HIGH

CVE-2026-65819

2026-08-07 CVSS v3.1

CVSS

7.5

Description

gopacket provides packet processing capabilities for Go. Through version 1.7.0, multiple layer decoders use attacker-controlled lengths, counts, or offsets before validating them against packet buffers, allowing a crafted packet decoded through DecodingLayerParser or DecodeFromBytes to trigger an unrecovered panic and remotely deny service. A patch commit is available at 210f25f.

Weakness (CWE)

CWE-125 Out-of-bounds Read

CWE-400 Uncontrolled Resource Consumption

EPSS Score

0.36%

Probability of exploitation in next 30 days

29.9th percentile

References

https://github.com/gopacket/gopacket/commit/210f25fb9b3ca1af2eb649936f78ad6991b6c9c5 https://github.com/gopacket/gopacket/releases/tag/v1.7.0 https://github.com/gopacket/gopacket/security/advisories/GHSA-8mcr-459q-5mx2

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE