Insecure Deserialization Vulnerability in Scapy by Secdev

CVE-2025-71463

What is CVE-2025-71463?

Scapy, prior to version 2.7.0, is susceptible to an insecure deserialization flaw within the load_session function. This vulnerability can be exploited by an attacker providing a maliciously crafted pickle session file (.pkl.gz). By tricking users into loading this compromised file through the -s option or the conf.session setting, attackers can inadvertently execute embedded Python code due to the incorrect handling of the reduce() method. Users are advised to upgrade to the latest version to mitigate the risk associated with this vulnerability.

References