{
  "cveId": "CVE-2026-63209",
  "url": "https://patchblox.com/security/cve/CVE-2026-63209",
  "summary": "CVE-2026-63209 is fixed in 11 products on 1 platform, first by DEBIAN-CVE-2026-63209, released October 1, 2026. It is not reported as exploited. Patch Radar priority: High.",
  "title": "Integer Overflow or Wraparound and Out-of-bounds Write in compress",
  "description": "compress provides various compression algorithms. Prior to version 1.18.7, a signed integer overflow vulnerability in s2.NewDict() allows an attacker to bypass repeat index validation by supplying a dictionary with a uvarint-encoded repeat value exceeding MaxInt64. When Dict.Encode() is subsequently called, the overflowed negative repeat value causes an out-of-bounds memory access via unsafe.Pointer arithmetic, crashing the process with SIGSEGV. This issue has been patched in version 1.18.7.",
  "published": "2026-09-29T15:17:27Z",
  "severity": "Important",
  "cvss": 7.5,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
  "cwe": "Integer Overflow or Wraparound",
  "epss": 0.00572,
  "epssPercentile": 0.47559,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "vendorAdvisory": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-63209",
  "fixes": [
    {
      "platform": "linux",
      "product": "aliyun-cli",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "3.5.1-160000.1.1",
      "fix": "OPENSUSE-SU-2026:22140-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-22140-1",
      "released": "2026-11-07T00:48:28Z"
    },
    {
      "platform": "linux",
      "product": "aliyun-cli",
      "release": "sles 16.0",
      "fixedVersion": "3.5.1-160000.1.1",
      "fix": "SUSE-SU-2026:24261-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-24261-1",
      "released": "2026-11-07T00:45:20Z"
    },
    {
      "platform": "linux",
      "product": "amazon-cloudwatch-agent",
      "release": "sles 15.6",
      "fixedVersion": "1.300073.0-150400.9.18.1",
      "fix": "SUSE-SU-2026:4662-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-4662-1",
      "released": "2026-11-07T00:43:02Z"
    },
    {
      "platform": "linux",
      "product": "amazon-cloudwatch-agent",
      "release": "sles 15.7",
      "fixedVersion": "1.300073.0-150400.9.18.1",
      "fix": "SUSE-SU-2026:4662-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-4662-1",
      "released": "2026-11-07T00:43:02Z"
    },
    {
      "platform": "linux",
      "product": "cadvisor",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "0.60.6-bp160.1.1",
      "fix": "OPENSUSE-SU-2026:22117-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-22117-1",
      "released": "2026-11-07T00:48:28Z"
    },
    {
      "platform": "linux",
      "product": "distribution",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "3.1.1-160000.5.1",
      "fix": "OPENSUSE-SU-2026:22039-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-22039-1",
      "released": "2026-10-06T15:08:34Z"
    },
    {
      "platform": "linux",
      "product": "distribution",
      "release": "sles 16.0",
      "fixedVersion": "3.1.1-160000.5.1",
      "fix": "SUSE-SU-2026:24153-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-24153-1",
      "released": "2026-10-06T15:09:02Z"
    },
    {
      "platform": "linux",
      "product": "gh",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "2.102.0-bp160.1.1",
      "fix": "OPENSUSE-SU-2026:22134-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-22134-1",
      "released": "2026-11-07T00:47:19Z"
    },
    {
      "platform": "linux",
      "product": "go-containerregistry",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "0.22.1-bp160.1.1",
      "fix": "OPENSUSE-SU-2026:22227-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-22227-1",
      "released": "2026-11-07T00:47:19Z"
    },
    {
      "platform": "linux",
      "product": "golang-github-klauspost-compress",
      "release": "Debian 14",
      "fixedVersion": "1.19.0\u002Bds1-1",
      "fix": "DEBIAN-CVE-2026-63209",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-63209",
      "released": "2026-10-01T20:52:30Z"
    },
    {
      "platform": "linux",
      "product": "google-osconfig-agent",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "20260928.01-160000.1.1",
      "fix": "OPENSUSE-SU-2026:22078-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-22078-1",
      "released": "2026-11-07T00:48:28Z"
    },
    {
      "platform": "linux",
      "product": "google-osconfig-agent",
      "release": "sles 15.6",
      "fixedVersion": "20260928.01-150000.1.70.1",
      "fix": "SUSE-SU-2026:4661-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-4661-1",
      "released": "2026-11-07T00:43:02Z"
    },
    {
      "platform": "linux",
      "product": "google-osconfig-agent",
      "release": "sles 15.7",
      "fixedVersion": "20260928.01-150000.1.70.1",
      "fix": "SUSE-SU-2026:4661-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-4661-1",
      "released": "2026-11-07T00:43:02Z"
    },
    {
      "platform": "linux",
      "product": "google-osconfig-agent",
      "release": "sles 16.0",
      "fixedVersion": "20260928.01-160000.1.1",
      "fix": "SUSE-SU-2026:24222-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-24222-1",
      "released": "2026-11-07T00:45:20Z"
    },
    {
      "platform": "linux",
      "product": "hauler",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "2.1.1-bp160.1.1",
      "fix": "OPENSUSE-SU-2026:22116-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-22116-1",
      "released": "2026-11-07T00:48:28Z"
    },
    {
      "platform": "linux",
      "product": "helm",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "4.3.0-160000.2.1",
      "fix": "OPENSUSE-SU-2026:22057-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-22057-1",
      "released": "2026-11-07T00:48:28Z"
    },
    {
      "platform": "linux",
      "product": "helm",
      "release": "sles 15.6",
      "fixedVersion": "3.22.1-150000.1.104.1",
      "fix": "SUSE-SU-2026:5119-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-5119-1",
      "released": "2026-11-07T00:43:02Z"
    },
    {
      "platform": "linux",
      "product": "helm",
      "release": "sles 15.7",
      "fixedVersion": "3.22.1-150000.1.104.1",
      "fix": "SUSE-SU-2026:5119-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-5119-1",
      "released": "2026-11-07T00:43:02Z"
    },
    {
      "platform": "linux",
      "product": "helm",
      "release": "sles 16.0",
      "fixedVersion": "4.3.0-160000.2.1",
      "fix": "SUSE-SU-2026:24247-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-24247-1",
      "released": "2026-11-07T00:45:20Z"
    },
    {
      "platform": "linux",
      "product": "rqlite",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "10.6.6-bp160.1.1",
      "fix": "OPENSUSE-SU-2026:22224-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-22224-1",
      "released": "2026-11-07T00:47:19Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T06:59:42Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}