CVE catalog

CVE-2026-65819

gopacket provides packet processing capabilities for Go. Through version 1.7.0, multiple layer decoders use attacker-controlled lengths, counts, or offsets before validating them against packet buffer

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.66% · Oct 25, 2026

gopacket provides packet processing capabilities for Go. Through version 1.7.0, multiple layer decoders use attacker-controlled lengths, counts, or offsets before validating them against packet buffers, allowing a crafted packet decoded through DecodingLayerParser or DecodeFromBytes to trigger an unrecovered panic and remotely deny service. A patch commit is available at 210f25f.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiangopacketsid1.1.19-6.2vulnerable
Debiangopacketforky1.1.19-6.2vulnerable
Debiangopackettrixie1.1.19-6.2vulnerable
Debiangopacketbookworm1.1.19-3vulnerable
Debiangolang-github-gopacket-gopacketsid1.3.0-2vulnerable
Debiangolang-github-gopacket-gopacketforky1.3.0-2vulnerable
Debiangolang-github-gopacket-gopackettrixie1.3.0-2vulnerable
Debiangolang-github-gopacket-gopacketbookworm1.0.0-1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiangopacketsourcesid(unfixed)not yet assignedNot reportedNot reported
Debiangopacketsourceforky(unfixed)not yet assignedNot reportedNot reported
Debiangopacketsourcetrixie(unfixed)not yet assignedNot reportedNot reported
Debiangopacketsourcebookworm(unfixed)not yet assignedNot reportedNot reported
Debiangolang-github-gopacket-gopacketsourcesid(unfixed)not yet assignedNot reported[1144416]
Debiangolang-github-gopacket-gopacketsourceforky(unfixed)not yet assignedNot reported[1144416]
Debiangolang-github-gopacket-gopacketsourcetrixie(unfixed)not yet assignedNot reported[1144416]
Debiangolang-github-gopacket-gopacketsourcebookworm(unfixed)not yet assignedNot reported[1144416]

[Debian bug #1144416]

Notes

[trixie] gopacket: Minor issue [bookworm] gopacket: Minor issue [trixie] golang-github-gopacket-gopacket: Minor issue [bookworm] golang-github-gopacket-gopacket: Limited support

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [golang-github-google-gopacket-dev]Affected

    Source package: [gopacket]

    Details (2)

    • 1.1.19-3 · all · bookworm

      Affected

      nvd · gopacket · debian · bookworm; nvd · gopacket · debian · 12

    • 1.1.19-3 · all · bookworm

      Affected

      nvd · gopacket · debian · bookworm; nvd · gopacket · debian · 12

  • [golang-github-gopacket-gopacket-dev]Affected

    Source package: [golang-github-gopacket-gopacket]

    Details (2)

    • 1.0.0-1 · all · bookworm

      Affected

      nvd · golang-github-gopacket-gopacket · debian · bookworm; nvd · golang-github-gopacket-gopacket · debian · 12

    • 1.0.0-1 · all · bookworm

      Affected

      nvd · golang-github-gopacket-gopacket · debian · bookworm; nvd · golang-github-gopacket-gopacket · debian · 12

[Debian 13 (Trixie)]

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]