[dymurray]

CVE-2026-116591: Panic on two-block frames in github.com/klauspost/compress

Severity	(CVSS 0.0)
Dependency	github.com/klauspost/compress v1.18.6 → github.com/klauspost/compress v1.20.2
Remediation	Automatic dependency update (build and tests verified)
Reachability (rgctl)	unknown; OpenVEX under_investigation
Trusted Profile Analyzer	CVE-2026-116591
Advisories	GO-2026-6865

Remediation report

fix(CVE-2026-116591): upgrade github.com/klauspost/compress v1.18.6 -> v1.20.2

Panic on two-block frames in github.com/klauspost/compress; github.com/klauspost/compress v1.20.2 is the lowest release outside the affected range.

Code changes:
- go.mod, go.sum: required github.com/klauspost/compress@v1.20.2 (no other source changes needed)

Verification:
- go build ./... && go test ./... (no new failures; 6 pre-existing failure(s) unchanged): 11 package(s) ok
- rgctl vuln analyze (before fix): unknown, exploitability not_exploitable (OpenVEX under_investigation)

Refs: CVE-2026-116591, GO-2026-6865 (reported by Red Hat Trusted Profile Analyzer)

Signed-off-by: Dylan Murray <dymurray@redhat.com>

Opened by MTA cve-remediation from a Red Hat Trusted Profile Analyzer finding.

Summary by CodeRabbit

• Chores
  • Updated an underlying component. No user-facing changes are included in this release.

[openshift-merge-bot]

Pipeline controller notification

This PR uses the pipeline controller for second-stage tests. Selection and triggering follow the repository configuration.

Use /test ? to list jobs and /pipeline help for commands.

[coderabbitai]

No actionable comments were generated in the recent review.

Walkthrough

The indirect github.com/klauspost/compress requirement is updated from v1.18.6 to v1.20.2.

Changes

Compression dependency update

Layer / File(s)	Summary
Update compression dependency version go.mod	The indirect requirement for github.com/klauspost/compress changes from v1.18.6 to v1.20.2.

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Bug fix

Suggested reviewers: kaovilai

Merge Risk: Minimal · up to 86d7c

No actionable technical blocker is established for this dependency update. Merge remains subject to required checks and GitHub protection requirements.

Pre-merge checks: 15

Check name	Status	Explanation
Title check		The title identifies the dependency upgrade and its security purpose.
Description check		The description explains the security issue and gives verification commands and results. It does not use the template headings.
Docstring Coverage		No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names		The PR changes only the dependency version in go.mod and its checksums in go.sum. It does not change Ginkgo test titles.
Test Structure And Quality		The PR changes only the dependency version and checksums in go.mod and go.sum. It does not add or change Ginkgo tests.
Microshift Test Compatibility		The PR changes only the dependency version and checksums in go.mod and go.sum. It adds no Ginkgo e2e tests.
Single Node Openshift (Sno) Test Compatibility		The PR changes only go.mod and go.sum. It adds no Ginkgo e2e tests, so the SNO test compatibility check does not apply.
Topology-Aware Scheduling Compatibility		The PR only updates the github.com/klauspost/compress dependency and its checksums. It does not change deployment manifests, operator code, or controllers.
Ote Binary Stdout Contract		The PR only updates an indirect compression dependency and its checksums. It changes no process-level stdout code. The repository search found no OpenShift Tests Extension references.
Ipv6 And Disconnected Network Test Compatibility		The PR changes only the dependency version in go.mod and its checksums in go.sum. It adds no Ginkgo e2e tests.
No-Weak-Crypto		The PR only updates an indirect compression dependency and its checksums. The diff introduces no crypto implementation or secret comparison.
Container-Privileges		The PR changes only a Go dependency version and its checksums. It does not change container or Kubernetes manifests.
No-Sensitive-Data-In-Logs		The PR changes only the github.com/klauspost/compress version and its checksums. It adds no logging statements.

Full details: Docstring Coverage

Explanation

No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

Finishing Touches

Generate unit tests (beta)

• Create a new PR

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Central YAML; Path: .coderabbit.yaml
• Review profile: CHILL
• Plan: Advanced
• Run ID: 7b4f9fb0-3265-4ffe-ab1a-fea723389ac6

Commits

Reviewing files that changed from the base of the PR and between 29d17b3 and 86d7cbf.

Files ignored due to path filters: 1

• go.sum is excluded by !**/*.sum

Files selected for processing: 1

• go.mod

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

[kaovilai]

The ci/prow/5.0-virt-kdm-e2e-test-aws failure on this PR is a known issue on the oadp-dev base branch, unrelated to this dependency bump. The failing spec times out with no VirtualMachineBackup found ... velero.io/dataupload-name=... — that is the pre-existing KubeVirt datamover e2e bug, not a regression from this change.

The fix is in #2531 (e2e test reads the VMB backup type from status.includedVolumes[].type after KubeVirt dropped whole-backup status.type) together with the controller fix in migtools/kubevirt-datamover-controller#255. Once #2531 merges, please re-run the virt-kdm job; the other checks on this PR are unaffected.

Note

Responses generated with Claude (model: GLM 5.3)

[sseago]

/retest

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: dymurray, sseago

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [dymurray,sseago]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

@dymurray: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[kaovilai]

The ci/prow/5.0-virt-kdm-e2e-test-aws failure on this PR was the known oadp-dev base-branch issue mentioned earlier. The fix has now merged: #2531 (e2e test reads the VMB backup type from status.includedVolumes[].type) and migtools/kubevirt-datamover-controller#255 (controller side), both merged into oadp-dev on Nov 9. Please re-run the virt-kdm job with /test 5.0-virt-kdm-e2e-test-aws (or /retest) — it should pass against the fixed base.

Note

Responses generated with Claude (model: GLM 5.3)