High · 8.7 CVE-2026-116591 EUVD-2026-110497GHSA-fpmh-frq8-7rj8GO-2026-6865

compress zstd: Panic on two-block frames

Published Oct 26, 2026 · Updated Oct 27, 2026 · Assigned by GitHub_M

Vendor: klauspost Product: compress Package: amazon-cloudwatch-agent Package: argo-events Package: argo-workflow-controller-4.0 Package: argo-workflows-3.7 Package: argocd-image-updater Package: atlantis Package: aws-otel-collector Package: azcopy Package: azl-otel-collector Package: azurelinux-image-tools Package: bento Package: bom Package: buildah Package: caddy Package: cadvisor Package: calico-cni-3.32 Package: cert-manager Package: cloudprober Package: conftest Package: containerd-1 Package: containerd-2 Package: containerd-2.3 Package: containerd-2.4 Package: containerd-shim-runc-v2-1 Package: containerd-stress-1 Package: containerd-stress-2 Package: containerd-stress-2.3 Package: containerd-stress-2.4 Package: containerd2 Package: containerized-data-importer Package: coredns Package: cortex Package: cosign-3 Package: crane Package: crane-cov Package: cri-o Package: crossplane-2.2 Package: crossplane-2.2-crank Package: ctr-1 Package: ctr-2 Package: ctr-2.3 Package: ctr-2.4 Package: dagdotdev Package: dagger Package: dapr-daprd-1.17 Package: datadog-agent-7.78 Package: datadog-agent-7.78-fakeintake Package: datadog-agent-7.78-full Package: datadog-agent-7.79 Package: datadog-agent-7.79-fakeintake Package: datadog-agent-7.79-full Package: datadog-agent-7.80 Package: datadog-agent-7.80-fakeintake Package: datadog-agent-7.80-full Package: datadog-agent-7.81 Package: datadog-agent-7.81-fakeintake Package: datadog-agent-7.81-full Package: datadog-cluster-agent-7.78 Package: datadog-cluster-agent-7.79 Package: datadog-cluster-agent-7.80 Package: datadog-cluster-agent-7.81 Package: datadog-operator Package: dbmate Package: dgraph Package: distribution Package: dive Package: dkron-executor-kafka Package: docker Package: docker-buildx Package: docker-cli Package: docker-compose Package: docker-compose Package: dockerd-28 Package: dogstatsd-7.78 Package: dogstatsd-7.79 Package: dogstatsd-7.80 Package: dogstatsd-7.81 Package: eksctl Package: etcd-3.6 Package: falco-no-driver Package: falcoctl Package: falcosidekick Package: ferretdb Package: flux-2.10 Package: flux-2.7 Package: flux-2.8 Package: flux-2.9 Package: flux-image-reflector-controller Package: flux-source-controller Package: flyte Package: gatus Package: gh Package: git-lfs Package: gitea Package: github.com/klauspost/compress Package: github.com/klauspost/compress/zstd Package: gitlab-kas-19.3 Package: gitlab-runner-19.3 Package: gitlab-runner-helper-19.3 Package: gitleaks Package: gitsign Package: golang-github-klauspost-compress Package: golang-github-klauspost-compress Package: gomplate-5 Package: grafana-12.3 Package: grafana-12.4 Package: grafana-13.0 Package: grafana-alloy Package: grafana-mimir-3.0 Package: grafana-mimir-3.0-mimirtool-3.0 Package: grafana-mimir-3.1 Package: grafana-mimir-3.1-mimirtool-3.1 Package: grafana-mimir-3.1-query-tee-3.1 Package: grafana-pyroscope-1.19 Package: grafana-pyroscope-2.0 Package: guac Package: guacingest Package: guacone Package: harbor-registry Package: harbor-scanner-trivy Package: incert Package: influxdb Package: ipfs-cluster Package: istio-pilot-agent-1.29 Package: istio-pilot-discovery-1.29 Package: jitsucom-bulker-bulker Package: jitsucom-bulker-ingest Package: jitsucom-bulker-sidecar Package: jitsucom-bulker-syncctl Package: juicefs-1.3 Package: k3d Package: k3s-1.32 Package: k3s-1.34 Package: k3s-1.35 Package: k3s-1.36 Package: k3s-1.37 Package: k3s-multicall-1.32 Package: k3s-multicall-1.34 Package: k3s-multicall-1.35 Package: k3s-multicall-1.36 Package: k3s-static-1.32 Package: k3s-static-1.34 Package: k3s-static-1.35 Package: k3s-static-1.36 Package: k6 Package: k9s Package: kaf Package: kafka_exporter Package: kaniko Package: kaniko-warmer Package: kata-containers Package: kata-containers-cc Package: kata-containers-preview Package: katib-controller Package: kbld Package: keda Package: keda-2.19 Package: keda-2.19-metrics-apiserver Package: keda-2.20 Package: keda-2.20-metrics-apiserver Package: knative-serving-1.21-controller Package: knative-serving-1.22-controller Package: ko Package: kpt Package: krane Package: kserve-agent Package: kubeflow-pipelines-apiserver Package: kubeflow-pipelines-cache_server Package: kubeflow-pipelines-persistence_agent Package: kubeflow-pipelines-scheduledworkflow Package: kubernetes Package: kubernetes-event-exporter Package: kubescape Package: kubescape-operator Package: kubevela-vela-cli Package: kubevela-vela-core Package: kubevirt-openvmm Package: kubewatch Package: kwokctl Package: kyverno-1.17 Package: kyverno-1.18 Package: kyverno-background-controller-1.17 Package: kyverno-background-controller-1.18 Package: kyverno-cleanup-controller-1.17 Package: kyverno-cleanup-controller-1.18 Package: kyverno-cli-1.17 Package: kyverno-cli-1.18 Package: kyverno-init-container-1.17 Package: kyverno-init-container-1.18 Package: kyverno-notation-aws Package: kyverno-policy-reporter-kyverno-plugin Package: kyverno-reports-controller-1.17 Package: kyverno-reports-controller-1.18 Package: libcontainers-common Package: local-path-provisioner Package: loki-3.6 Package: loki-3.6-logcli Package: loki-3.6-loki-canary Package: loki-3.6-promtail Package: loki-3.7 Package: loki-3.7-logcli Package: loki-3.7-loki-canary Package: manifest-tool Package: mariadb-operator Package: mattermost-11.5 Package: mattermost-11.6 Package: mattermost-11.7 Package: mc Package: migrate Package: minio Package: minio-object-browser Package: moby-containerd-cc Package: moby-engine Package: neuvector-scanner Package: neuvector-scanner-task Package: newrelic-fluent-bit-output Package: nfpm Package: nri-kafka Package: nri-kafka-jdk11 Package: nuclei Package: op-geth Package: op-geth-abigen Package: op-geth-clef Package: op-geth-devp2p Package: op-geth-evm Package: opa Package: opa Package: opa-envoy Package: opencost Package: opentofu-1.11 Package: opentofu-1.12 Package: opentofu-1.9 Package: osv-scanner Package: osv-scanner-reporter Package: packer Package: paranoia Package: percona-server-mongodb-operator Package: percona-server-mongodb-operator-mongodb-healthcheck Package: podman Package: podman-6.0 Package: policy-controller Package: policy-controller-tester Package: prometheus-3.11 Package: prometheus-3.12 Package: prometheus-alertmanager Package: prometheus-operator Package: promxy Package: pulumi Package: pulumi-kubernetes-operator Package: pulumi-language-dotnet Package: pulumi-language-go Package: pulumi-language-java Package: pulumi-language-nodejs Package: pulumi-language-python Package: pulumi-language-yaml Package: rancher-fleet-agent Package: rancher-fleet-cli Package: rancher-fleet-controller Package: rclone Package: restic Package: scorecard Package: sftpgo Package: skaffold Package: skopeo Package: skopeo Package: slsa-verifier Package: spegel Package: spire-agent Package: spire-server Package: sql_exporter Package: steampipe Package: step Package: step-ca Package: tailscale Package: tailscale-k8s-operator Package: task Package: tekton-chains Package: tekton-pipelines-controller-1.12 Package: tekton-pipelines-controller-1.13 Package: tekton-pipelines-resolvers-1.12 Package: tekton-pipelines-resolvers-1.13 Package: telegraf Package: telegraf-1.38 Package: tempo-2.10 Package: tempo-2.10-cli Package: tempo-2.10-vulture Package: tempo-3.0 Package: tempo-3.0-cli Package: tempo-3.0-vulture Package: terraform Package: terraform-provider-pagerduty Package: terragrunt Package: tfsec Package: thanos Package: timoni Package: tkn Package: traefik-3.6 Package: trivy Package: trivy-operator Package: umoci Package: undock Package: vault-secrets-webhook Package: vcluster Package: vcluster-cli Package: vcluster-syncer Package: velero Package: vendir Package: verticadb-operator Package: vexctl Package: victoriametrics Package: victoriametrics-operator Package: victoriametrics-operator-config-reloader Package: victoriametrics-vmagent Package: victoriametrics-vmagent-cluster Package: victoriametrics-vmalert Package: victoriametrics-vmalert-cluster Package: victoriametrics-vmauth Package: victoriametrics-vminsert-cluster Package: victoriametrics-vmselect-cluster Package: victoriametrics-vmstorage-cluster Package: vitess Package: vitess-23 Package: vitess-23-binaries Package: vitess-24 Package: vitess-24-binaries Package: wal-g-pg Package: weaviate Package: wgcf Package: witness Package: wolfictl Package: xeol Package: zarf Ecosystem: Alpine Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: Go Ecosystem: Ubuntu Ecosystem: Wolfi

