CVE-2026-65819 Details
Description
gopacket provides packet processing capabilities for Go. Through version 1.7.0, multiple layer decoders use attacker-controlled lengths, counts, or offsets before validating them against packet buffers, allowing a crafted packet decoded through DecodingLayerParser or DecodeFromBytes to trigger an unrecovered panic and remotely deny service. A patch commit is available at 210f25f.
A denial-of-service vulnerability has been identified in the Gopacket library, specifically in versions prior to 1.7.0. The issue arises in several layer decoders that improperly handle attacker-controlled lengths, counts, or offsets. These decoders slice or read packet data without first validating it against the actual buffer size, leading to out-of-bounds access or unsigned-integer underflows. This flaw can be exploited by sending crafted packets that trigger a panic, causing a crash in the application. The vulnerability is particularly concerning when the affected decoders are used with 'DecodingLayerParser' or 'DecodeFromBytes', as the resulting panic is not recovered, unlike when 'gopacket.NewPacket' with default options is used.
Users can update to Gopacket version 1.7.1, where this vulnerability has been fixed. The patch involves adding proper length validations for the affected decoders before processing the packet data.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 7, 2026CISA-ADP
Assessed Aug 11, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/gopacket/gopacket/commit/210f25fb9b3ca1af2eb649936f78ad6991b6c9c5 | [email protected] | Source CodeVendor |
| https://github.com/gopacket/gopacket/releases/tag/v1.7.0 | [email protected] | Release NotesVendor |
| https://github.com/gopacket/gopacket/security/advisories/GHSA-8mcr-459q-5mx2 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | [email protected] |
| CWE-400 | Uncontrolled Resource Consumption | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| gopacket | < 1.7.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 11, 2026 | CVE Modified | CISA-ADP |
| Aug 7, 2026 | New CVE Received | [email protected] |