What is the CVSS score of EUVD-2026-54609?

EUVD-2026-54609 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.4%.

Which versions of gopacket are affected by EUVD-2026-54609?

gopacket, a widely-used Go packet processing library, contains a remote denial-of-service vulnerability (CVE-2026-65819) that can crash any Go application processing untrusted network packets.

How to fix or mitigate EUVD-2026-54609?

Within 24 hours, inventory all Go applications using gopacket and determine which are exposed to untrusted or external network traffic. Within 7 days, implement network segmentation and packet source validation to restrict input to trusted networks only, and configure isolated goroutine processing with restart handlers to contain crashes. Within 30 days, establish vendor patch monitoring for gopacket updates; if no patch is released within 30 days, evaluate alternative packet processing libraries and plan either a library replacement or full network edge validation to prevent malformed packets from reaching the application layer.

gopacket EUVD-2026-54609

| CVE-2026-65819 HIGH

Out-of-bounds Read (CWE-125)

2026-08-07 GitHub_M

Buffer Overflow Information Disclosure Gopacket

7.5

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Network-delivered crafted packets require no privileges or interaction; impact is crash-only with no confidentiality or integrity effect confirmed.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Red Hat

7.5 HIGH

qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

Aug 07, 2026 - 20:21 vuln.today

Analysis Generated

Aug 07, 2026 - 20:21 vuln.today

CVE Published

Aug 07, 2026 - 19:19 cve.org

HIGH 7.5

DescriptionCVE.org

gopacket provides packet processing capabilities for Go. Through version 1.7.0, multiple layer decoders use attacker-controlled lengths, counts, or offsets before validating them against packet buffers, allowing a crafted packet decoded through DecodingLayerParser or DecodeFromBytes to trigger an unrecovered panic and remotely deny service. A patch commit is available at 210f25f.

AnalysisAI

Remote denial of service in gopacket through version 1.7.0 can crash any Go application that processes untrusted network packets via DecodingLayerParser or direct DecodeFromBytes calls. Eleven protocol decoders - including TLS, DHCPv4, GTPv1U, IPSec AH, Diameter, and RadioTap - consume attacker-controlled length, count, or offset fields from raw packet headers before verifying them against the actual buffer size, causing an unrecovered Go runtime panic that terminates the processing goroutine or application. No active exploitation has been confirmed (not listed in CISA KEV), but the zero-privilege network attack surface makes this a credible operational risk for Go-based network monitoring, packet capture, and security tooling.

Technical ContextAI

gopacket is a Go library providing packet capture and protocol layer decoding, analogous to combining libpcap bindings with a layered parser framework. CWE-125 (Out-of-bounds Read) is the root cause: fields such as HardwareLen in DHCPv4, MessageLength in Diameter, ActualLength in IPSec AH, extension header indices in GTPv1U and RadioTap, and count fields in VRRPv2 are read directly from raw packet bytes and then used as slice indices or lengths without first confirming the buffer is large enough. In Go, an out-of-bounds slice operation raises a runtime panic that propagates unless explicitly recovered. Critically, the DecodingLayerParser path - unlike gopacket.NewPacket with default options - does not install a recover() handler, so the panic is unrecovered and terminates the caller. The commit diff confirms twelve distinct decoder sites were patched by adding minimum-length guards before unsafe slice operations. CPE cpe:2.3:a:gopacket:gopacket:*:*:*:*:*:*:*:* covers all versions through v1.7.0.

RemediationAI

The upstream fix is available at commit 210f25fb9b3ca1af2eb649936f78ad6991b6c9c5 (https://github.com/gopacket/gopacket/commit/210f25fb9b3ca1af2eb649936f78ad6991b6c9c5); however, a tagged release incorporating this fix has not been independently confirmed from the available references - v1.7.0 remains the most recent known tag and is still vulnerable. Consumers should pin their Go module to the fix commit using a replace directive or monitor the releases page at https://github.com/gopacket/gopacket/releases for a patched tagged release. As a compensating control, wrap DecodingLayerParser decode calls in a recover() defer to prevent panics from crashing the process - note this adds per-packet overhead and may silently swallow legitimate parsing errors that callers should handle. Alternatively, switch from DecodingLayerParser to gopacket.NewPacket with default options, which internally recovers panics; this trades some decode throughput for resilience. Applications that can allowlist or sanitize input packets before passing them to gopacket should do so at the network boundary.