CVE-2026-65819

Отчет

A flaw was found in gopacket, a Go library for packet processing. Multiple protocol layer decoders (TLS, DHCPv4, sFlow, IPSec AH, VRRPv2, Diameter, GTPv1-U, ERSPAN II, LCM, RadioTap, Dot11, and others) use attacker-controlled length, count, or offset fields to index or slice packet buffers without first validating them against the actual buffer size. A single malformed packet triggers an out-of-bounds slice or unsigned-integer underflow panic. When packets are decoded via the high-performance DecodingLayerParser or direct DecodeFromBytes path — the common pattern used by network monitors and intrusion-detection systems — the panic is not recovered and crashes the process, causing an unauthenticated remote denial of service. Applications using only gopacket.NewPacket with default options recover the panic into an error and are not crashed. Red Hat Network Observability components (CLI and eBPF agent) ship gopacket v1.5.0 and use it for packet capture, making them vulnerable.

Меры по смягчению последствий

• Upgrade gopacket to a version containing commit 210f25f or later.
• If upgrading is not immediately possible, restrict network access to services that process untrusted packet data using gopacket. Where possible, use the recovering gopacket.NewPacket(..., gopacket.Default) code path instead of DecodingLayerParser or direct DecodeFromBytes calls, accepting the performance trade-off. Ensure that packet capture interfaces are not exposed to untrusted network segments.