Description

compress provides various compression algorithms. Prior to 1.20.2, the zstd DecodeAll and streaming decoder paths can panic when a crafted two-block frame reaches huff0.ReadTable with an FSE normalized count of 32768 that readNCount stores in int16 as -32768. The wrapped count allows buildDtable to retain stale fse.Scratch decode-table state from the prior block, and nextFast then derives an out-of-range state and indexes beyond the table instead of returning a decode error. Both blocks are required to preserve and then reuse the stale state, allowing untrusted zstd input to crash an application. This issue is fixed in version 1.20.2.

Affected products

Vendor	Product	Affected	Fixed
klauspost	compress	< 1.20.2	—

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	golang-github-klauspost-compress	1.20.3+ds1-1	—
Debian 13	golang-github-klauspost-compress	No fix yet	—
Debian 12	golang-github-klauspost-compress	No fix yet	—

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu 26.10	golang-github-klauspost-compress	No fix yet	—
Ubuntu 26.04 LTS	golang-github-klauspost-compress	No fix yet	—
Ubuntu 24.04 LTS	golang-github-klauspost-compress	No fix yet	—
Ubuntu 22.04 LTS	golang-github-klauspost-compress	No fix yet	—
Ubuntu 20.04 LTS	golang-github-klauspost-compress	No fix yet	—

Show 2 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Ubuntu 18.04 LTS	golang-github-klauspost-compress	No fix yet	—
Ubuntu 16.04 LTS	golang-github-klauspost-compress	No fix yet	—

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
RHEL 10	grafana +1	12.4.3-3.el10_3.6	RHSA-2026:98639
RHEL 10	grafana-pcp	6.1.0-2.el10_3.3	RHSA-2026:98620
RHEL 9	grafana +1	10.2.6-24.el9_9.8	RHSA-2026:98541
RHEL 9	grafana-pcp	5.1.1-17.el9_9.4	RHSA-2026:99172
RHEL 8	grafana +1	9.2.10-38.el8_10	RHSA-2026:99030
RHEL 8	grafana-pcp	5.1.1-20.el8_10	RHSA-2026:99020

Show 3 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
RHEL 10.2 EUS	grafana +1	10.2.6-28.el10_2.11	RHSA-2026:99134
RHEL 10.2 EUS	grafana-pcp	5.3.0-8.el10_2.3	RHSA-2026:99171
RHEL 9.8 EUS	grafana +1	10.2.6-23.el9_8.10	RHSA-2026:99151
RHEL 9.8 EUS	grafana-pcp	5.1.1-17.el9_8.3	RHSA-2026:99152
Red Hat Hardened Images 1	buildah	2:1.46.0-1.hum1	RHSA-2026:88190
Red Hat Hardened Images 1	caddy	2.11.7-0.4.hum1	RHSA-2026:91480
Red Hat Hardened Images 1	cosign	3.1.4-0.2.hum1	RHSA-2026:91389
Red Hat Hardened Images 1	distribution	3.1.2-0.4.hum1	RHSA-2026:91378
Red Hat Hardened Images 1	git-lfs	3.8.1-0.2.hum1	RHSA-2026:91645
Red Hat Hardened Images 1	grafana12.4	12.4.13-0.6.hum1	RHSA-2026:93601
Red Hat Hardened Images 1	grafana13.1	13.1.8-0.6.hum1	RHSA-2026:93608
Red Hat Hardened Images 1	grafana13.2	13.2.4-0.6.hum1	RHSA-2026:94794
Red Hat Hardened Images 1	grype	0.121.0-0.3.hum1	RHSA-2026:91643
Red Hat Hardened Images 1	jaeger	2.21.0-0.3.hum1	RHSA-2026:91444
Red Hat Hardened Images 1	k6v1	1.8.2-0.3.hum1	RHSA-2026:91401
Red Hat Hardened Images 1	k6v2	2.3.0-0.4.hum1	RHSA-2026:91412
Red Hat Hardened Images 1	loki3.6 +2	3.6.19-0.3.hum1	RHSA-2026:95617
Red Hat Hardened Images 1	loki3.7 +2	3.7.9-0.2.hum1	RHSA-2026:91665
Red Hat Hardened Images 1	opentelemetry-collector +1	0.164.0-0.1.hum1	RHSA-2026:91393, RHSA-2026:90991
Red Hat Hardened Images 1	opentelemetry-collector-k8s	0.163.2-0.1.hum1	RHSA-2026:88185
Red Hat Hardened Images 1	opentofu1.12	1.12.9-0.2.hum1	RHSA-2026:92903, RHSA-2026:91647
Red Hat Hardened Images 1	podman +4	5:6.1.4-1.2.hum1	RHSA-2026:91385
Red Hat Hardened Images 1	prometheus3.13	3.13.5-0.2.hum1	RHSA-2026:91483
Red Hat Hardened Images 1	skopeo +1	1:1.24.1-1.3.hum1	RHSA-2026:91368
Red Hat Hardened Images 1	spire1.14 +3	1.14.9-0.3.hum1	RHSA-2026:91460
Red Hat Hardened Images 1	spire1.15 +3	1.15.5-0.3.hum1	RHSA-2026:91462
Red Hat Hardened Images 1	syft	1.55.0-0.3.hum1	RHSA-2026:91376
Red Hat Hardened Images 1	tempo2.10	2.10.9-0.2.hum1	RHSA-2026:95406
Red Hat Hardened Images 1	tempo3.0	3.0.4-0.3.hum1	RHSA-2026:91459
Red Hat Hardened Images 1	trivy	0.76.1-0.2.hum1	RHSA-2026:91471

