CVE-2026-65819

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-65819", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-07-22T23:16:47.752Z", "datePublished": "2026-08-07T19:19:16.032Z", "dateUpdated": "2026-08-11T01:07:57.373Z"}, "containers": {"cna": {"title": "gopacket: Multiple layer decoders panic on crafted packets (out-of-bounds/underflow) enabling unauthenticated remote DoS via DecodingLayerParser", "problemTypes": [{"descriptions": [{"cweId": "CWE-125", "lang": "en", "description": "CWE-125: Out-of-bounds Read", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-400", "lang": "en", "description": "CWE-400: Uncontrolled Resource Consumption", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/gopacket/gopacket/security/advisories/GHSA-8mcr-459q-5mx2", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/gopacket/gopacket/security/advisories/GHSA-8mcr-459q-5mx2"}, {"name": "https://github.com/gopacket/gopacket/commit/210f25fb9b3ca1af2eb649936f78ad6991b6c9c5", "tags": ["x_refsource_MISC"], "url": "https://github.com/gopacket/gopacket/commit/210f25fb9b3ca1af2eb649936f78ad6991b6c9c5"}, {"name": "https://github.com/gopacket/gopacket/releases/tag/v1.7.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/gopacket/gopacket/releases/tag/v1.7.0"}], "affected": [{"vendor": "gopacket", "product": "gopacket", "versions": [{"version": "<= 1.7.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-07T19:19:16.032Z"}, "descriptions": [{"lang": "en", "value": "gopacket provides packet processing capabilities for Go. Through version 1.7.0, multiple layer decoders use attacker-controlled lengths, counts, or offsets before validating them against packet buffers, allowing a crafted packet decoded through DecodingLayerParser or DecodeFromBytes to trigger an unrecovered panic and remotely deny service. A patch commit is available at 210f25f."}], "source": {"advisory": "GHSA-8mcr-459q-5mx2", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-11T01:07:46.400637Z", "id": "CVE-2026-65819", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-11T01:07:57.373Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-65819", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-11T01:07:46.400637Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-11T01:07:53.719Z"}}], "cna": {"title": "gopacket: Multiple layer decoders panic on crafted packets (out-of-bounds/underflow) enabling unauthenticated remote DoS via DecodingLayerParser", "source": {"advisory": "GHSA-8mcr-459q-5mx2", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "gopacket", "product": "gopacket", "versions": [{"status": "affected", "version": "<= 1.7.0"}]}], "references": [{"url": "https://github.com/gopacket/gopacket/security/advisories/GHSA-8mcr-459q-5mx2", "name": "https://github.com/gopacket/gopacket/security/advisories/GHSA-8mcr-459q-5mx2", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/gopacket/gopacket/commit/210f25fb9b3ca1af2eb649936f78ad6991b6c9c5", "name": "https://github.com/gopacket/gopacket/commit/210f25fb9b3ca1af2eb649936f78ad6991b6c9c5", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/gopacket/gopacket/releases/tag/v1.7.0", "name": "https://github.com/gopacket/gopacket/releases/tag/v1.7.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "gopacket provides packet processing capabilities for Go. Through version 1.7.0, multiple layer decoders use attacker-controlled lengths, counts, or offsets before validating them against packet buffers, allowing a crafted packet decoded through DecodingLayerParser or DecodeFromBytes to trigger an unrecovered panic and remotely deny service. A patch commit is available at 210f25f."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "CWE-125: Out-of-bounds Read"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-400", "description": "CWE-400: Uncontrolled Resource Consumption"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-07T19:19:16.032Z"}}}, "cveMetadata": {"cveId": "CVE-2026-65819", "state": "PUBLISHED", "dateUpdated": "2026-08-11T01:07:57.373Z", "dateReserved": "2026-07-22T23:16:47.752Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-08-07T19:19:16.032Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "gopacket", "vendor": "gopacket", "versions": [{"status": "affected", "version": "<= 1.7.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "gopacket provides packet processing capabilities for Go. Through version 1.7.0, multiple layer decoders use attacker-controlled lengths, counts, or offsets before validating them against packet buffers, allowing a crafted packet decoded through DecodingLayerParser or DecodeFromBytes to trigger an unrecovered panic and remotely deny service. A patch commit is available at 210f25f."