (−1) nor a valid positive count, so the spread loop runs zero times and the decode table is left empty without error; (3) huff0 shares a single fse.Scratch across blocks without clearing it, so stale decode-table state from block 1 persists into block 2. When nextFast processes a cell with nbBits == 0 from the stale table, it reads 16 junk bits into the state and indexes past the end of the 32768-entry table, triggering panic: runtime error: index out of range [33077] with length 32768. The streaming decoder panics on its own goroutine, making the panic unrecoverable by callers (GitHub Advisory, Fix Commit).

Successful exploitation results in an unrecoverable application crash (panic) in any Go program using klauspost/compress for zstd decompression, constituting a complete availability impact with no confidentiality or integrity loss. Because the streaming decoder panics on a separate goroutine, callers cannot guard against it with standard Go error handling, making the denial-of-service condition reliable and unavoidable for affected applications. Any networked service that accepts and decompresses user-supplied zstd data — such as databases, message queues, blockchain nodes, or API gateways — is at risk of being crashed by a single malicious ~27 KB payload (GitHub Advisory).

A functional proof-of-concept (PoC) Go test function is publicly available in the GitHub Security Advisory, demonstrating the panic with a self-contained crafted payload (GitHub Advisory). The vulnerability requires no authentication, no privileges, and no user interaction, and is classified as automatable by NVD SSVC. There is no evidence of in-the-wild exploitation at this time, and it is not listed in the CISA KEV catalog. The EPSS score is approximately 0.33% (26th percentile), reflecting low but non-negligible exploitation probability (GitHub Advisory).

1. Identify targets: Enumerate internet-facing services or applications built with Go that use github.com/klauspost/compress versions ≤ v1.20.1 for zstd decompression (e.g., via dependency scanning, Shodan, or reviewing open-source project dependency files).
2. Craft the malicious payload: Construct a ~27 KB two-block zstd frame where the second block's FSE-compressed Huffman-weight table encodes a normalized count of 32768 at tableLog 15. The public PoC provides the exact byte sequence using slices.Concat with specific byte patterns (GitHub Advisory).
3. Deliver the payload: Submit the crafted zstd frame to any endpoint that passes it to DecodeAll or the streaming decoder — for example, an HTTP upload endpoint, a message queue consumer, a network protocol handler, or a file processing pipeline.
4. Trigger the panic: The decoder processes block 1 (populating fse.Scratch), then processes block 2 with the malformed count. The stale state causes nextFast to index out of bounds, triggering an unrecoverable panic that crashes the application or goroutine.
5. Achieve denial of service: The target application crashes. If the service auto-restarts, the attack can be repeated to maintain a persistent denial-of-service condition (GitHub Advisory, Fix Commit).

• Logs: Go runtime panic messages in application logs containing panic: runtime error: index out of range [N] with length 32768 originating from fse/decompress.go (specifically fse.(*decoder).nextFast) or huff0/decompress.go.
• Logs: Stack traces referencing github.com/klauspost/compress/fse.(*Scratch).decompress, huff0.ReadTable, zstd.(*blockDec).decodeLiterals, or zstd.(*Decoder).DecodeAll in crash reports.
• Network: Inbound requests delivering ~27 KB zstd-compressed payloads to decompression endpoints, particularly payloads that do not decompress successfully with the reference zstd implementation.
• Process: Unexpected application process terminations or goroutine crashes in Go services that handle zstd-compressed input, especially if correlated with specific client connections or message deliveries.

The primary remediation is to upgrade github.com/klauspost/compress to v1.20.2 or later, which rejects FSE normalized counts exceeding math.MaxInt16 in readNCount and enforces the RFC 8878 limit of tableLog ≤ 6 for Huffman-weight tables in huff0.ReadTable (v1.20.2 Release, Fix Commit). If immediate patching is not possible, consider isolating zstd decompression to a separate process with resource limits and automatic restart, implementing input size or rate limiting on zstd decompression endpoints, and validating that zstd input is well-formed before passing it to the library. Red Hat has also tracked this issue and downstream packages should be updated as vendor advisories become available (Red Hat Bugzilla).

The vulnerability was reported to the klauspost/compress maintainer by researchers from Ava Labs (joshua-kim as reporter, StephenButtolph as coordinator, Morris-be as finder, chriselbring-avalabs as analyst), indicating it was discovered during security review of blockchain infrastructure that depends on the library (GitHub Advisory). Red Hat tracked the issue with high severity and assigned it to their Product Security DevOps Team, with a large CC list indicating broad downstream impact across Red Hat products (Red Hat Bugzilla). Microsoft also published an advisory for the CVE, suggesting impact on Microsoft products or services using the affected Go library (GitHub Advisory).