AlmaLinux

Errata ↗

Release	Package	Fixed in	Advisory
AlmaLinux 8	grafana +1	9.2.10-38.el8_10	ALSA-2026:99030
AlmaLinux 8	grafana-pcp	5.1.1-20.el8_10	ALSA-2026:99020

Rocky Linux

Errata ↗

Release	Package	Fixed in	Advisory
Rocky Linux 10	grafana-pcp	6.1.0-2.el10_3.3	RLSA-2026:98620
Rocky Linux 9	grafana +1	10.2.6-24.el9_9.8	RLSA-2026:98541
Rocky Linux 8	grafana +1	9.2.10-38.el8_10	RLSA-2026:99030
Rocky Linux 8	grafana-pcp	5.1.1-20.el8_10	RLSA-2026:99020

SUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
SLES 15 SP7	aliyun-cli	3.5.2-150400.9.13.1	SUSE-SU-2026:5195-1
SLES 15 SP6	aliyun-cli	3.5.2-150400.9.13.1	SUSE-SU-2026:5195-1
SLES 15 SP5	aliyun-cli	3.5.2-150400.9.13.1	SUSE-SU-2026:5195-1

Show 2 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
SLES for SAP 16.0	aliyun-cli	3.5.2-160000.1.1	SUSE-SU-2026:24652-1
SLES 16.0	aliyun-cli	3.5.2-160000.1.1	SUSE-SU-2026:24652-1

openSUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
openSUSE Tumbleweed	aliyun-cli	3.5.2-2.1	openSUSE-SU-2026:12313-1
openSUSE Tumbleweed	amazon-cloudwatch-agent	1.300073.2-3.1	openSUSE-SU-2026:12340-1
openSUSE Tumbleweed	cadvisor	0.60.6-5.1	openSUSE-SU-2026:12317-1
openSUSE Tumbleweed	distribution	3.1.2-4.1	openSUSE-SU-2026:12318-1
openSUSE Tumbleweed	go-containerregistry	0.22.1-3.1	openSUSE-SU-2026:12323-1
openSUSE Tumbleweed	google-osconfig-agent	20261103.02-1.1	openSUSE-SU-2026:12430-1
openSUSE Tumbleweed	gopass	1.17.4-2.1	openSUSE-SU-2026:12530-1
openSUSE Tumbleweed	hauler	2.1.2-3.1	openSUSE-SU-2026:12325-1
openSUSE Tumbleweed	helm	4.3.1-3.1	openSUSE-SU-2026:12326-1
openSUSE Tumbleweed	helm3	3.22.1-2.1	openSUSE-SU-2026:12327-1
openSUSE Tumbleweed	syft	1.56.0-1.1	openSUSE-SU-2026:12479-1
openSUSE Leap 16.0	aliyun-cli	3.5.2-160000.1.1	openSUSE-SU-2026:22241-1
openSUSE Leap 16.0	cadvisor	0.60.6-bp160.4.1	openSUSE-SU-2026:22218-1
openSUSE Leap 16.0	go-containerregistry	0.22.1-bp160.1.1	openSUSE-SU-2026:22227-1
openSUSE Leap 16.0	hauler	2.1.2-bp160.2.1	openSUSE-SU-2026:22228-1

