{"id":"DHI-2wcy-w2sf-taqe-lcqj","summary":"compress provides various compression algorithms. Prior to version 1.18.7, a signed integer overflow vulnerability in…","details":"compress provides various compression algorithms. Prior to version 1.18.7, a signed integer overflow vulnerability in s2.NewDict() allows an attacker to bypass repeat index validation by supplying a dictionary with a uvarint-encoded repeat value exceeding MaxInt64. When Dict.Encode() is subsequently called, the overflowed negative repeat value causes an out-of-bounds memory access via unsafe.Pointer arithmetic, crashing the process with SIGSEGV. This issue has been patched in version 1.18.7.","modified":"2026-11-10T22:15:03.963329416Z","published":"2026-11-10T22:09:09Z","upstream":["CVE-2026-63209"],"references":[{"type":"ADVISORY","url":"https://scout.docker.com/v/DHI-2wcy-w2sf-taqe-lcqj"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63209"},{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2026-63209"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-259r-337f-4rfw"},{"type":"ADVISORY","url":"https://github.com/klauspost/compress/security/advisories/GHSA-259r-337f-4rfw"},{"type":"FIX","url":"https://github.com/klauspost/compress/pull/1163"},{"type":"FIX","url":"https://github.com/klauspost/compress/commit/8668e357e776d5152ed62f33c17f21b8690664fa"},{"type":"FIX","url":"https://github.com/klauspost/compress/commit/539243b8823ee8f03e49969823d57c348c917536"},{"type":"WEB","url":"https://github.com/klauspost/compress/releases/tag/v1.18.7"},{"type":"ADVISORY","url":"https://pkg.go.dev/vuln/GO-2026-5841"},{"type":"ADVISORY","url":"https://ubuntu.com/security/CVE-2026-63209"},{"type":"ADVISORY","url":"http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-63209"}],"affected":[{"package":{"name":"tailscale-dev","ecosystem":"Docker Hardened Images:Alpine:3.23","purl":"pkg:apk/dhi/tailscale-dev"},"versions":["1.100.0-r0","1.100.0-r1","1.100.0-r2","1.100.0-r3","1.100.0-r4","1.100.0-r5","1.102.0-r0","1.102.0-r1","1.102.2-r0","1.102.2-r1","1.102.3-r0","1.102.3-r1","1.102.3-r2","1.102.3-r3","1.102.3-r4","1.102.4-r0","1.102.5-r0","1.104.0-r0","1.104.1-r0","1.104.1-r1","1.104.1-r2","1.104.2-r0","1.104.4-r0","1.104.4-r1","1.104.5-r0","1.104.5-r1","1.98.1-r0","1.98.2-r0","1.98.2-r1","1.98.2-r2","1.98.3-r0","1.98.3-r1","1.98.3-r2","1.98.4-r0","1.98.5-r0","1.98.5-r1"],"database_specific":{"owner_kind":"HSP","source":"https://github.com/docker-hardened-images/advisories-test/blob/main/osv/2026/DHI-2wcy-w2sf-taqe-lcqj.json"}},{"package":{"name":"tailscale-fips-dev","ecosystem":"Docker Hardened