Read the docs
TI-2026-80931 Aliases CVE-2026-116591GHSA-fpmh-frq8-7rj8

compress zstd: Panic on two-block frames

Priority MEDIUM 44CWE-190Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 4 fixed, 57 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-190 and the CVSS impact.

Summary

compress provides various compression algorithms. Prior to 1.20.2, the zstd DecodeAll and streaming decoder paths can panic when a crafted two-block frame reaches huff0.ReadTable with an FSE normalized count of 32768 that readNCount stores in int16 as -32768. The wrapped count allows buildDtable to retain stale fse.Scratch decode-table state from the prior block, and nextFast then derives an out-of-range state and indexes beyond the table instead of returning a decode error. Both blocks are required to preserve and then reuse the stale state, allowing untrusted zstd input to crash an application. This issue is fixed in version 1.20.2.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00333 26th percentileScored 2026-11-07
Fix Partial compress (klauspost): 1.20.2github.com/klauspost/compress/zstd (Go): 1.20.2Red Hat: 30 advisoriesRed Hat: 4 fixed, 57 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
klauspostcompressbefore 1.20.21.20.2Patch availableCNA
—github.com/klauspost/compress/zstd (Go)before 1.20.21.20.2Patch availableGHSA-fpmh-frq8-7rj8
  • compress Vendorklauspost Affected before 1.20.2 Fixed in 1.20.2 Patch available CNA
  • github.com/klauspost/compress/zstd (Go) Vendor— Affected before 1.20.2 Fixed in 1.20.2 Patch available GHSA-fpmh-frq8-7rj8

Remediation

  • Fix · CNA compress (klauspost) Fixed in 1.20.2
  • Fix · GHSA-fpmh-frq8-7rj8 github.com/klauspost/compress/zstd (Go) Fixed in 1.20.2 Advisory →

Red Hat 30 advisories

  • RHSA-2026:95617 Released 2026-11-05 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images loki3.6-3.6.19-0.3.hum1@aarch64, loki3.6-3.6.19-0.3.hum1@src, loki3.6-3.6.19-0.3.hum1@x86_64 +4
  • RHSA-2026:95591 Released 2026-11-05 · Red Hat rating Important
    Cluster Observability Operator - 1.5
    • Cluster Observability Operator 1.5 registry.redhat.io/cluster-observability-operator/alertmanager-rhel9, registry.redhat.io/cluster-observability-operator/cluster-observability-rhel9-operator, registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9 +16
  • RHSA-2026:95406 Released 2026-11-05 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images tempo2.10-2.10.9-0.2.hum1@aarch64, tempo2.10-2.10.9-0.2.hum1@src, tempo2.10-2.10.9-0.2.hum1@x86_64
Show 27 more Red Hat advisories
  • RHSA-2026:95090 Released 2026-11-04 · Red Hat rating Critical
    RHACS 4.11.7 security and bug fix update
    • Red Hat Advanced Cluster Security for Kubernetes 4.11 registry.redhat.io/advanced-cluster-security/rhacs-central-db-rhel9, registry.redhat.io/advanced-cluster-security/rhacs-main-rhel9, registry.redhat.io/advanced-cluster-security/rhacs-operator-bundle +5
  • RHSA-2026:94794 Released 2026-11-03 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images grafana13.2-13.2.4-0.6.hum1@aarch64, grafana13.2-13.2.4-0.6.hum1@s390x, grafana13.2-13.2.4-0.6.hum1@src +1
  • RHSA-2026:94580 Released 2026-11-03 · Red Hat rating Important
    Red Hat OpenShift distributed tracing platform (Tempo) 3.11.4 release
    • Red Hat OpenShift distributed tracing 3.11 registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9, registry.redhat.io/rhosdt/tempo-gateway-rhel9, registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9 +2
  • RHSA-2026:93608 Released 2026-11-02 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images grafana13.1-13.1.8-0.6.hum1@aarch64, grafana13.1-13.1.8-0.6.hum1@s390x, grafana13.1-13.1.8-0.6.hum1@src +1
  • RHSA-2026:93601 Released 2026-11-02 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images grafana12.4-12.4.13-0.6.hum1@aarch64, grafana12.4-12.4.13-0.6.hum1@src, grafana12.4-12.4.13-0.6.hum1@x86_64
  • RHSA-2026:92903 Released 2026-10-29 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images opentofu1.12-1.12.11-0.1.hum1@aarch64, opentofu1.12-1.12.11-0.1.hum1@s390x, opentofu1.12-1.12.11-0.1.hum1@src +1
  • RHSA-2026:91665 Released 2026-10-28 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images loki3.7-3.7.9-0.2.hum1@aarch64, loki3.7-3.7.9-0.2.hum1@src, loki3.7-3.7.9-0.2.hum1@x86_64 +4
  • RHSA-2026:91647 Released 2026-10-28 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images opentofu1.12-1.12.9-0.2.hum1@aarch64, opentofu1.12-1.12.9-0.2.hum1@s390x, opentofu1.12-1.12.9-0.2.hum1@src +1
  • RHSA-2026:91645 Released 2026-10-28 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images git-lfs-3.8.1-0.2.hum1@aarch64, git-lfs-3.8.1-0.2.hum1@s390x, git-lfs-3.8.1-0.2.hum1@src +1
  • RHSA-2026:91643 Released 2026-10-28 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images grype-0.121.0-0.3.hum1@aarch64, grype-0.121.0-0.3.hum1@s390x, grype-0.121.0-0.3.hum1@src +1
  • RHSA-2026:91483 Released 2026-10-27 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images prometheus3.13-3.13.5-0.2.hum1@aarch64, prometheus3.13-3.13.5-0.2.hum1@src, prometheus3.13-3.13.5-0.2.hum1@x86_64
  • RHSA-2026:91480 Released 2026-10-27 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images caddy-2.11.7-0.4.hum1@aarch64, caddy-2.11.7-0.4.hum1@s390x, caddy-2.11.7-0.4.hum1@src +1
  • RHSA-2026:91471 Released 2026-10-27 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images trivy-0.76.1-0.2.hum1@aarch64, trivy-0.76.1-0.2.hum1@s390x, trivy-0.76.1-0.2.hum1@src +1
  • RHSA-2026:91462 Released 2026-10-27 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images spire1.15-1.15.5-0.3.hum1@aarch64, spire1.15-1.15.5-0.3.hum1@s390x, spire1.15-1.15.5-0.3.hum1@src +10
  • RHSA-2026:91460 Released 2026-10-27 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images spire1.14-1.14.9-0.3.hum1@aarch64, spire1.14-1.14.9-0.3.hum1@s390x, spire1.14-1.14.9-0.3.hum1@src +10
  • RHSA-2026:91459 Released 2026-10-27 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images tempo3.0-3.0.4-0.3.hum1@aarch64, tempo3.0-3.0.4-0.3.hum1@src, tempo3.0-3.0.4-0.3.hum1@x86_64
  • RHSA-2026:91444 Released 2026-10-27 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images jaeger-2.21.0-0.3.hum1@aarch64, jaeger-2.21.0-0.3.hum1@src, jaeger-2.21.0-0.3.hum1@x86_64
  • RHSA-2026:91412 Released 2026-10-27 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images k6v2-2.3.0-0.4.hum1@aarch64, k6v2-2.3.0-0.4.hum1@src, k6v2-2.3.0-0.4.hum1@x86_64
  • RHSA-2026:91401 Released 2026-10-27 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images k6v1-1.8.2-0.3.hum1@aarch64, k6v1-1.8.2-0.3.hum1@src, k6v1-1.8.2-0.3.hum1@x86_64
  • RHSA-2026:91393 Released 2026-10-27 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images opentelemetry-collector-contrib-0.164.0-0.1.hum1@aarch64, opentelemetry-collector-contrib-0.164.0-0.1.hum1@s390x, opentelemetry-collector-contrib-0.164.0-0.1.hum1@src +1
  • RHSA-2026:91389 Released 2026-10-27 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images cosign-3.1.4-0.2.hum1@aarch64, cosign-3.1.4-0.2.hum1@s390x, cosign-3.1.4-0.2.hum1@src +1
  • RHSA-2026:91385 Released 2026-10-27 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images podman-5:6.1.4-1.2.hum1@aarch64, podman-5:6.1.4-1.2.hum1@s390x, podman-5:6.1.4-1.2.hum1@src +12
  • RHSA-2026:91378 Released 2026-10-27 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images distribution-3.1.2-0.4.hum1@aarch64, distribution-3.1.2-0.4.hum1@s390x, distribution-3.1.2-0.4.hum1@src +1
  • RHSA-2026:91376 Released 2026-10-27 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images syft-1.55.0-0.3.hum1@aarch64, syft-1.55.0-0.3.hum1@s390x, syft-1.55.0-0.3.hum1@src +1
  • RHSA-2026:91368 Released 2026-10-27 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images skopeo-1:1.24.1-1.3.hum1@aarch64, skopeo-1:1.24.1-1.3.hum1@s390x, skopeo-1:1.24.1-1.3.hum1@src +4
  • RHSA-2026:88190 Released 2026-10-22 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images buildah-2:1.46.0-1.hum1@aarch64, buildah-2:1.46.0-1.hum1@s390x, buildah-2:1.46.0-1.hum1@src +1
  • RHSA-2026:88185 Released 2026-10-22 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images opentelemetry-collector-k8s-0.163.2-0.1.hum1@aarch64, opentelemetry-collector-k8s-0.163.2-0.1.hum1@s390x, opentelemetry-collector-k8s-0.163.2-0.1.hum1@src +1