Alpine

Security tracker ↗

Release	Package	Fixed in	Advisory
Alpine v3.24	docker	29.9.3-r0	—

Amazon Linux

Release	Package	Fixed in	Advisory
Amazon Linux 2023	buildah	2:1.43.1-1.amzn2023.0.4	ALAS2023-2026-3451
Amazon Linux 2023	skopeo +1	2:1.22.2-1.amzn2023.0.4	ALAS2023-2026-3450

Azure Linux

Release	Package	Fixed in	Advisory
Azure Linux 3	gh +28	No fix yet	—

Oracle Linux

Release	Package	Fixed in	Advisory
Oracle Linux 8	grafana +1	9.2.10-38.0.1.el8_10	ELSA-2026-99030
Oracle Linux 8	grafana-pcp	5.1.1-20.el8_10	ELSA-2026-99020

Wolfi

Release	Package	Fixed in	Advisory
Wolfi rolling	amazon-cloudwatch-agent	1.300075.0-r0	—
Wolfi rolling	argo-events	1.9.11-r21	—
Wolfi rolling	argo-workflow-controller-4.0	4.0.15-r4	—
Wolfi rolling	argo-workflows-3.7	3.7.18-r15	—
Wolfi rolling	argocd-image-updater	1.4.0-r1	—
Wolfi rolling	atlantis	0.49.0-r1	—
Wolfi rolling	aws-otel-collector	0.51.0-r2	—
Wolfi rolling	azcopy	10.34.1-r2	—
Wolfi rolling	bento	1.22.0-r8	—
Wolfi rolling	bom	0.8.0-r5	—
Wolfi rolling	caddy	2.11.9-r1	—
Wolfi rolling	cadvisor	0.60.6-r8	—
Wolfi rolling	calico-cni-3.32	3.32.3-r2	—
Wolfi rolling	cloudprober	0.14.7-r2	—
Wolfi rolling	conftest	0.71.1-r6	—
Wolfi rolling	cortex	1.21.1-r23	—
Wolfi rolling	cosign-3	3.1.4-r3	—
Wolfi rolling	crane +2	0.22.1-r3	—
Wolfi rolling	crossplane-2.2 +1	2.2.7-r4	—
Wolfi rolling	ctr-1 +29	No fix yet	—
Wolfi rolling	ctr-2 +5	2.4.2-r6	—
Wolfi rolling	ctr-2.3 +2	2.3.7-r6	—
Wolfi rolling	dagdotdev	0.0.20-r36	—
Wolfi rolling	dagger	0.21.11-r2	—
Wolfi rolling	dapr-daprd-1.17	1.17.19-r3	—
Wolfi rolling	datadog-operator	1.31.2-r1	—
Wolfi rolling	dbmate	2.37.0-r5	—
Wolfi rolling	dgraph	25.5.1-r3	—
Wolfi rolling	distribution +1	3.1.2-r9	—
Wolfi rolling	dive	0.13.1-r31	—
Wolfi rolling	dkron-executor-kafka	4.2.1-r5	—
Wolfi rolling	docker-compose	5.7.0-r1	—
Wolfi rolling	dockerd-28	28.5.2-r48	—
Wolfi rolling	dogstatsd-7.78 +4	7.78.4-r32	—
Wolfi rolling	eksctl	0.231.0-r5	—
Wolfi rolling	etcd-3.6	3.6.16-r2	—
Wolfi rolling	falco-no-driver	0.45.2-r2	—
Wolfi rolling	falcoctl	0.14.3-r2	—
Wolfi rolling	falcosidekick	2.35.1-r4	—
Wolfi rolling	ferretdb	2.7.0-r37	—
Wolfi rolling	flux-2.10 +1	2.10.0-r2	—
Wolfi rolling	flux-2.7	2.7.5-r48	—
Wolfi rolling	flux-2.8	2.8.8-r31	—
Wolfi rolling	flux-2.9	2.9.6-r7	—
Wolfi rolling	flux-image-reflector-controller	1.3.0-r2	—
Wolfi rolling	flux-source-controller	1.10.1-r1	—
Wolfi rolling	flyte	1.16.9-r5	—
Wolfi rolling	gatus	5.38.0-r3	—
Wolfi rolling	git-lfs	3.8.1-r2	—
Wolfi rolling	gitea	28.3.0-r2	—
Wolfi rolling	gitlab-kas-19.3	19.3.7-r4	—
Wolfi rolling	gitlab-runner-19.3 +1	19.3.6-r1	—
Wolfi rolling	gitleaks	8.30.1-r31	—
Wolfi rolling	gitsign	0.18.0-r4	—
