Denial of Service Vulnerability in gopacket by Google

CVE-2026-65819

What is CVE-2026-65819?

The gopacket library, used for packet processing in Go, has a vulnerability that affects its ability to handle certain crafted packets. Specifically, multiple layer decoders within gopacket fail to properly validate attacker-controlled lengths, counts, or offsets before using them in packet buffers. This oversight can lead to an unrecovered panic, resulting in a remote denial of service condition. To mitigate this issue, a patch has been published, addressing the vulnerability and restoring the stability of the application.

References