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
AWS Load Balancer OperatorAffectedNo fix yet
Assisted Installer for Red Hat OpenShift Container Platform 2AffectedNo fix yet
Builds for Red Hat OpenShiftAffectedNo fix yet
Confidential Compute AttestationAffectedNo fix yet
Cryostat 4AffectedNo fix yet
Custom Metric Autoscaler operator for Red Hat OpenshiftAffectedNo fix yet
DPU kit for NVIDIAAffectedNo fix yet
Deployment Validation OperatorAffectedNo fix yet
File Integrity OperatorAffectedNo fix yet
Helm CLI for Red Hat OpenShiftAffectedNo fix yet
Lightspeed CoreAffectedNo fix yet
Logging Subsystem for Red Hat OpenShiftAffectedNo fix yet
Migration Toolkit for ContainersAffectedNo fix yet
Multiarch Tuning OperatorAffectedNo fix yet
Multicluster Engine for KubernetesAffectedNo fix yet
Multicluster Global HubAffectedNo fix yet
Network Observability OperatorAffectedNo fix yet
OpenShift API for Data ProtectionAffectedNo fix yet
OpenShift Developer Tools and ServicesAffectedNo fix yet
OpenShift LightspeedAffectedNo fix yet
OpenShift PipelinesAffectedNo fix yet
OpenShift ServerlessAffectedNo fix yet
OpenShift Source-to-Image (S2I)AffectedNo fix yet
Pen Drive Powered by Red Hat LightspeedAffectedNo fix yet
Red Hat Advanced Cluster Management for Kubernetes 2AffectedNo fix yet
Red Hat Advanced Cluster Security 4AffectedNo fix yet
Red Hat Build of Podman DesktopAffectedNo fix yet
Red Hat Ceph Storage 5AffectedNo fix yet
Red Hat Ceph Storage 6AffectedNo fix yet
Red Hat Ceph Storage 7AffectedNo fix yet
Red Hat Ceph Storage 8AffectedNo fix yet
Red Hat Ceph Storage 9AffectedNo fix yet
Red Hat Certification Program for Red Hat Enterprise Linux 9AffectedNo fix yet
Red Hat Connectivity Link 1AffectedNo fix yet
Red Hat Developer Hub 1AffectedNo fix yet
Red Hat Edge Manager 1AffectedNo fix yet
Red Hat Enterprise Linux 10AffectedNo fix yet
Red Hat Enterprise Linux 8AffectedNo fix yet
Red Hat Enterprise Linux 9AffectedNo fix yet
Red Hat Hardened ImagesAffectedNo fix yet
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet
Red Hat OpenShift Container Platform 4AffectedNo fix yet
Red Hat OpenShift Container Platform 5AffectedNo fix yet
Red Hat OpenShift Dev SpacesAffectedNo fix yet
Red Hat OpenShift GitOpsAffectedNo fix yet
Red Hat OpenShift distributed tracing 3AffectedNo fix yet
Red Hat OpenShift for Windows ContainersAffectedNo fix yet
Red Hat OpenStack Platform 18.0AffectedNo fix yet
Red Hat Openshift Data Foundation 4AffectedNo fix yet
Red Hat Quay 3AffectedNo fix yet
Red Hat Satellite 6AffectedNo fix yet
Red Hat Trusted Artifact SignerAffectedNo fix yet
Red Hat Trusted Profile AnalyzerAffectedNo fix yet
Security Profiles OperatorAffectedNo fix yet
Zero Trust Workload Identity ManagerAffectedNo fix yet
cert-manager Operator for Red Hat OpenShiftAffectedNo fix yet
streams for Apache Kafka 3AffectedNo fix yet
Cluster Observability Operator 1.5Fixed RHSA-2026:95591
Red Hat Advanced Cluster Security for Kubernetes 4.11Fixed RHSA-2026:95090
Red Hat Hardened ImagesFixed RHSA-2026:88185, RHSA-2026:88190, RHSA-2026:91368, RHSA-2026:91376, RHSA-2026:91378, RHSA-2026:91385, RHSA-2026:91389, RHSA-2026:91393, RHSA-2026:91401, RHSA-2026:91412, RHSA-2026:91444, RHSA-2026:91459, RHSA-2026:91460, RHSA-2026:91462, RHSA-2026:91471, RHSA-2026:91480, RHSA-2026:91483, RHSA-2026:91643, RHSA-2026:91645, RHSA-2026:91647, RHSA-2026:91665, RHSA-2026:92903, RHSA-2026:93601, RHSA-2026:93608, RHSA-2026:94794, RHSA-2026:95406, RHSA-2026:95617
Red Hat OpenShift distributed tracing 3.11Fixed RHSA-2026:94580
Not affected: 18 products
  • Cluster Observability Operator 1.5
  • Custom Metric Autoscaler operator for Red Hat Openshift
  • Logical Volume Manager Storage
  • OpenShift Service Mesh 3
  • Red Hat Advanced Cluster Security for Kubernetes 4.11
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat Hardened Images
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Container Platform 5
  • Red Hat OpenShift distributed tracing 3.11
  • Red Hat OpenStack Platform 16.2
  • Red Hat OpenStack Platform 17.1
  • Red Hat OpenStack Platform 18.0
  • Red Hat Openshift Data Foundation 4
  • Zero Trust Workload Identity Manager - Tech Preview
  • streams for Apache Kafka 2