Wolfi rolling	gomplate-5	5.3.1-r2	—
Wolfi rolling	grafana-12.3	12.3.11-r16	—
Wolfi rolling	grafana-12.4	12.4.14-r3	—
Wolfi rolling	grafana-13.0	13.0.12-r4	—
Wolfi rolling	grafana-alloy	1.21.3-r2	—
Wolfi rolling	grafana-mimir-3.0 +1	3.0.9-r12	—
Wolfi rolling	grafana-mimir-3.1 +2	3.1.9-r2	—
Wolfi rolling	grafana-pyroscope-2.0	2.0.6-r17	—
Wolfi rolling	guac +2	1.1.0-r42	—
Wolfi rolling	harbor-scanner-trivy	0.40.0-r1	—
Wolfi rolling	incert	0.6.0-r9	—
Wolfi rolling	ipfs-cluster	1.1.6-r24	—
Wolfi rolling	istio-pilot-agent-1.29 +1	1.29.10-r3	—
Wolfi rolling	jitsucom-bulker-bulker +3	2.15.0-r14	—
Wolfi rolling	juicefs-1.3	1.3.4-r3	—
Wolfi rolling	k3d	5.9.0-r20	—
Wolfi rolling	k3s-1.34 +2	1.34.12.1-r9	—
Wolfi rolling	k3s-1.35 +2	1.35.9.1-r9	—
Wolfi rolling	k3s-1.36 +2	1.36.6.1-r1	—
Wolfi rolling	k3s-1.37	1.37.2.1-r1	—
Wolfi rolling	k6	2.3.0-r8	—
Wolfi rolling	k9s	0.51.0-r29	—
Wolfi rolling	kaf	0.2.14-r21	—
Wolfi rolling	kafka_exporter	1.11.0-r2	—
Wolfi rolling	kaniko +1	1.25.20-r2	—
Wolfi rolling	katib-controller	0.19.0-r51	—
Wolfi rolling	kbld	0.49.2-r3	—
Wolfi rolling	keda-2.19 +1	2.19.0-r42	—
Wolfi rolling	keda-2.20 +1	2.20.2-r20	—
Wolfi rolling	knative-serving-1.21-controller	1.21.3-r14	—
Wolfi rolling	knative-serving-1.22-controller	1.22.1-r21	—
Wolfi rolling	ko	0.19.1-r15	—
Wolfi rolling	kpt	1.0.1-r5	—
Wolfi rolling	kserve-agent	0.21.0-r14	—
Wolfi rolling	kubeflow-pipelines-apiserver +3	2.18.0-r5	—
Wolfi rolling	kubernetes-event-exporter	1.7-r80	—
Wolfi rolling	kubescape	4.0.20-r1	—
Wolfi rolling	kubescape-operator	0.2.209-r1	—
Wolfi rolling	kubevela-vela-cli +1	1.11.1-r1	—
Wolfi rolling	kubewatch	2.16.1-r5	—
Wolfi rolling	kwokctl	0.8.0-r16	—
Wolfi rolling	kyverno-1.18 +5	1.18.2-r24	—
Wolfi rolling	kyverno-notation-aws	1.1-r88	—
Wolfi rolling	kyverno-policy-reporter-kyverno-plugin	1.6.4-r42	—
Wolfi rolling	local-path-provisioner	0.0.37-r8	—
Wolfi rolling	loki-3.6 +3	3.6.19-r4	—
Wolfi rolling	loki-3.7 +2	3.7.9-r3	—
Wolfi rolling	manifest-tool	2.2.2-r22	—
Wolfi rolling	mariadb-operator	26.10.2-r2	—
Wolfi rolling	mattermost-11.5	11.5.7-r20	—
Wolfi rolling	mattermost-11.6	11.6.6-r22	—
Wolfi rolling	mattermost-11.7	11.7.15-r2	—
Wolfi rolling	mc	0.20250813.083541-r28	—
Wolfi rolling	migrate	4.20.1-r9	—
Wolfi rolling	minio	0.20261023.200651-r3	—
Wolfi rolling	minio-object-browser	2.0.5-r2	—
Wolfi rolling	neuvector-scanner +1	4.318-r1	—
Wolfi rolling	newrelic-fluent-bit-output	3.13.0-r1	—
Wolfi rolling	nfpm	2.48.0-r5	—
Wolfi rolling	nri-kafka +1	3.28.0-r1	—
Wolfi rolling	nuclei	3.11.1-r19	—
Wolfi rolling	op-geth +4	1.101702.3-r9	—
Wolfi rolling	opa	1.22.2-r1	—
Wolfi rolling	opa-envoy	1.22.0-r1	—
Wolfi rolling	opencost	1.121.3-r7	—
Wolfi rolling	opentofu-1.11	1.11.14-r14	—
Wolfi rolling	opentofu-1.12	1.12.12-r1	—
Wolfi rolling	opentofu-1.9	1.9.4-r37	—
Wolfi rolling	osv-scanner +1	2.7.0-r4	—
Wolfi rolling	paranoia	0.5.0-r24	—
Wolfi rolling	percona-server-mongodb-operator +1	1.23.1-r6	—
Wolfi rolling	policy-controller +1	0.15.1-r36	—
Wolfi rolling	prometheus-3.11	3.11.3-r25	—
Wolfi rolling	prometheus-3.12	3.12.0-r22	—
Wolfi rolling	prometheus-alertmanager	0.34.2-r1	—
Wolfi rolling	prometheus-operator	0.95.1-r1	—
Wolfi rolling	promxy	0.0.97-r9	—
Wolfi rolling	pulumi +3	3.274.1-r1	—
Wolfi rolling	pulumi-language-dotnet	3.117.0-r1	—
Wolfi rolling	pulumi-language-java	1.39.0-r1	—
Wolfi rolling	pulumi-language-yaml	1.38.16-r1	—
Wolfi rolling	rancher-fleet-cli +2	0.16.3-r4	—
Wolfi rolling	rclone	1.76.0-r0	—
Wolfi rolling	restic	0.19.1-r14	—
Wolfi rolling	scorecard	5.6.0-r3	—
Wolfi rolling	sftpgo	2.7.6-r6	—
Wolfi rolling	skaffold	2.25.0-r8	—
Wolfi rolling	skopeo	1.24.1-r8	—
Wolfi rolling	slsa-verifier	2.7.1-r41	—
Wolfi rolling	spegel	0.8.1-r2	—
Wolfi rolling	spire-agent +1	1.16.0-r1	—
Wolfi rolling	sql_exporter	0.24.13-r3	—
Wolfi rolling	steampipe	2.4.9-r1	—
Wolfi rolling	step	0.31.0-r11	—
Wolfi rolling	step-ca	0.30.2-r33	—
Wolfi rolling	tailscale +1	1.104.5-r1	—
Wolfi rolling	task	3.54.0-r7	—
Wolfi rolling	tekton-chains	0.30.0-r1	—
Wolfi rolling	tekton-pipelines-resolvers-1.12 +1	1.12.3-r4	—
Wolfi rolling	tekton-pipelines-resolvers-1.13 +1	1.13.1-r19	—
Wolfi rolling	telegraf-1.38	1.38.4-r41	—
Wolfi rolling	tempo-2.10 +2	2.10.10-r3	—
Wolfi rolling	tempo-3.0 +2	3.0.5-r5	—
Wolfi rolling	terraform	1.5.7-r68	—
Wolfi rolling	terraform-provider-pagerduty	3.37.0-r2	—
Wolfi rolling	terragrunt	1.2.1-r2	—
Wolfi rolling	tfsec	1.28.14-r58	—
Wolfi rolling	thanos	0.42.5-r2	—
Wolfi rolling	timoni	0.37.0-r2	—
Wolfi rolling	tkn	0.46.2-r2	—
Wolfi rolling	traefik-3.6	3.6.25-r18	—
Wolfi rolling	trivy	0.76.2-r1	—
Wolfi rolling	trivy-operator	0.36.1-r1	—
Wolfi rolling	undock	0.14.1-r5	—
Wolfi rolling	vault-secrets-webhook	1.23.1-r18	—
Wolfi rolling	vcluster +2	0.37.6-r5	—
Wolfi rolling	velero	1.18.4-r7	—
Wolfi rolling	vendir	0.46.3-r2	—
Wolfi rolling	verticadb-operator	25.4.0.0-r35	—
Wolfi rolling	vexctl	0.4.4-r16	—
Wolfi rolling	victoriametrics +8	1.155.0-r2	—
Wolfi rolling	victoriametrics-operator +1	0.75.2-r1	—
Wolfi rolling	vitess-23 +1	23.0.8-r7	—
Wolfi rolling	vitess-24 +1	24.0.5-r11	—
Wolfi rolling	wal-g-pg	3.0.9-r14	—
Wolfi rolling	weaviate	1.40.4-r2	—
Wolfi rolling	wgcf	2.3.1-r4	—
Wolfi rolling	witness	0.12.0-r20	—
Wolfi rolling	wolfictl	0.39.31-r0	—
Wolfi rolling	xeol	0.10.8-r73	—
Wolfi rolling	zarf	0.89.0-r3	—

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Go	github.com/klauspost/compress	< 1.20.2	1.20.2	GO-2026-6865
Go	github.com/klauspost/compress/zstd	< 1.20.2	1.20.2	GHSA-fpmh-frq8-7rj8

Advisories 50

RHSA-2026:98639 Red Hat Security Advisory: grafana security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
RHSA-2026:99151 Red Hat Security Advisory: grafana security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
RHSA-2026:98541 Red Hat Security Advisory: grafana security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
RHSA-2026:99030 Red Hat Security Advisory: grafana security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
RHSA-2026:99134 Red Hat Security Advisory: grafana security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
RHSA-2026:99172 Red Hat Security Advisory: grafana-pcp security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
RHSA-2026:99171 Red Hat Security Advisory: grafana-pcp security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
RHSA-2026:99152 Red Hat Security Advisory: grafana-pcp security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
RHSA-2026:99020 Red Hat Security Advisory: grafana-pcp security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
RHSA-2026:98620 Red Hat Security Advisory: grafana-pcp security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
RHSA-2026:95406 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Nov 13, 2026
RHSA-2026:94794 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Nov 13, 2026
RHSA-2026:95617 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Nov 13, 2026
RHSA-2026:93601 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Nov 13, 2026
RHSA-2026:93608 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Nov 13, 2026
RHSA-2026:92903 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Nov 13, 2026
RHSA-2026:91471 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Nov 13, 2026
RHSA-2026:91647 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Nov 13, 2026
RHSA-2026:91460 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Nov 13, 2026
RHSA-2026:91480 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Nov 13, 2026
RHSA-2026:91483 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Nov 13, 2026
RHSA-2026:91378 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Nov 13, 2026
RHSA-2026:91401 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Nov 13, 2026
RHSA-2026:91393 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Nov 13, 2026
RHSA-2026:91645 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Nov 13, 2026
RHSA-2026:91389 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Nov 13, 2026
RHSA-2026:91665 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Nov 13, 2026
RHSA-2026:91462 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Nov 13, 2026
RHSA-2026:91643 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Nov 13, 2026
RHSA-2026:88190 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Nov 13, 2026
RHSA-2026:90991 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Nov 13, 2026
RHSA-2026:91385 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Nov 13, 2026
RHSA-2026:91368 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Nov 13, 2026
RHSA-2026:91459 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Nov 13, 2026
RHSA-2026:91412 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Nov 13, 2026
RHSA-2026:88185 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Nov 13, 2026
RHSA-2026:91376 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Nov 13, 2026
RHSA-2026:91444 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Nov 13, 2026
RLSA-2026:98620 Important: grafana-pcp security update Rocky Linux Security Advisories · Nov 13, 2026
RLSA-2026:98541 Important: grafana security update Rocky Linux Security Advisories · Nov 13, 2026
ALSA-2026:99030 Important: grafana security update AlmaLinux Security Advisories · Nov 13, 2026
ALSA-2026:99020 Important: grafana-pcp security update AlmaLinux Security Advisories · Nov 13, 2026
RLSA-2026:99020 Important: grafana-pcp security update Rocky Linux Security Advisories · Nov 13, 2026
RLSA-2026:99030 Important: grafana security update Rocky Linux Security Advisories · Nov 13, 2026
WID-SEC-2026-4542 Red Hat Enterprise Linux: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 12, 2026
openSUSE-SU-2026:12530-1 gopass-1.17.4-2.1 on GA media SUSE / openSUSE Security Updates · Nov 12, 2026
SUSE-SU-2026:24652-1 Security update for aliyun-cli SUSE / openSUSE Security Updates · Nov 12, 2026
SUSE-SU-2026:5195-1 Security update for aliyun-cli SUSE / openSUSE Security Updates · Nov 12, 2026
ALAS2023-2026-3450 Important: skopeo security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Nov 12, 2026
ALAS2023-2026-3451 Important: buildah security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Nov 12, 2026

CNA	v4.0	8.7
EUVD	v4.0	8.7

compress zstd: Panic on two-block frames

Description

Affected products

Fixed in Linux distributions

Debian

Ubuntu

Red Hat

AlmaLinux

Rocky Linux

SUSE

openSUSE

Alpine

Amazon Linux

Azure Linux

Oracle Linux

Wolfi

Affected packages

Advisories 50

References