Disclosed weakness · no CVE recorded

Anthropic fixes a Claude Code compressed-response decoding issue

Anthropic · Claude Code · Compressed-response decoding

First documented disclosure · Review checkpoint

Summary

Anthropic identifies a security issue in handling zstd-compressed responses. The vendor gives no further technical details.

Severity and exploitation evidence

No CVSS score recorded in this review.

Exploitation not established: The vendor release notes report a fix and identify no exploitation against users.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Anthropic identifies a security issue in handling zstd-compressed responses. The vendor gives no further technical details.

Conditions required

The affected component decodes a zstd-compressed response. Other preconditions are unknown.

Potential impact

The vendor did not describe the effect on confidentiality, integrity or availability.

Affected versions and configurations

Anthropic did not publish the earliest affected version.

Fix and mitigation status

Anthropic lists the correction in 2.1.325.

Practical next steps

Update Claude Code to a supported release containing the 2.1.325 correction.

Operating lesson

Track installed client versions so a vendor security fix can be deployed even when its impact is undisclosed.

Evidence and limits

The November 13 release provides no issue-specific CVE or severity. Its change to the default approval flow for sandboxed Bash is documented separately.

Sources