Integer Overflow Affecting github.com/klauspost/compress/s2 package, versions >=1.16.0 <1.18.7
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-GOLANG-GITHUBCOMKLAUSPOSTCOMPRESSS2-18343256
- published28 Jul 2026
- disclosed27 Jul 2026
- creditChristopher Linke
Introduced: 27 Jul 2026
New CVE NOT AVAILABLE CWE-190 (opens in a new tab)How to fix?
Upgrade github.com/klauspost/compress/s2 to version 1.18.7 or higher.
Overview
Affected versions of this package are vulnerable to Integer Overflow leading to an out-of-bounds write in the s2.NewDict() function in s2/dict.go, which reads a uvarint and converts it to int without checking whether it exceeds MaxInt64. An attacker can crash the process with a segmentation fault by supplying S2 dictionary data whose repeat-index uvarint exceeds MaxInt64, which becomes a negative int that bypasses the index validation and drives out-of-bounds arithmetic through unsafe.Pointer in Dict.Encode(). Exploitation requires the application to build an S2 dictionary from attacker-controlled data with s2.NewDict() and then call Dict.Encode() on input of at least 32 bytes.