Skip to content

chore(deps): update security fixes [security] - #1264

Open
posthog-renovate[bot] wants to merge 1 commit into
mainfrom
renovate/security-fixes
Open

chore(deps): update security fixes [security]#1264
posthog-renovate[bot] wants to merge 1 commit into
mainfrom
renovate/security-fixes

Conversation

@posthog-renovate

@posthog-renovate posthog-renovate Bot commented Oct 24, 2026 •
edited
Loading

Copy link
Copy Markdown

This PR contains the following updates:

Package Change Age Confidence
github.com/klauspost/compress v1.18.5 → v1.20.2 age confidence
golang.org/x/net v0.60.0 → v0.62.0 age confidence

GitHub Vulnerability Alerts

CVE-2026-63209

Signed Integer Overflow in s2.NewDict

Summary

A signed integer overflow vulnerability in s2.NewDict() allows an attacker to bypass repeat index validation by supplying a dictionary with a uvarint-encoded repeat value exceeding MaxInt64. When Dict.Encode() is subsequently called, the overflowed negative repeat value causes an out-of-bounds memory access via unsafe.Pointer arithmetic, crashing the process with SIGSEGV.

Package

  • Name: github.com/klauspost/compress/s2
  • Ecosystem: Go
  • Affected versions: <= v1.18.6 (all versions with NewDict function)

Severity

High (7.5) — CVSS v3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Vulnerability

Type

  • CWE-190: Integer Overflow or Wraparound
  • CWE-787: Out-of-bounds Write (via unsafe.Pointer)

Description

The NewDict() function reads a uvarint from dictionary data and converts it to int:

r, n := binary.Uvarint(dict)
// ...
d.repeat = int(r)
if d.repeat > len(dict) {
    return nil
}

When r exceeds MaxInt64 (9223372036854775807), int(r) overflows to a negative value. Since a negative number is never greater than a positive length, the validation check is bypassed.

When Dict.Encode() is called, the negative repeat value causes an integer overflow in encodeBlockDictGo():

repeat := len(dict.dict) - dict.repeat  // overflows: 62 - (-5758978476775341977) = huge positive
candidate := len(dict.dict) - repeat + s // underflows to negative
load32(dict.dict, candidate)             // OOB via unsafe.Pointer

load32 calls le.Load32 which uses unsafe.Pointer arithmetic without bounds checking:

func Load32[I Indexer](b []byte, i I) uint32 {
    return *(*uint32)(unsafe.Add(unsafe.Pointer(unsafe.SliceData(b)), i))
}

This causes a segmentation fault (SIGSEGV) when the negative index is dereferenced.

PoC

package main

import (
    "encoding/binary"
    "fmt"
    "github.com/klauspost/compress/s2"
)

func main() {
    var dictData []byte
    buf := make([]byte, binary.MaxVarintLen64)
    n := binary.PutUvarint(buf, 12687765596934209639) // > MaxInt64
    dictData = append(dictData, buf[:n]...)
    dictData = append(dictData, make([]byte, 16)...) // minimum dict size

    dict := s2.NewDict(dictData)
    // dict is non-nil despite invalid repeat value (overflow bypassed validation)

    src := make([]byte, 64)
    for i := range src { src[i] = byte(i) }
    dict.Encode(nil, src) // SIGSEGV: OOB access via unsafe.Pointer
}

Impact

  • Denial of Service: The process crashes immediately with SIGSEGV

Attack Vector

Any application that:

  1. Accepts user-supplied S2 dictionary data via s2.NewDict()
  2. Calls Dict.Encode() on any data ≥32 bytes

Suggested Fix

Validate the uvarint value before converting to int:

if r > math.MaxInt64 {
    return nil
}
d.repeat = int(r)

Or use uint for the repeat field and validate against uint(len(dict)).

References

  • Source: s2/dict.go lines 59-61 (vulnerability), s2/encode_all.go line 947 (crash site)
  • Commit: 539243b (v1.18.6 + 4 commits)

Credits

Christopher Linke / https://github.com/celinke97/

OOB read in github.com/klauspost/compress/s2

CVE-2026-63209 / GHSA-259r-337f-4rfw / GO-2026-5841

More information

Details

Providing a specially crafted dictionary to s2.NewDict and using it to encode data can make the encoder read out of bounds.

