CVE-2026-65819CWE-125CWE-400denial-of-service

CVE-2026-65819

High · published August 8, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
50.9
In the wild
Unconfirmed
What it is

gopacket provides packet processing capabilities for Go. Through version 1.7.0, multiple layer decoders use attacker-controlled lengths, counts, or offsets before validating them against packet buffers, allowing a crafted packet decoded through DecodingLayerParser or DecodeFromBytes to trigger an unrecovered panic and remotely deny service. A patch commit is available at 210f25f.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00657 · 50.9th percentile
Weaknesses
CWE-125 · Out-of-bounds Read; CWE-400 · Uncontrolled Resource Consumption
Published
2026-08-08T00:16Z
References (3)
https://github.com/gopacket/gopacket/commit/210f25fb9b3ca1af2eb649936f78ad6991b6c9c5 · [email protected]https://github.com/gopacket/gopacket/releases/tag/v1.7.0 · [email protected]https://github.com/gopacket/gopacket/security/advisories/GHSA-8mcr-459q-5mx2 · [email protected]
EPSS history
Timeline
  • 07 AUG 19:19Z
    gopacket: Multiple layer decoders panic on crafted packets (out-of-bounds/underflow) enabling unauthenticated remote DoS via DecodingLayerParser
    cvelistv5