CVE-2026-65819
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
gopacket provides packet processing capabilities for Go. Through version 1.7.0, multiple layer decoders use attacker-controlled lengths, counts, or offsets before validating them against packet buffers, allowing a crafted packet decoded through DecodingLayerParser or DecodeFromBytes to trigger an unrecovered panic and remotely deny service. A patch commit is available at 210f25f.
Risk Assessment
A remote attacker can send a specially crafted packet that causes a crash in the process using gopacket, leading to service disruption (DoS).
Recommendation
Apply the patch from commit 210f25f or update the gopacket library to a patched version.
Other vulnerabilities in gopacket
See all- CVE-2026-54345High
The gopacket library for Go version 1.6.0 and earlier has a vulnerability in the Diameter AVP decoder. An attacker can control the Length field in an AVP, causing an unsigned 32-bit underflow and allocation of about 4 GiB memory. Two such messages can cause OOM and denial of service.
- CVE-2026-54332High
The gopacket library for Go version 1.6.0 and earlier has a vulnerability in the sFlow ExtendedGatewayFlow decoder. An attacker controls 32-bit community and AS path member counts, leading to allocation of up to 16 GiB memory from a 104-byte UDP datagram, causing denial of service.
Original NVD description (English source)
gopacket provides packet processing capabilities for Go. Through version 1.7.0, multiple layer decoders use attacker-controlled lengths, counts, or offsets before validating them against packet buffers, allowing a crafted packet decoded through DecodingLayerParser or DecodeFromBytes to trigger an unrecovered panic and remotely deny service. A patch commit is available at 210f25f.