CVE-2026-65819
Description
A flaw was found in gopacket, a Go library for packet processing. Multiple layer decoders in gopacket use attacker-controlled lengths, counts, or offsets without proper validation against packet buffers. A remote, unauthenticated attacker can exploit this by sending a specially crafted packet, which, when decoded, triggers an unrecovered panic. This can lead to a remote Denial of Service (DoS) condition, making the affected system unavailable.
Statement
A flaw was found in gopacket, a Go library for packet processing. Multiple protocol layer decoders (TLS, DHCPv4, sFlow, IPSec AH, VRRPv2, Diameter, GTPv1-U, ERSPAN II, LCM, RadioTap, Dot11, and others) use attacker-controlled length, count, or offset fields to index or slice packet buffers without first validating them against the actual buffer size. A single malformed packet triggers an out-of-bounds slice or unsigned-integer underflow panic. When packets are decoded via the high-performance DecodingLayerParser or direct DecodeFromBytes path — the common pattern used by network monitors and intrusion-detection systems — the panic is not recovered and crashes the process, causing an unauthenticated remote denial of service. Applications using only gopacket.NewPacket with default options recover the panic into an error and are not crashed. Red Hat Network Observability components (CLI and eBPF agent) ship gopacket v1.5.0 and use it for packet capture, making them vulnerable.
Mitigation
- Upgrade gopacket to a version containing commit 210f25f or later.
- If upgrading is not immediately possible, restrict network access to services that process untrusted packet data using gopacket. Where possible, use the recovering `gopacket.NewPacket(..., gopacket.Default)` code path instead of `DecodingLayerParser` or direct `DecodeFromBytes` calls, accepting the performance trade-off. Ensure that packet capture interfaces are not exposed to untrusted network segments.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.5 | N/A | 7.5 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | None | N/A | None |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Integrity,Confidentiality,Availability
Technical Impact: Read Memory; Modify Memory; Execute Unauthorized Code or Commands
Buffer overflows often can be used to execute arbitrary code, which is usually outside the scope of a program's implicit security policy. This can often be used to subvert any other security service.
Availability
Technical Impact: Modify Memory; DoS: Crash, Exit, or Restart; DoS: Resource Consumption (CPU)
Buffer overflows generally lead to crashes. Other attacks leading to lack of availability are possible, including putting the program into an infinite loop.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
