Vulnerability Description
gopacket provides packet processing capabilities for Go. Through version 1.7.0, multiple layer decoders use attacker-controlled lengths, counts, or offsets before validating them against packet buffers, allowing a crafted packet decoded through DecodingLayerParser or DecodeFromBytes to trigger an unrecovered panic and remotely deny service. A patch commit is available at 210f25f.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/gopacket/gopacket/commit/210f25fb9b3ca1af2eb649936f78ad6991b6
- https://github.com/gopacket/gopacket/releases/tag/v1.7.0
- https://github.com/gopacket/gopacket/security/advisories/GHSA-8mcr-459q-5mx2
FAQ
What is CVE-2026-65819?
CVE-2026-65819 is a vulnerability with a CVSS score of 7.5 (HIGH). gopacket provides packet processing capabilities for Go. Through version 1.7.0, multiple layer decoders use attacker-controlled lengths, counts, or offsets before validating them against packet buffer...
How severe is CVE-2026-65819?
CVE-2026-65819 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-65819?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.