CVE-2026-116591
Published: October 30, 2026Last modified: November 9, 2026
Description
compress provides various compression algorithms. Prior to 1.20.2, the zstd DecodeAll and streaming decoder paths can panic when a crafted two-block frame reaches huff0.ReadTable with an FSE normalized count of 32768 that readNCount stores in int16 as -32768. The wrapped count allows buildDtable to retain stale fse.Scratch decode-table state from the prior block, and nextFast then derives an out-of-range state and indexes beyond the table instead of returning a decode error. Both blocks are required to preserve and then reuse the stale state, allowing untrusted zstd input to crash an application. This issue is fixed in version 1.20.2.
Status
| Product | Release | Package | Status |
|---|---|---|---|
| Alpaquita Linux | 23 LTS | buildah | Unknown (1.28.0-r1) |
| containerd | Unknown (1.6.10-r0) | ||
| docker | Unknown (20.10.21-r1) | ||
| podman | Unknown (4.3.1-r0) | ||
| skopeo | Unknown (1.10.0-r2) | ||
| 25 LTS | buildah | Unknown (1.40.0-r0) | |
| containerd | Unknown (2.1.1-r0) | ||
| docker | Unknown (28.2.1-r0) | ||
| docker-cli-buildx | Unknown (0.24.0-r0) | ||
| etcd | Unknown (3.6.4-r6) | ||
| grype | Unknown (0.114.0-r14) | ||
| helm | Unknown (3.19.0-r4) | ||
| osv-scanner | Unknown (2.1.0-r4) | ||
| podman | Unknown (5.5.0-r0) | ||
| skopeo | Unknown (1.18.0-r2) | ||
| Stream | buildah | Unknown (1.31.0-r0) | |
| containerd | Unknown (1.7.2-r1) | ||
| docker | Fixed (29.9.3-r0) | ||
| docker-cli-buildx | Unknown (0.11.0-r0) | ||
| etcd | Unknown (3.6.4-r6) | ||
| grype | Unknown (0.100.0-r0) | ||
| helm | Unknown (3.19.0-r4) | ||
| osv-scanner | Unknown (2.1.0-r2) | ||
| podman | Unknown (4.5.1-r1) | ||
| skopeo | Unknown (1.13.0-r1) |