Timeline

  1. 2026-10-26 Threatist record created from CVE-2026-116591
  2. 2026-10-27 CISA SSVC decision points changed
  3. 2026-10-27 Alias added: GHSA-fpmh-frq8-7rj8
  4. 2026-10-29 Affected versions changed · Red Hat
  5. 2026-10-29 CVSS score added · Red Hat
  6. 2026-10-29 Fix available: Red Hat Hardened Images · Red Hat
  7. 2026-10-30 Fix available: RHSA-2026:91368 · Red Hat
  8. 2026-10-30 Fix available: RHSA-2026:91385 · Red Hat
  9. 2026-10-30 Fix available: RHSA-2026:91393 · Red Hat
  10. 2026-10-30 Fix available: RHSA-2026:91401 · Red Hat
  11. 2026-10-30 Fix available: RHSA-2026:91389 · Red Hat
  12. 2026-10-30 Fix available: RHSA-2026:91412 · Red Hat
  13. 2026-10-30 Fix available: RHSA-2026:91462 · Red Hat
  14. 2026-10-30 Fix available: RHSA-2026:91460 · Red Hat
  15. 2026-10-30 Fix available: RHSA-2026:91471 · Red Hat
  16. 2026-10-30 Fix available: RHSA-2026:91444 · Red Hat
  17. 2026-10-30 Fix available: RHSA-2026:91378 · Red Hat
  18. 2026-10-30 Fix available: RHSA-2026:91459 · Red Hat
  19. 2026-10-30 Fix available: RHSA-2026:91376 · Red Hat
  20. 2026-10-30 Fix available: RHSA-2026:91483 · Red Hat
  21. 2026-10-30 Fix available: RHSA-2026:91480 · Red Hat
  22. 2026-10-30 Fix available: RHSA-2026:91645 · Red Hat
  23. 2026-10-30 Fix available: RHSA-2026:91647 · Red Hat
  24. 2026-10-30 Fix available: RHSA-2026:91665 · Red Hat
  25. 2026-10-30 Fix available: RHSA-2026:91643 · Red Hat
  26. 2026-10-30 Fix available: RHSA-2026:88185 · Red Hat
  27. 2026-10-30 Fix available: RHSA-2026:88190 · Red Hat
  28. 2026-10-30 Affected versions changed · Red Hat
  29. 2026-10-30 Affected versions changed · Red Hat
  30. 2026-10-30 Affected versions changed · Red Hat
  31. 2026-10-31 Affected versions changed · Red Hat
  32. 2026-10-31 Affected versions changed · Red Hat
  33. 2026-11-01 Affected versions changed · Red Hat
  34. 2026-11-02 Affected versions changed · Red Hat
  35. 2026-11-02 Affected versions changed · Red Hat
  36. 2026-11-02 Affected versions changed · Red Hat
  37. 2026-11-03 Affected versions changed · Red Hat
  38. 2026-11-03 Fix available: RHSA-2026:93608 · Red Hat
  39. 2026-11-03 Fix available: RHSA-2026:93601 · Red Hat
  40. 2026-11-03 Affected versions changed · Red Hat
  41. 2026-11-03 Affected versions changed · Red Hat
  42. 2026-11-04 Affected versions changed · Red Hat
  43. 2026-11-04 Fix available: RHSA-2026:94794 · Red Hat
  44. 2026-11-04 Fix available: RHSA-2026:92903 · Red Hat
  45. 2026-11-04 Fix available: RHSA-2026:94580 · Red Hat
  46. 2026-11-04 Fix available: Red Hat OpenShift distributed tracing 3.11 · Red Hat
  47. 2026-11-04 Affected versions changed · Red Hat
  48. 2026-11-04 Fix available: RHSA-2026:95090 · Red Hat
  49. 2026-11-04 Fix available: Red Hat Advanced Cluster Security for Kubernetes 4.11 · Red Hat
  50. 2026-11-06 Fix available: Cluster Observability Operator 1.5 · Red Hat
  51. 2026-11-06 Fix available: RHSA-2026:95591 · Red Hat
  52. 2026-11-06 Fix available: RHSA-2026:95406 · Red Hat
  53. 2026-11-06 Fix available: RHSA-2026:95617 · Red Hat

References

Advisory 1

Other 4

  • TI-2026-45095 Integer Overflow or Wraparound and Out-of-bounds Write in compress CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences