EUVD-2026-40148
GHSA-9f2x-4g7j-783f
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable parser, no auth required, but high complexity limits exploitation; scope unchanged as impact stays within the consuming process.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
1DescriptionCVE.org
A vulnerability was determined in seladb PcapPlusPlus 25.05. The impacted element is the function pcpp::SSLClientHelloMessage::getHandshakeVersion of the file Packet++/src/SSLHandshake.cpp of the component TLS Hello Handler. Executing a manipulation of the argument handshakeVersion can lead to heap-based buffer overflow. It is possible to launch the attack remotely. This attack is characterized by high complexity. The exploitability is regarded as difficult. The exploit has been publicly disclosed and may be utilized. This patch is called 98e671010bc7c87b95898c22ae289220ae92542b. It is best practice to apply a patch to resolve this issue.
AnalysisAI
Heap-based buffer overflow in PcapPlusPlus 25.05's TLS Hello Handler allows remote unauthenticated attackers to trigger memory corruption via a crafted handshakeVersion argument in the SSLClientHelloMessage::getHandshakeVersion function of SSLHandshake.cpp. Successful exploitation requires high attack complexity, limiting practical impact, but a public proof-of-concept (poc.zip) has been disclosed via GitHub. This vulnerability is not confirmed in CISA KEV, and its CVSS 4.0 score of 2.9 reflects the constrained, low-impact nature of the flaw despite the public exploit availability.
Technical ContextAI
PcapPlusPlus (seladb/PcapPlusPlus) is an open-source, multi-platform C++ library for network packet capture, parsing, and crafting, built atop libpcap and WinPcap/Npcap. The vulnerability resides in Packet++/src/SSLHandshake.cpp within the pcpp::SSLClientHelloMessage::getHandshakeVersion() function, which is responsible for parsing the handshakeVersion field from TLS ClientHello messages. CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) identifies the root cause class: the function does not adequately validate or bounds-check the handshakeVersion input before performing heap memory operations, allowing a specially crafted TLS ClientHello packet to trigger a write beyond the allocated heap buffer. This class of bug commonly enables memory corruption, potentially leading to crashes or, under precise heap grooming conditions, code execution. The CPE corresponds to seladb PcapPlusPlus version 25.05 as identified in the NVD reference and GitHub issue #2151.
RemediationAI
The upstream fix is available as commit 98e671010bc7c87b95898c22ae289220ae92542b, delivered via pull request #2161 (https://github.com/seladb/PcapPlusPlus/pull/2161). Developers and maintainers using PcapPlusPlus 25.05 should update their dependency to a version of the repository incorporating this commit. A tagged patched release version has not been independently confirmed from the available data - treat this as an upstream fix available via PR/commit pending a formal release tag. As a compensating control where immediate patching is not feasible, consider adding application-level input validation on the handshakeVersion field before passing TLS ClientHello packets to PcapPlusPlus parsing functions; this adds a bounds or sanity check at the integration boundary and reduces the risk of triggering the vulnerable code path. An alternative mitigation is to restrict the network interfaces or traffic sources from which the consuming application accepts TLS packets to trusted hosts only, reducing attacker-controlled input reaching the vulnerable parser. Note that neither compensating control eliminates the underlying vulnerability.
Same weakness CWE-119 – Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today