}], "id": "CVE-2026-65819", "lastModified": "2026-09-09T21:02:22.660", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-65819", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-11T01:07:46.400637Z", "version": "2.0.3"}}]}, "published": "2026-08-07T20:16:52.603", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/gopacket/gopacket/commit/210f25fb9b3ca1af2eb649936f78ad6991b6c9c5"}, {"source": "security-advisories@github.com", "url": "https://github.com/gopacket/gopacket/releases/tag/v1.7.0"}, {"source": "security-advisories@github.com", "url": "https://github.com/gopacket/gopacket/security/advisories/GHSA-8mcr-459q-5mx2"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}, {"lang": "en", "value": "CWE-400"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "github.com/gopacket/gopacket: gopacket: Remote Denial of Service via crafted packet processing", "id": "2512626", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2512626"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-805", "details": ["gopacket provides packet processing capabilities for Go. Through version 1.7.0, multiple layer decoders use attacker-controlled lengths, counts, or offsets before validating them against packet buffers, allowing a crafted packet decoded through DecodingLayerParser or DecodeFromBytes to trigger an unrecovered panic and remotely deny service. A patch commit is available at 210f25f.", "A flaw was found in gopacket, a Go library for packet processing. Multiple layer decoders in gopacket use attacker-controlled lengths, counts, or offsets without proper validation against packet buffers. A remote, unauthenticated attacker can exploit this by sending a specially crafted packet, which, when decoded, triggers an unrecovered panic. This can lead to a remote Denial of Service (DoS) condition, making the affected system unavailable."], "mitigation": {"lang": "en:us", "value": "- Upgrade gopacket to a version containing commit 210f25f or later.\n- If upgrading is not immediately possible, restrict network access to services that process untrusted packet data using gopacket. Where possible, use the recovering `gopacket.NewPacket(..., gopacket.Default)` code path instead of `DecodingLayerParser` or direct `DecodeFromBytes` calls, accepting the performance trade-off. Ensure that packet capture interfaces are not exposed to untrusted network segments."}, "name": "CVE-2026-65819", "package_state": [{"cpe": "cpe:/a:redhat:network_observ_optr:1", "fix_state": "Affected", "package_name": "network-observability/network-observability-cli-rhel9", "product_name": "Network Observability Operator"}, {"cpe": "cpe:/a:redhat:network_observ_optr:1", "fix_state": "Affected", "package_name": "network-observability/network-observability-ebpf-agent-rhel9", "product_name": "Network Observability Operator"}], "public_date": "2026-08-07T19:19:16Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-65819\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-65819\nhttps://github.com/gopacket/gopacket/commit/210f25fb9b3ca1af2eb649936f78ad6991b6c9c5\nhttps://github.com/gopacket/gopacket/releases/tag/v1.7.0\nhttps://github.com/gopacket/gopacket/security/advisories/GHSA-8mcr-459q-5mx2"], "statement": "A flaw was found in gopacket, a Go library for packet processing. Multiple protocol layer decoders (TLS, DHCPv4, sFlow, IPSec AH, VRRPv2, Diameter, GTPv1-U, ERSPAN II, LCM, RadioTap, Dot11, and others) use attacker-controlled length, count, or offset fields to index or slice packet buffers without first validating them against the actual buffer size. A single malformed packet triggers an out-of-bounds slice or unsigned-integer underflow panic. When packets are decoded via the high-performance DecodingLayerParser or direct DecodeFromBytes path \u2014 the common pattern used by network monitors and intrusion-detection systems \u2014 the panic is not recovered and crashes the process, causing an unauthenticated remote denial of service. Applications using only gopacket.NewPacket with default options recover the panic into an error and are not crashed. Red Hat Network Observability components (CLI and eBPF agent) ship gopacket v1.5.0 and use it for packet capture, making them vulnerable.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.7.0]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "gopacket", "source": "cna", "vendor": "gopacket"}, "product": "gopacket", "vendor": "gopacket"}], "created": "2026-08-07T20:30:17.426417+00:00", "updated": "2026-08-11T02:15:03.914825+00:00", "vendors": ["gopacket", "gopacket$PRODUCT$gopacket"]}