CVE-2026-63209: 
cAdvisor vulnerability analysis and mitigation

CVE-2026-63209 is a signed integer overflow vulnerability in the s2.NewDict() function of the klauspost/compress Go library (package compress/s2), which can lead to an out-of-bounds memory access and process crash (SIGSEGV). It affects all versions of klauspost/compress up to and including v1.18.6, and was disclosed on June 30, 2026 by researcher Christopher Linke (celinke97). The vulnerability was published to NVD on September 29, 2026, and patched in v1.18.7. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Microsoft MSRC).

The root cause is a signed integer overflow (CWE-190) in s2.NewDict(), where a uvarint value read from attacker-supplied dictionary data is cast directly to a signed int without first validating that it does not exceed MaxInt64. When a value exceeding MaxInt64 (e.g., 12687765596934209639) is supplied, the cast produces a large negative number stored in d.repeat; because a negative value is never greater than a positive slice length, the bounds check is bypassed. When Dict.Encode() is subsequently called on data of at least 32 bytes, the negative repeat value causes arithmetic overflow in encodeBlockDictGo(), producing a negative index that is then dereferenced via unsafe.Pointer arithmetic in load32() without bounds checking (CWE-787), resulting in a SIGSEGV crash. A public proof-of-concept is included in the GitHub Security Advisory (GitHub Advisory).

Successful exploitation results in an immediate process crash (Denial of Service) with no impact on confidentiality or integrity. Any application that accepts user-supplied S2 dictionary data via s2.NewDict() and subsequently calls Dict.Encode() on data of 32 bytes or more is vulnerable. Because the attack requires no authentication or user interaction and is network-reachable, it can be used to reliably crash affected services, potentially causing sustained outages in systems that depend on the compress library (GitHub Advisory).

A public proof-of-concept is included in the GitHub Security Advisory and demonstrates reliable process termination with a crafted dictionary payload. There is no evidence of in-the-wild exploitation or threat actor attribution at this time, and the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is approximately 0.365%, reflecting low but non-negligible exploitation probability. The NVD SSVC assessment classifies the vulnerability as automatable with partial technical impact (GitHub Advisory, Feedly).

1. Identify target: Locate applications that accept user-supplied S2 dictionary data and use the klauspost/compress library at version ≤ v1.18.6 — for example, services exposing a compression API endpoint.
2. Craft malicious dictionary: Construct a byte slice where the first bytes encode a uvarint value exceeding MaxInt64 (e.g., 12687765596934209639 encoded with binary.PutUvarint), followed by at least 16 bytes of padding to meet the minimum dictionary size.
3. Submit dictionary to target: Supply the crafted dictionary data to the application in a way that causes it to call s2.NewDict() — for example, via an HTTP request body, file upload, or API parameter that accepts dictionary-compressed data.
4. Trigger encoding: Ensure the application subsequently calls Dict.Encode() on any source data of at least 32 bytes using the returned (non-nil) dict object. The overflowed negative repeat value causes arithmetic underflow in encodeBlockDictGo(), producing a negative index.
5. Achieve crash: The load32() function dereferences the negative index via unsafe.Pointer arithmetic, triggering a SIGSEGV and crashing the process, resulting in a Denial of Service (GitHub Advisory).

• Process: Unexpected process termination with signal SIGSEGV (signal 11) in any Go application using github.com/klauspost/compress/s2; crash stack traces referencing s2.(*Dict).Encode, encodeBlockDictGo, or load32 functions.
• Logs: Application error logs showing panic or fatal signal entries originating from the compress/s2 package; repeated service restarts or watchdog-triggered restarts in process supervisors (e.g., systemd, Kubernetes pod restarts).
• Network: Unusual or malformed requests containing binary-encoded dictionary payloads with leading bytes that decode to uvarint values near or exceeding 9223372036854775807 (MaxInt64); repeated requests to compression-related API endpoints from the same source IP (GitHub Advisory).

Upgrade github.com/klauspost/compress to version v1.18.7 or later, which adds a validation check to reject uvarint values exceeding MaxInt64 before casting to int in s2.NewDict() (GitHub Release). If immediate patching is not feasible, restrict dictionary processing to trusted sources only, or implement application-level input validation to reject dictionaries whose first uvarint-encoded value exceeds math.MaxInt64. Downstream consumers such as SUSE, openSUSE, and HashiCorp Consul have also released updated packages incorporating the fix (GitHub Advisory).

The vulnerability was reported by researcher Christopher Linke (GitHub: celinke97) and acknowledged by the klauspost/compress maintainer, who released v1.18.7 as a dedicated security-only release. Downstream Linux distributions including SUSE and openSUSE issued security advisories and updated packages. The vulnerability also received coverage in Linux security roundups and was picked up by Tenable Nessus detection plugins (IDs 358378, 364128, 364342). No significant social media controversy or broader industry debate has been observed (GitHub Advisory, GitHub Release).