)]}'
{
  "commit": "3266de7c69fd3c05c921823bcfd92b0a8f0b1ffa",
  "tree": "0c00ad869b13d8ce3e2b52eee4bae6edbd48a34c",
  "parents": [
    "79b0fd37d5915c7a30dcb2db9a7f0665de49a3ae"
  ],
  "author": {
    "name": "Mend Renovate",
    "email": "bot@renovateapp.com",
    "time": "Tue Oct 20 19:04:06 2026 +0100"
  },
  "committer": {
    "name": "GitHub",
    "email": "noreply@github.com",
    "time": "Tue Oct 20 11:04:06 2026 -0700"
  },
  "message": "chore(all): update module github.com/klauspost/compress to v1.18.7 [SECURITY] (#20726)\n\nThis PR contains the following updates:\n\n| Package | Change |\n[Age](https://docs.renovatebot.com/merge-confidence/) |\n[Confidence](https://docs.renovatebot.com/merge-confidence/) |\n|---|---|---|---|\n|\n[github.com/klauspost/compress](https://redirect.github.com/klauspost/compress)\n| `v1.18.6` → `v1.18.7` |\n![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2fklauspost%2fcompress/v1.18.7?slim\u003dtrue)\n|\n![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2fklauspost%2fcompress/v1.18.6/v1.18.7?slim\u003dtrue)\n|\n\n---\n\n### Compress/s2: Integer Overflow or Wraparound and Out-of-bounds Write\nin compress\n[CVE-2026-63209](https://nvd.nist.gov/vuln/detail/CVE-2026-63209) /\n[GHSA-259r-337f-4rfw](https://redirect.github.com/advisories/GHSA-259r-337f-4rfw)\n\n\u003cdetails\u003e\n\u003csummary\u003eMore information\u003c/summary\u003e\n\n#### Details\n##### Signed Integer Overflow in s2.NewDict\n\n##### Summary\n\nA signed integer overflow vulnerability in `s2.NewDict()` allows an\nattacker to bypass repeat index validation by supplying a dictionary\nwith a uvarint-encoded repeat value exceeding `MaxInt64`. When\n`Dict.Encode()` is subsequently called, the overflowed negative repeat\nvalue causes an out-of-bounds memory access via `unsafe.Pointer`\narithmetic, crashing the process with SIGSEGV.\n\n##### Package\n\n- **Name:** `github.com/klauspost/compress/s2`\n- **Ecosystem:** Go\n- **Affected versions:** \u003c\u003d v1.18.6 (all versions with `NewDict`\nfunction)\n\n##### Severity\n\n**High (7.5)** — CVSS v3.1: `AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`\n\n##### Vulnerability\n\n##### Type\n- CWE-190: Integer Overflow or Wraparound\n- CWE-787: Out-of-bounds Write (via unsafe.Pointer)\n\n##### Description\n\nThe `NewDict()` function reads a uvarint from dictionary data and\nconverts it to `int`:\n\n```go\nr, n :\u003d binary.Uvarint(dict)\n// ...\nd.repeat \u003d int(r)\nif d.repeat \u003e len(dict) {\n    return nil\n}\n```\n\nWhen `r` exceeds `MaxInt64` (9223372036854775807), `int(r)` overflows to\na negative value. Since a negative number is never greater than a\npositive length, the validation check is bypassed.\n\nWhen `Dict.Encode()` is called, the negative `repeat` value causes an\ninteger overflow in `encodeBlockDictGo()`:\n\n```go\nrepeat :\u003d len(dict.dict) - dict.repeat  // overflows: 62 - (-5758978476775341977) \u003d huge positive\ncandidate :\u003d len(dict.dict) - repeat + s // underflows to negative\nload32(dict.dict, candidate)             // OOB via unsafe.Pointer\n```\n\n`load32` calls `le.Load32` which uses `unsafe.Pointer` arithmetic\nwithout bounds checking:\n\n```go\nfunc Load32[I Indexer](b []byte, i I) uint32 {\n    return *(*uint32)(unsafe.Add(unsafe.Pointer(unsafe.SliceData(b)), i))\n}\n```\n\nThis causes a segmentation fault (SIGSEGV) when the negative index is\ndereferenced.\n\n##### PoC\n\n```go\npackage main\n\nimport (\n    \"encoding/binary\"\n    \"fmt\"\n    \"github.com/klauspost/compress/s2\"\n)\n\nfunc main() {\n    var dictData []byte\n    buf :\u003d make([]byte, binary.MaxVarintLen64)\n    n :\u003d binary.PutUvarint(buf, 12687765596934209639) // \u003e MaxInt64\n    dictData \u003d append(dictData, buf[:n]...)