CVE-2026-65819: gopacket: Multiple layer decoders panic on crafted packets (out-of-bounds/underflow) enabling unauthenticated remote DoS via DecodingLayerParser
gopacket provides packet processing capabilities for Go. Through version 1.7.0, multiple layer decoders use attacker-controlled lengths, counts, or offsets before validating them against packet buffers, allowing a crafted packet decoded through DecodingLayerParser or DecodeFromBytes to trigger an unrecovered panic and remotely deny service. A patch commit is available at 210f25f.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
gopacketto a version that resolves this vulnerability.Fixed in 1.7.0Patch 210f25f - Compensating control
Mitigate unauthenticated remote DoS by restricting exposure of any endpoint or service that processes attacker-supplied packets using gopacket's DecodingLayerParser or DecodeFromBytes (e.g., only allow trusted sources / limit network access at the firewall or via ACLs).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-65819?
The severity of CVE-2026-65819 is rated high with a score of 7.5.
What is the risk associated with CVE-2026-65819?
CVE-2026-65819 has a risk level of 43, indicating a significant potential impact.
How can I fix CVE-2026-65819?
To fix CVE-2026-65819, upgrade gopacket to version 1.7.0 or later.
What kind of attack does CVE-2026-65819 enable?
CVE-2026-65819 allows unauthenticated remote denial of service (DoS) attacks via crafted packets.
Which software is affected by CVE-2026-65819?
The vulnerability CVE-2026-65819 affects gopacket versions prior to 1.7.0.