CVE-2026-116591
CVE
High
· CVSS 8.7
Medium Impactklauspost/compress: zstd Decoder Panic via Crafted Two-Block Frame
Exploitable under specific conditions
This vulnerability can affect KrakenD under specific conditions. Review the affected versions below and upgrade if your deployment is exposed.
KrakenD only decodes zstd when it consumes messages from Kafka, so the exposure is
limited to the Kafka subscriber backend (
backend/pubsub/subscriber/kafka) and the
Kafka async agent (async/kafka). The Kafka publisher only compresses and is not
affected. Exploiting it requires publishing a crafted message to a topic KrakenD
consumes, or tampering with the traffic between KrakenD and the brokers, and the
result is a crash of the gateway process. Until you upgrade, restrict write access
on the consumed topics to trusted producers and use TLS for broker connections.Component
klauspost/compress (zstd)
Disclosed
Nov 12, 2026
CVSS Score
8.7
Description
The zstd decoder in
klauspost/compress can panic on a crafted frame made of two
blocks. An FSE normalized count of 32768 wraps to -32768 when stored as an int16,
so the decoder keeps stale table state from the first block and indexes beyond the
table while decoding the second, instead of returning an error. Both the DecodeAll
and the streaming decoder paths are affected, so any application that decompresses
untrusted zstd input can be crashed. Affects all versions before 1.20.2.Version summary
Enterprise Edition
3.0.4, 2.13.14
addresses this advisory
Affected EE versions
>= 2.0, < 2.13.14 || >= 3.0, < 3.0.4
Upgrade to the addressed version or later to remediate this vulnerability.