Images:Alpine:3.23","purl":"pkg:apk/dhi/tailscale-fips-dev"},"versions":["1.100.0-r0","1.100.0-r1","1.100.0-r2","1.100.0-r3","1.100.0-r4","1.100.0-r5","1.102.0-r0","1.102.0-r1","1.102.2-r0","1.102.2-r1","1.102.3-r0","1.102.3-r1","1.102.3-r2","1.102.3-r3","1.102.3-r4","1.102.4-r0","1.102.5-r0","1.104.0-r0","1.104.1-r0","1.104.1-r1","1.104.1-r2","1.104.2-r0","1.104.4-r0","1.104.4-r1","1.104.5-r0","1.104.5-r1","1.98.1-r0","1.98.2-r0","1.98.2-r1","1.98.2-r2","1.98.3-r0","1.98.3-r1","1.98.3-r2","1.98.4-r0","1.98.5-r0","1.98.5-r1"],"database_specific":{"owner_kind":"HSP","source":"https://github.com/docker-hardened-images/advisories-test/blob/main/osv/2026/DHI-2wcy-w2sf-taqe-lcqj.json"}},{"package":{"name":"tailscale-fips","ecosystem":"Docker Hardened Images:Alpine:3.23","purl":"pkg:apk/dhi/tailscale-fips"},"versions":["1.100.0-r0","1.100.0-r1","1.100.0-r2","1.100.0-r3","1.100.0-r4","1.100.0-r5","1.102.0-r0","1.102.0-r1","1.102.2-r0","1.102.2-r1","1.102.3-r0","1.102.3-r1","1.102.3-r2","1.102.3-r3","1.102.3-r4","1.102.4-r0","1.102.5-r0","1.104.0-r0","1.104.1-r0","1.104.1-r1","1.104.1-r2","1.104.2-r0","1.104.4-r0","1.104.4-r1","1.104.5-r0","1.104.5-r1","1.98.1-r0","1.98.2-r0","1.98.2-r1","1.98.2-r2","1.98.3-r0","1.98.3-r1","1.98.3-r2","1.98.4-r0","1.98.5-r0","1.98.5-r1"],"database_specific":{"owner_kind":"HSP","source":"https://github.com/docker-hardened-images/advisories-test/blob/main/osv/2026/DHI-2wcy-w2sf-taqe-lcqj.json"}},{"package":{"name":"tailscale-k8s-nameserver-dev","ecosystem":"Docker Hardened Images:Alpine:3.23","purl":"pkg:apk/dhi/tailscale-k8s-nameserver-dev"},"versions":["1.100.0-r0","1.100.0-r1","1.100.0-r2","1.100.0-r3","1.100.0-r4","1.100.0-r5","1.102.0-r0","1.102.0-r1","1.102.2-r0","1.102.2-r1","1.102.3-r0","1.102.3-r1","1.102.3-r2","1.102.3-r3","1.102.3-r4","1.102.4-r0","1.102.5-r0","1.104.0-r0","1.104.1-r0","1.104.1-r1","1.104.1-r2","1.104.2-r0","1.104.4-r0","1.104.4-r1","1.104.5-r0","1.104.5-r1","1.98.1-r0","1.98.2-r0","1.98.2-r1","1.98.2-r2","1.98.3-r0","1.98.3-r1","1.98.3-r2","1.98.4-r0","1.98.5-r0","1.98.5-r1"],"database_specific":{"owner_kind":"HSP","source":"https://github.com/docker-hardened-images/advisories-test/blob/main/osv/2026/DHI-2wcy-w2sf-taqe-lcqj.json"}},{"package":{"name":"tailscale-k8s-nameserver-fips-dev","ecosystem":"Docker Hardened Images:Alpine:3.23","purl":"pkg:apk/dhi/tailscale-k8s-nameserver-fips-dev"},"versions":["1.100.0-r0","1.100.0-r1","1.100.0-r2","1.100.0-r3","1.100.0-r4","1.100.0-r5","1.102.0-r0","1.102.0-r1","1.102.2-r0","1.102.2-r1","1.102.3-r0","1.102.3-r1","1.102.3-r2","1.102.3-r3","1.102.3-r4","1.102.4-r0","1.102.5-r0","1.104.0-r0","1.104.1-r0","1.104.1-r1","1.104.1-r2","1.104.2-r0","1.104.4-r0","1.104.4-r1","1.104.5-r0","1.104.5-r1","1.98.1-r0","1.98.2-r0","1.98.2-r1","1.98.2-r2","1.98.3-r0","1.98.3-r1","1.98.3-r2","1.98.4-r0","1.98.5-r0","1.98.5-r1"],"database_specific":{"owner_kind":"HSP","source":"https://github.com/docker-hardened-images/advisories-test/blob/main/osv/2026/DHI-2wcy-w2sf-taqe-lcqj.json"}},{"package":{"name":"tailscale-k8s-nameserver-fips","ecosystem":"Docker Hardened Images:Alpine:3.23","purl":"pkg:apk/dhi/tailscale-k8s-nameserver-fips"},"versions":["1.100.0-r0","1.100.0-r1","1.100.0-r2","1.100.0-r3","1.100.0-r4","1.100.0-r5","1.102.0-r0","1.102.0-r1","1.102.2-r0","1.102.2-r1","1.102.3-r0","1.102.3-r1","1.102.3-r2","1.102.3-r3","1.102.3-r4","1.102.4-r0","1.102.5-r0","1.104.0-r0","1.104.1-r0","1.104.1-r1","1.104.1-r2","1.104.2-r0","1.104.4-r0","1.104.4-r1","1.104.5-r0","1.104.5-r1","1.98.2-r2","1.98.3-r0","1.98.3-r1","1.98.3-r2","1.98.4-r0","1.98.5-r0","1.98.5-r1"],"database_specific":{"owner_kind":"HSP","source":"https://github.com/docker-hardened-images/advisories-test/blob/main/osv/2026/DHI-2wcy-w2sf-taqe-lcqj.json"}},{"package":{"name":"tailscale-k8s-nameserver","ecosystem":"Docker Hardened Images:Alpine:3.23","purl":"pkg:apk/dhi/tailscale-k8s-nameserver"},"versions":["1.100.0-r0","1.100.0-r1","1.100.0-r2","1.100.0-r3","1.100.0-r4","1.100.0-r5","1.102.0-r0","1.102.0-r1","1.102.2-r0","1.102.2-r1","1.102.3-r0","1.102.3-r1","1.102.3-r2","1.102.3-r3","1.102.3-r4","1.102.4-r0","1.102.5-r0","1.104.0-r0","1.104.1-r0","1.104.1-r1","1.104.1-r2","1.104.2-r0","1.104.4-r0","1.104.4-r1","1.104.5-r0","1.104.5-r1","1.98.2-r2","1.98.3-r0","1.98.3-r1","1.98.3-r2","1.98.4-r0","1.98.5-r0","1.98.5-r1"],"database_specific":{"owner_kind":"HSP","source":"https://github.com/docker-hardened-images/advisories-test/blob/main/osv/2026/DHI-2wcy-w2sf-taqe-lcqj.json"}},{"package":{"name":"tailscale-k8s-operator-dev","ecosystem":"Docker Hardened Images:Alpine:3.23","purl":"pkg:apk/dhi/tailscale-k8s-operator-dev"},"versions":["1.100.0-r0","1.100.0-r1","1.100.0-r2","1.100.0-r3","1.100.0-r4","1.100.0-r5","1.102.0-r0","1.102.0-r1","1.102.2-r0","1.102.2-r1","1.102.3-r0","1.102.3-r1","1.102.3-r2","1.102.3-r3","1.102.3-r4","1.102.4-r0","1.102.5-r0","1.104.0-r0","1.104.1-r0","1.104.1-r1","1.104.1-r2","1.104.2-r0","1.104.4-r0","1.104.4-r1","1.104.5-r0","1.104.5-r1","1.98.1-r0","1.98.2-r0","1.98.2-r1","1.98.2-r2","1.98.3-r0","1.98.3-r1","1.98.3-r2","1.98.4-r0","1.98.5-r0","1.98.5-r1"],"database_specific":{"owner_kind":"HSP","source":"https://github.com/docker-hardened-images/advisories-test/blob/main/osv/2026/DHI-2wcy-w2sf-taqe-lcqj.json"}},{"package":{"name":"tailscale-k8s-operator-fips-dev","ecosystem":"Docker Hardened Images:Alpine:3.23","purl":"pkg:apk/dhi/tailscale-k8s-operator-fips-dev"},"versions":["1.100.0-r0","1.100.0-r1","1.100.0-r2","1.100.0-r3","1.100.0-r4","1.100.0-r5","1.102.0-r0","1.102.0-r1","1.102.2-r0","1.102.2-r1","1.102.3-r0","1.102.3-r1","1.102.3-r2","1.102.3-r3","1.102.3-r4","1.102.4-r0","1.102.5-r0","1.104.0-r0","1.104.1-r0","1.104.1-r1","1.104.1-r2","1.104.2-r0","1.104.4-r0","1.104.4-r1","1.104.5-r0","1.104.5-r1","1.98.1-r0","1.98.2-r0","1.98.2-r1","1.98.2-r2","1.98.3-r0","1.98.3-r1","1.98.3-r2","1.98.4-r0","1.98.5-r0","1.98.5-r1"],"database_specific":{"owner_kind":"HSP","source":"https://github.com/docker-hardened-images/advisories-test/blob/main/osv/2026/DHI-2wcy-w2sf-taqe-lcqj.json"}},{"package":{"name":"tailscale-k8s-operator-fips","ecosystem":"Docker Hardened Images:Alpine:3.23","purl":"pkg:apk/dhi/tailscale-k8s-operator-fips"},"versions":["1.100.0-r0","1.100.0-r1","1.100.0-r2","1.100.0-r3","1.100.0-r4","1.100.0-r5","1.102.0-r0","1.102.0-r1","1.102.2-r0","1.102.2-r1","1.102.3-r0","1.102.3-r1","1.102.3-r2","1.102.3-r3","1.102.3-r4","1.102.4-r0","1.102.5-r0","1.104.0-r0","1.104.1-r0","1.104.1-r1","1.104.1-r2","1.104.2-r0","1.104.4-r0","1.104.4-r1","1.104.5-r0","1.104.5-r1","1.98.1-r0","1.98.2-r0","1.98.2-r1","1.98.2-r2","1.98.3-r0","1.98.3-r1","1.98.3-r2","1.98.4-r0","1.98.5-r0","1.98.5-r1"],"database_specific":{"owner_kind":"HSP","source":"https://github.com/docker-hardened-images/advisories-test/blob/main/osv/2026/DHI-2wcy-w2sf-taqe-lcqj.json"}},{"package":{"name":"tailscale-k8s-operator","ecosystem":"Docker Hardened Images:Alpine:3.23","purl":"pkg:apk/dhi/tailscale-k8s-operator"},"versions":["1.100.0-r0","1.100.0-r1","1.100.0-r2","1.100.0-r3","1.100.0-r4","1.100.0-r5","1.102.0-r0","1.102.0-r1","1.102.2-r0","1.102.2-r1","1.102.3-r0","1.102.3-r1","1.102.3-r2","1.102.3-r3","1.102.3-r4","1.102.4-r0","1.102.5-r0","1.104.0-r0","1.104.1-r0","1.104.1-r1","1.104.1-r2","1.104.2-r0","1.104.4-r0","1.104.4-r1","1.104.5-r0","1.104.5-r1","1.98.1-r0","1.98.2-r0","1.98.2-r1","1.98.2-r2","1.98.3-r0","1.98.3-r1","1.98.3-r2","1.98.4-r0","1.98.5-r0","1.98.5-r1"],"database_specific":{"owner_kind":"HSP","source":"https://github.com/docker-hardened-images/advisories-test/blob/main/osv/2026/DHI-2wcy-w2sf-taqe-lcqj.json"}},{"package":{"name":"tailscale","ecosystem":"Docker Hardened Images:Alpine:3.23","purl":"pkg:apk/dhi/tailscale"},"versions":["1.100.0-r0","1.100.0-r1","1.100.0-r2","1.100.0-r3","1.100.0-r4","1.100.0-r5","1.102.0-r0","1.102.0-r1","1.102.2-r0","1.102.2-r1","1.102.3-r0","1.102.3-r1","1.102.3-r2","1.102.3-r3","1.102.3-r4","1.102.4-r0","1.102.5-r0","1.104.0-r0","1.104.1-r0","1.104.1-r1","1.104.1-r2","1.104.2-r0","1.104.4-r0","1.104.4-r1","1.104.5-r0","1.104.5-r1","1.98.1-r0","1.98.2-r0","1.98.2-r1","1.98.2-r2","1.98.3-r0","1.98.3-r1","1.98.3-r2","1.98.4-r0","1.98.5-r0","1.98.5-r1"],"database_specific":{"owner_kind":"HSP","source":"https://github.com/docker-hardened-images/advisories-test/blob/main/osv/2026/DHI-2wcy-w2sf-taqe-lcqj.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}