—
GO-2026-5841
OOB read in github.com/klauspost/compress/s2
Quick fix
GO-2026-5841 — github.com/klauspost/compress: upgrade to the fixed version with the command below.
go get github.com/klauspost/compress@v1.18.7Details
Providing a specially crafted dictionary to s2.NewDict and using it to encode data can make the encoder read out of bounds.
Are you affected?
Enter the version of the package you're using.
Affected packages
Go / github.com/klauspost/compress
Introduced in:
1.16.0 Fixed in: 1.18.7 Fix
go get github.com/klauspost/compress@v1.18.7