Read the docs
TI-2026-46904 Aliases CVE-2026-65819

Out-of-bounds read in gopacket

Priority LOW 39CWE-125Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 1 fixed, 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-125 and the CVSS impact.

Summary

gopacket provides packet processing capabilities for Go. Through version 1.7.0, multiple layer decoders use attacker-controlled lengths, counts, or offsets before validating them against packet buffers, allowing a crafted packet decoded through DecodingLayerParser or DecodeFromBytes to trigger an unrecovered panic and remotely deny service. A patch commit is available at 210f25f.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00361 30th percentileScored 2026-11-07
Fix Partial Red Hat: 1 advisoryRed Hat: 1 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
gopacketgopacketup to 1.7.0—No fix listedCNA
  • gopacket Vendorgopacket Affected up to 1.7.0 Fixed in — No fix listed CNA

Remediation

Red Hat 1 advisory

  • RHSA-2026:70593 Released 2026-09-23 · Red Hat rating Important
    Network Observability 1.12.3 for OpenShift
    • Network Observability (NETOBSERV) 1.12.3 registry.redhat.io/network-observability/network-observability-cli-rhel9, registry.redhat.io/network-observability/network-observability-console-plugin-pf5-rhel9, registry.redhat.io/network-observability/network-observability-console-plugin-rhel9

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Network Observability OperatorAffectedNo fix yet
Network Observability (NETOBSERV) 1.12.3Fixed RHSA-2026:70593
Not affected: 1 product
  • Network Observability (NETOBSERV) 1.12.3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-65819
  2. 2026-10-11 EPSS moved to the 50th–90th percentile
  3. 2026-11-02 EPSS moved to the below the 50th percentile
  4. 2026-11-03 Priority changed: MEDIUM → LOW

References

Other 3

  • TI-2026-39239 Integer underflow in gopacket CVSS 4.0MEDIUM 6.9
  • TI-2026-39226 Resource allocation without limits in gopacket CVSS 4.0MEDIUM 6.9
  • TI-2026-83212 Out-of-bounds panics in gopacket SCTP decoding from crafted segments CVSS 3.1MEDIUM 5.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences