CVEvulnerability

CVE-2026-65819

7.5 HIGH Published 2026-08-07 Modified 2026-09-09 Official page ↗
Status
Deferred
Published
2026-08-07
Last modified
2026-09-09
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-125, CWE-400

Description

gopacket provides packet processing capabilities for Go. Through version 1.7.0, multiple layer decoders use attacker-controlled lengths, counts, or offsets before validating them against packet buffers, allowing a crafted packet decoded through DecodingLayerParser or DecodeFromBytes to trigger an unrecovered panic and remotely deny service. A patch commit is available at 210f25f.

Related

Weakness · CWE (2)

  • CWE-125 Out-of-bounds Read weakness
  • CWE-400 Uncontrolled Resource Consumption weakness

References