Severity

Unknown

References

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

Compress/s2: Integer Overflow or Wraparound and Out-of-bounds Write in compress

CVE-2026-63209 / GHSA-259r-337f-4rfw / GO-2026-5841

More information

Details

Signed Integer Overflow in s2.NewDict
Summary

A signed integer overflow vulnerability in s2.NewDict() allows an attacker to bypass repeat index validation by supplying a dictionary with a uvarint-encoded repeat value exceeding MaxInt64. When Dict.Encode() is subsequently called, the overflowed negative repeat value causes an out-of-bounds memory access via unsafe.Pointer arithmetic, crashing the process with SIGSEGV.

Package
  • Name: github.com/klauspost/compress/s2
  • Ecosystem: Go
  • Affected versions: <= v1.18.6 (all versions with NewDict function)
Severity

High (7.5) — CVSS v3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Vulnerability
Type
  • CWE-190: Integer Overflow or Wraparound
  • CWE-787: Out-of-bounds Write (via unsafe.Pointer)
Description

The NewDict() function reads a uvarint from dictionary data and converts it to int:

r, n := binary.Uvarint(dict)
// ...
d.repeat = int(r)
if d.repeat > len(dict) {
    return nil
}

When r exceeds MaxInt64 (9223372036854775807), int(r) overflows to a negative value. Since a negative number is never greater than a positive length, the validation check is bypassed.

When Dict.Encode() is called, the negative repeat value causes an integer overflow in encodeBlockDictGo():

repeat := len(dict.dict) - dict.repeat  // overflows: 62 - (-5758978476775341977) = huge positive
candidate := len(dict.dict) - repeat + s // underflows to negative
load32(dict.dict, candidate)             // OOB via unsafe.Pointer

load32 calls le.Load32 which uses unsafe.Pointer arithmetic without bounds checking:

func Load32[I Indexer](b []byte, i I) uint32 {
    return *(*uint32)(unsafe.Add(unsafe.Pointer(unsafe.SliceData(b)), i))
}

This causes a segmentation fault (SIGSEGV) when the negative index is dereferenced.

PoC
package main

import (
    "encoding/binary"
    "fmt"
    "github.com/klauspost/compress/s2"
)

func main() {
    var dictData []byte
    buf := make([]byte, binary.MaxVarintLen64)
    n := binary.PutUvarint(buf, 12687765596934209639) // > MaxInt64
    dictData = append(dictData, buf[:n]...)
    dictData = append(dictData, make([]byte, 16)...) // minimum dict size

    dict := s2.NewDict(dictData)
    // dict is non-nil despite invalid repeat value (overflow bypassed validation)

    src := make([]byte, 64)
    for i := range src { src[i] = byte(i) }
    dict.Encode(nil, src) // SIGSEGV: OOB access via unsafe.Pointer
}
Impact
  • Denial of Service: The process crashes immediately with SIGSEGV
Attack Vector

Any application that:

  1. Accepts user-supplied S2 dictionary data via s2.NewDict()
  2. Calls Dict.Encode() on any data ≥32 bytes
Suggested Fix

Validate the uvarint value before converting to int:

if r > math.MaxInt64 {
    return nil
}
d.repeat = int(r)

Or use uint for the repeat field and validate against uint(len(dict)).

References
  • Source: s2/dict.go lines 59-61 (vulnerability), s2/encode_all.go line 947 (crash site)
  • Commit: 539243b (v1.18.6 + 4 commits)
Credits

Christopher Linke / https://github.com/celinke97/

Severity

  • CVSS Score: 7.5 / 10 (High)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Panic on two-block frames in github.com/klauspost/compress

CVE-2026-116591 / GHSA-fpmh-frq8-7rj8 / GO-2026-6865

More information

Details

Panic on two-block frames in github.com/klauspost/compress

Severity

Unknown

References

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

Check all ancestor namespace transitions when rendering raw text in html in golang.org/x/net

CVE-2026-97045 / GO-2026-6866

More information

Details

In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found. However, that integration point may itself be a descendant of an element that was foster-parented into a foreign namespace (such as or fostered under ), causing a parser to resolve the subtree in a different foreign namespace upon re-parsing the rendered output.

Continue walking the full ancestor chain and verify that every transition from a non-empty namespace occurs at an HTML integration point before emitting literal text.

Severity

Unknown

References

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

Avoid quadratic complexity when coalescing text nodes in html in golang.org/x/net

CVE-2026-78661 / GO-2026-6860

More information

Details

When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n.Data += text) reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated by ignored end tags (such as "a") caused O(n^2) allocations and byte copies.

Accumulate coalesced text in per-node byte slices during parsing and materialize Data strings once at the end of parse.

Severity

Unknown

References

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

Release Notes

klauspost/compress (github.com/klauspost/compress)

v1.20.2

Compare Source

Full Changelog: klauspost/compress@v1.20.1...v1.20.2

v1.20.1

Compare Source

What's Changed

New Contributors

Full Changelog: klauspost/compress@v1.20.0...v1.20.1

v1.20.0

Compare Source

What's Changed

New Contributors

Full Changelog: klauspost/compress@v1.19.2...v1.20.0

v1.19.2

Compare Source

What's Changed

New Contributors

Full Changelog: klauspost/compress@v1.19.1...v1.19.2

v1.19.1

Compare Source

What's Changed

New Contributors

Full Changelog: klauspost/compress@v1.19.0...v1.19.1

v1.19.0

Compare Source

What's Changed

New Contributors

Full Changelog: klauspost/compress@v1.18.6...v1.19.0

v1.18.7

Compare Source

  • Fix s2.NewDict OOB read.

Security release without other changes.

Full Changelog: klauspost/compress@v1.18.6...v1.18.7

v1.18.6

Compare Source

What's Changed

New Contributors

Full Changelog: klauspost/compress@v1.18.5...v1.18.6

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

@posthog-renovate posthog-renovate Bot added the security Security hardening or vulnerability label Oct 24, 2026
@posthog-renovate

posthog-renovate Bot commented Oct 24, 2026 •
edited
Loading

Copy link
Copy Markdown
Author

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 7 additional dependencies were updated

Details:

Package Change
golang.org/x/crypto v0.57.0 -> v0.58.0
golang.org/x/sync v0.23.0 -> v0.24.0
golang.org/x/sys v0.48.0 -> v0.49.0
golang.org/x/telemetry v0.0.0-20260811182544-a038080d80e5 -> v0.0.0-20260924152758-ed294f943157
golang.org/x/term v0.46.0 -> v0.47.0
golang.org/x/text v0.42.0 -> v0.43.0
golang.org/x/tools v0.49.0 -> v0.51.0

@github-actions

github-actions Bot commented Oct 24, 2026

Copy link
Copy Markdown

Test Impact Plan

Deterministic summary of how this PR changes tests, CI runners, and coverage-risk signals.

Summary

Area Added Changed Deleted
Test files 0 0 0
E2E/journey files 0 0 0
Workflow files 0 0 0

Signals

  • Test cases: +0 / -0
  • Assertions: +0 / -0
  • Skips or known failures added: 0
  • Workflow continue-on-error added: 0
  • Workflow path filters added: 0
  • Test commands removed from justfile: 0
  • E2E/journey retry lines added: 0

Coverage risk: neutral or increased

No coverage-reduction warnings detected.

@posthog-renovate
posthog-renovate Bot force-pushed the renovate/security-fixes branch 3 times, most recently from 6d5bcc7 to ab9c077 Compare October 31, 2026 05:27
@posthog-renovate
posthog-renovate Bot force-pushed the renovate/security-fixes branch from ab9c077 to ac6e00e Compare November 5, 2026 05:26
@posthog-renovate posthog-renovate Bot changed the title fix(deps): update security fixes [security] chore(deps): update security fixes [security] Nov 5, 2026
@posthog-renovate
posthog-renovate Bot force-pushed the renovate/security-fixes branch from ac6e00e to 33f7ab6 Compare November 6, 2026 05:26

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

security Security hardening or vulnerability

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants