CVE-2026-6554

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-6554", "assignerOrgId": "cfdbb673-b408-4d03-89c1-c3d73ed80896", "state": "PUBLISHED", "assignerShortName": "Tcpdump", "dateReserved": "2026-04-17T22:00:24.313Z", "datePublished": "2026-09-05T18:51:02.338Z", "dateUpdated": "2026-10-22T20:08:13.106Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "modules": ["BPF interpreter"], "product": "libpcap", "programFiles": ["bpf_filter.c"], "programRoutines": [{"name": "pcapint_filter_with_aux_data()"}], "repo": "https://github.com/the-tcpdump-group/libpcap/", "vendor": "The Tcpdump Group", "versions": [{"lessThan": "1.10.7", "status": "affected", "version": "0", "versionType": "semver"}]}], "configurations": [{"lang": "en", "value": "An uncommon vulnerable configuration is an application that uses pcap_offline_filter() or bpf_filter() with an externally-supplied compiled filter program without validating the program first."}, {"lang": "en", "value": "A common vulnerable configuration is an application that uses pcap_compile() to compile a filter expression, but the expression uses the 'protochain' primitive. Support for this primitive is conditional, but is enabled by default."}], "credits": [{"lang": "en", "type": "reporter", "value": "Kaixuan LI has discovered the crafted filter program attack vector"}, {"lang": "en", "type": "finder", "value": "Denis Ovsienko has discovered the 'protochain' attack vector"}], "descriptions": [{"lang": "en", "value": "libpcap BPF interpreter treats the offset in the 'ja L' BPF instruction as a signed integer to implement looping via backward jumps, but it does not limit the number of loop iterations. A crafted filter program or the 'protochain' primitive used on a crafted network packet can cause the interpreter to loop infinitely."}], "exploits": [{"lang": "en", "value": "Functional exploits exist for both attack vectors."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-835", "description": "CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "cfdbb673-b408-4d03-89c1-c3d73ed80896", "shortName": "Tcpdump", "dateUpdated": "2026-10-22T17:28:27.086Z"}, "references": [{"tags": ["patch"], "url": "https://github.com/the-tcpdump-group/libpcap/commit/ff3c83475ac303c6b681c52ad0b6e14795a8e0ce"}], "solutions": [{"lang": "en", "value": "Upgrade to libpcap 1.10.7."}], "source": {"discovery": "UNKNOWN"}, "title": "infinte loop in libpcap before 1.10.7", "workarounds": [{"lang": "en", "value": "Do not use filter programs that have been compiled outside of libpcap. Build libpcap without the 'protochain' primitive support."}], "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-08T15:14:56.820512Z", "id": "CVE-2026-6554", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-08T15:15:06.137Z"}}, {"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/10/22/3"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-10-22T20:08:13.106Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/10/22/3"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-10-22T20:08:13.106Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-6554", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-08T15:14:56.820512Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-08T15:15:00.849Z"}}], "cna": {"title": "infinte loop in libpcap before 1.10.7", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "reporter", "value": "Kaixuan LI has discovered the crafted filter program attack vector"}, {"lang": "en", "type": "finder", "value": "Denis Ovsienko has discovered the 'protochain' attack vector"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/the-tcpdump-group/libpcap/", "vendor": "The Tcpdump Group", "modules": ["BPF interpreter"], "product": "libpcap", "versions": [{"status": "affected", "version": "0", "lessThan": "1.10.7", "versionType": "semver"}], "programFiles": ["bpf_filter.c"], "defaultStatus": "unaffected", "programRoutines": [{"name": "pcapint_filter_with_aux_data()"}]}], "exploits": [{"lang": "en", "value": "Functional exploits exist for both attack vectors."}], "solutions": [{"lang": "en", "value": "Upgrade to libpcap 1.10.7."}], "references": [{"url": "https://github.com/the-tcpdump-group/libpcap/commit/ff3c83475ac303c6b681c52ad0b6e14795a8e0ce", "tags": ["patch"]}], "workarounds": [{"lang": "en", "value": "Do not use filter programs that have been compiled outside of libpcap. Build libpcap without the 'protochain' primitive support."}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "libpcap BPF interpreter treats the offset in the 'ja L' BPF instruction as a signed integer to implement looping via backward jumps, but it does not limit the number of loop iterations. A crafted filter program or the 'protochain' primitive used on a crafted network packet can cause the interpreter to loop infinitely."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-835", "description": "CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')"}]}], "configurations": [{"lang": "en", "value": "An uncommon vulnerable configuration is an application that uses pcap_offline_filter() or bpf_filter() with an externally-supplied compiled filter program without validating the program first."}, {"lang": "en", "value": "A common vulnerable configuration is an application that uses pcap_compile() to compile a filter expression, but the expression uses the 'protochain' primitive. Support for this primitive is conditional, but is enabled by default."}], "providerMetadata": {"orgId": "cfdbb673-b408-4d03-89c1-c3d73ed80896", "shortName": "Tcpdump", "dateUpdated": "2026-10-22T17:28:27.086Z"}}}, "cveMetadata": {"cveId": "CVE-2026-6554", "state": "PUBLISHED", "dateUpdated": "2026-10-22T20:08:13.106Z", "dateReserved": "2026-04-17T22:00:24.313Z", "assignerOrgId": "cfdbb673-b408-4d03-89c1-c3d73ed80896", "datePublished": "2026-09-05T18:51:02.338Z", "assignerShortName": "Tcpdump"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "modules": ["BPF interpreter"], "product": "libpcap", "programFiles": ["bpf_filter.c"], "programRoutines": [{"name": "pcapint_filter_with_aux_data()"}], "repo": "https://github.com/the-tcpdump-group/libpcap/", "vendor": "The Tcpdump Group", "versions": [{"lessThan": "1.10.7", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@tcpdump.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "libpcap BPF interpreter treats the offset in the 'ja L' BPF instruction as a signed integer to implement looping via backward jumps, but it does not limit the number of loop iterations. A crafted filter program or the 'protochain' primitive used on a crafted network packet can cause the interpreter to loop infinitely."}], "id": "CVE-2026-6554", "lastModified": "2026-10-22T21:17:21.727", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security@tcpdump.org", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-6554", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-09-08T15:14:56.820512Z", "version": "2.0.3"}}]}, "published": "2026-09-05T19:16:56.067", "references": [{"source": "security@tcpdump.org", "url": "https://github.com/the-tcpdump-group/libpcap/commit/ff3c83475ac303c6b681c52ad0b6e14795a8e0ce"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2026/10/22/3"}], "sourceIdentifier": "security@tcpdump.org", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-835"}], "source": "security@tcpdump.org", "type": "Secondary"}]}

{"bugzilla": {"description": "libpcap: libpcap: Denial of Service via infinite loop in BPF interpreter", "id": "2529091", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2529091"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-835", "details": ["libpcap BPF interpreter treats the offset in the 'ja L' BPF instruction as a signed integer to implement looping via backward jumps, but it does not limit the number of loop iterations. In particular uncommon use cases a crafted filter program can cause the interpreter to loop infinitely.", "A flaw was found in libpcap. The Berkeley Packet Filter (BPF) interpreter incorrectly handles offsets in 'ja L' instructions, allowing backward jumps without limiting loop iterations. A local attacker could provide a specially crafted filter program, leading to an infinite loop and causing a Denial of Service (DoS) condition."], "name": "CVE-2026-6554", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "libpcap", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Fix deferred", "package_name": "libpcap", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "libpcap", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "libpcap", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "libpcap", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-09-05T18:51:02Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-6554\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-6554\nhttps://github.com/the-tcpdump-group/libpcap/commit/ff3c83475ac303c6b681c52ad0b6e14795a8e0ce"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.10.7)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "libpcap", "source": "cna", "vendor": "The Tcpdump Group"}, "product": "libpcap", "vendor": "tcpdump"}], "created": "2026-09-05T20:30:17.796836+00:00", "updated": "2026-10-23T00:00:16.053032+00:00", "vendors": ["tcpdump", "tcpdump$PRODUCT$libpcap"]}