\n    dictData \u003d append(dictData, make([]byte, 16)...) // minimum dict size\n\n    dict :\u003d s2.NewDict(dictData)\n    // dict is non-nil despite invalid repeat value (overflow bypassed validation)\n\n    src :\u003d make([]byte, 64)\n    for i :\u003d range src { src[i] \u003d byte(i) }\n    dict.Encode(nil, src) // SIGSEGV: OOB access via unsafe.Pointer\n}\n```\n\n##### Impact\n\n- **Denial of Service:** The process crashes immediately with SIGSEGV\n\n##### Attack Vector\n\nAny application that:\n1. Accepts user-supplied S2 dictionary data via `s2.NewDict()`\n2. Calls `Dict.Encode()` on any data ≥32 bytes\n\n##### Suggested Fix\n\nValidate the uvarint value before converting to int:\n\n```go\nif r \u003e math.MaxInt64 {\n    return nil\n}\nd.repeat \u003d int(r)\n```\n\nOr use `uint` for the repeat field and validate against\n`uint(len(dict))`.\n\n##### References\n\n- Source: `s2/dict.go` lines 59-61 (vulnerability), `s2/encode_all.go`\nline 947 (crash site)\n- Commit: 539243b (v1.18.6 + 4 commits)\n\n##### Credits\nChristopher Linke / https://github.com/celinke97/\n\n#### Severity\n- CVSS Score: 7.5 / 10 (High)\n- Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`\n\n#### References\n-\n[https://github.com/klauspost/compress/security/advisories/GHSA-259r-337f-4rfw](https://redirect.github.com/klauspost/compress/security/advisories/GHSA-259r-337f-4rfw)\n-\n[https://nvd.nist.gov/vuln/detail/CVE-2026-63209](https://nvd.nist.gov/vuln/detail/CVE-2026-63209)\n-\n[https://github.com/klauspost/compress/pull/1163](https://redirect.github.com/klauspost/compress/pull/1163)\n-\n[https://github.com/klauspost/compress/commit/539243b8823ee8f03e49969823d57c348c917536](https://redirect.github.com/klauspost/compress/commit/539243b8823ee8f03e49969823d57c348c917536)\n-\n[https://github.com/klauspost/compress/commit/8668e357e776d5152ed62f33c17f21b8690664fa](https://redirect.github.com/klauspost/compress/commit/8668e357e776d5152ed62f33c17f21b8690664fa)\n-\n[https://github.com/klauspost/compress/releases/tag/v1.18.7](https://redirect.github.com/klauspost/compress/releases/tag/v1.18.7)\n-\n[https://github.com/advisories/GHSA-259r-337f-4rfw](https://redirect.github.com/advisories/GHSA-259r-337f-4rfw)\n\nThis data is provided by the [GitHub Advisory\nDatabase](https://redirect.github.com/advisories/GHSA-259r-337f-4rfw)\n([CC-BY\n4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).\n\u003c/details\u003e\n\n---\n\n### Release Notes\n\n\u003cdetails\u003e\n\u003csummary\u003eklauspost/compress (github.com/klauspost/compress)\u003c/summary\u003e\n\n###\n[`v1.18.7`](https://redirect.github.com/klauspost/compress/releases/tag/v1.18.7)\n\n[Compare\nSource](https://redirect.github.com/klauspost/compress/compare/v1.18.6...v1.18.7)\n\n- Fix s2.NewDict OOB read.\n\nSecurity release without other changes.\n\n**Full Changelog**:\n\u003chttps://github.com/klauspost/compress/compare/v1.18.6...v1.18.7\u003e\n\n\u003c/details\u003e\n\n---\n\n### Configuration\n\n📅 **Schedule**: (UTC)\n\n- Branch creation\n  - At any time (no schedule defined)\n- Automerge\n  - At any time (no schedule defined)\n\n🚦 **Automerge**: Disabled by config. Please merge this manually once you\nare satisfied.\n\n♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the\nrebase/retry checkbox.\n\n🔕 **Ignore**: Close this PR and you won\u0027t be reminded about this update\nagain.\n\n---\n\n- [ ] \u003c!-- rebase-check --\u003eIf you want to rebase/retry this PR, check\nthis box\n\n---\n\nThis PR was generated by [Mend Renovate](https://mend.io/renovate/).\nView the [repository job\nlog](https://developer.mend.io/github/googleapis/google-cloud-go).\n\n\u003c!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNzEuMiIsInVwZGF0ZWRJblZlciI6IjQ0LjE3MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--\u003e",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "4f8974830adea5efb74ace992148948473e20080",
      "old_mode": 33188,
      "old_path": "pubsublite/go.mod",
      "new_id": "89ce6dc0c527d3ee0adc14b6264c46ebe5da7c2a",
      "new_mode": 33188,
      "new_path": "pubsublite/go.mod"
    },
    {
      "type": "modify",
      "old_id": "4e025d265b67393fe9d6b5033f4e13ed208c63c6",
      "old_mode": 33188,
      "old_path": "pubsublite/go.sum",
      "new_id": "9fe171c1f36fe465acd4993d98bd42a62b5c0cac",
      "new_mode": 33188,
      "new_path": "pubsublite/go.sum"
    }
  ]
}