CVE-2026-65819
Received Received - Intake

Out-of-Bounds Read in gopacket Packet Decoding

Publication date: 2026-08-07

Last updated on: 2026-08-07

Assigner: GitHub, Inc.

Description
gopacket provides packet processing capabilities for Go. Through version 1.7.0, multiple layer decoders use attacker-controlled lengths, counts, or offsets before validating them against packet buffers, allowing a crafted packet decoded through DecodingLayerParser or DecodeFromBytes to trigger an unrecovered panic and remotely deny service. A patch commit is available at 210f25f.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-07
Last Modified
2026-08-07
Generated
2026-08-08
AI Q&A
2026-08-07
EPSS Evaluated
N/A
NVD
CVE-2026-65819
EUVD
EUVD-2026-54609

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
github gopacket 1.7.0
github gopacket to 1.7.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-65819 is a vulnerability in the gopacket library where multiple packet decoders use attacker-controlled length, count, or offset values to process network packets before validating them against the actual buffer size. This can cause runtime panics like out-of-bounds errors or integer underflows, crashing the application. The issue affects decoders for protocols like TLS, DHCPv4, and others.

Detection Guidance

Detecting this vulnerability requires monitoring for crashes or panics in applications using gopacket versions prior to 1.7.1. Check logs for runtime panics like out-of-bounds slice errors or unsigned-integer underflows. Use packet capture tools like tcpdump or Wireshark to inspect network traffic for malformed packets targeting affected protocols (TLS, DHCPv4, etc.).

Commands to check gopacket version: grep -r "gopacket" go.mod or go.sum. Monitor application logs for panic messages or crashes during packet processing.

Impact Analysis

This vulnerability allows an unauthenticated remote attacker to send a crafted packet that triggers a crash in applications using affected gopacket decoders. This results in a denial-of-service (DoS) condition, disrupting service availability. The impact is severe as a single malformed packet can crash the entire application.

Compliance Impact

This vulnerability primarily causes denial-of-service (DoS) conditions by crashing applications processing network packets. For compliance standards like GDPR or HIPAA, which require data availability and integrity, such disruptions could lead to violations if systems fail to process critical data or maintain service levels. The impact is indirect but significant as it may prevent systems from functioning as intended.

Mitigation Strategies

Upgrade to gopacket v1.7.1 or later immediately. If upgrading is not possible, disable packet parsing for affected protocols or implement strict input validation before passing data to gopacket decoders. Ensure applications using gopacket handle errors from DecodingLayerParser or DecodeFromBytes to avoid crashes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-65819. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart