Skip to main content
View

Vulnerability Assessment

Weakness
CWE
CWE-770
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource allocation limits
MITRE ATT&CK

1 technique across 1 tactic: Impact

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Impact

CVSS score of 5.3 (MEDIUM). Attack characteristics: network attack vector, low complexity, no privileges required, no user interaction not required.
Exploit ScenarioDerived

A remote attacker could exhaust system resources through uncontrolled allocation by sending crafted requests to the affected application. No authentication is required to exploit this vulnerability.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 2.8% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAI

sf-pcapng.c in libpcap before 1.9.1 does not properly validate the PHB header length before allocating memory. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Allocation of Resources Without Limits vulnerability could allow attackers to exhaust system resources through uncontrolled allocation.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Set resource limits, implement rate limiting, validate input sizes.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

This vulnerability is classified as Allocation of Resources Without Limits (CWE-770), which allows attackers to exhaust system resources through uncontrolled allocation. sf-pcapng.c in libpcap before 1.9.1 does not properly validate the PHB header length before allocating memory. Affected products include: Tcpdump Libpcap, Debian Debian Linux, Opensuse Leap, Oracle Communications Operations Monitor, Apple Ipados. Version information: before 1.9.1.

Know when Libpcap gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 5.3 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None

DescriptionNVD

sf-pcapng.c in libpcap before 1.9.1 does not properly validate the PHB header length before allocating memory.

Threat Intelligence Overview

EPSS Score
2.8%
Top 15% exploitable
Data Quality
3 sources
Confidence: Low
NVD CVE.org EPSS GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 2.8%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
Yes
Human Impact· derived
Medium

Priority Score

29
Low Medium High Critical
KEV: 0
EPSS: +3
CVSS: +26
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

Affected Products (CPE)NVD

cpe:2.3:a:tcpdump:libpcap:*:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*
cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_operations_monitor:3.4:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_operations_monitor:4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_operations_monitor:4.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_operations_monitor:4.2:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_operations_monitor:4.3:*:*:*:*:*:*:*
cpe:2.3:o:apple:ipados:13.3:*:*:*:*:*:*:*
cpe:2.3:o:apple:iphone_os:13.3:*:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2019-007:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-002:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:10.15.2:*:*:*:*:*:*:*
cpe:2.3:o:apple:tvos:13.3:*:*:*:*:*:*:*
cpe:2.3:o:apple:watchos:6.1.1:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*
+ 6 more

More in Libpcap

View all
CVE-2026-0799 HIGH
8.7 Sep 05

Unvalidated BPF scratch-register array index in libpcap's user-space BPF interpreter allows a local attacker with low pr
CVE-2026-6554 HIGH
7.5 Sep 05

Denial of service in libpcap before 1.10.7 allows an unauthenticated remote attacker to hang the offline BPF filter inte
CVE-2019-15163 HIGH
7.5 Oct 03

rpcapd/daemon.c in libpcap before 1.9.1 allows attackers to cause a denial of service (NULL pointer dereference and daem
CVE-2026-6244 MEDIUM
5.5 Sep 05

Division by zero in libpcap's BPF interpreter can crash any application using the library when processing a crafted filt
CVE-2026-31911 MEDIUM
5.5 Sep 05

Process termination via crafted BPF filter in libpcap allows a local attacker with low privileges to crash any applicati
CVE-2026-31912 MEDIUM
5.5 Sep 05

Out-of-bounds memory reads in libpcap's userland BPF interpreter allow a local attacker who can supply a crafted filter

CVE-2019-15164 MEDIUM
5.3 Oct 03

rpcapd/daemon.c in libpcap before 1.9.1 allows SSRF because a URL may be provided as a capture source. Rated medium seve
CVE-2019-15162 MEDIUM
5.3 Oct 03

rpcapd/daemon.c in libpcap before 1.9.1 on non-Windows platforms provides details about why authentication failed, which
CVE-2019-15161 MEDIUM
5.3 Oct 03

rpcapd/daemon.c in libpcap before 1.9.1 mishandles certain length values because of reuse of a variable. Rated medium se
CVE-2026-18238 MEDIUM
5.0 Sep 05

Remote memory disclosure in libpcap's rpcap client allows a malicious or compromised rpcap server to cause a connected c
CVE-2024-8006 MEDIUM
4.4 Aug 31

Remote packet capture support is disabled by default in libpcap. Rated medium severity (CVSS 4.4), this vulnerability is
CVE-2026-18313 MEDIUM
4.3 Sep 05

Memory exhaustion in libpcap's rpcapd remote capture daemon allows an authenticated remote client to degrade or crash th

Same weakness CWE-770 – Allocation of Resources Without Limits or Throttling

View all
CVE-2017-8779 HIGH POC
7.5
CVE-2025-53521 CRITICAL POC
9.3
CVE-2024-28182 MEDIUM
5.3
CVE-2023-2650 MEDIUM
6.5
CVE-2017-5850 HIGH POC
7.5
CVE-2025-26682 HIGH
7.5
CVE-2022-32206 MEDIUM POC
6.5
CVE-2023-24998 HIGH
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

References

Advisories & patches
PATCH https://github.com/the-tcpdump-group/libpcap/commit/87d6bef033062f969e70fa40c43dfd945d5a20ab PATCH https://github.com/the-tcpdump-group/libpcap/commit/a5a36d9e82dde7265e38fe1f87b7f11c461c29f6 ADVISORY https://www.tcpdump.org/public-cve-list.txt REF http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00051.html REF http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00052.html REF http://seclists.org/fulldisclosure/2019/Dec/26 REF https://github.com/the-tcpdump-group/libpcap/blob/libpcap-1.9/CHANGES REF https://lists.debian.org/debian-lts-announce/2019/10/msg00031.html REF https://lists.debian.org/debian-lts-announce/2021/12/msg00014.html REF https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5P5K3DQ4TFSZBDB3XN4CZNJNQ3UIF3D3/ REF https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GBIEKWLNIR62KZ5GA7EDXZS52HU6OE5F/ REF https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UZTIPUWABYUE5KQOLCKAW65AUUSB7QO6/ REF https://seclists.org/bugtraq/2019/Dec/23 REF https://support.apple.com/kb/HT210785 REF https://support.apple.com/kb/HT210788 REF https://support.apple.com/kb/HT210789 REF https://support.apple.com/kb/HT210790 REF https://usn.ubuntu.com/4221-1/ REF https://usn.ubuntu.com/4221-2/ REF https://www.oracle.com/security-alerts/cpuapr2020.html

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy