CVE-2026-13587

A vulnerability was found in seladb PcapPlusPlus 25.05. The affected element is the function parse_by_block_type of the file light_pcapng.c of the component LightPcapNg Parser. Performing a manipulation of the argument captured_packet_length results in heap-based buffer overflow. It is possible to initiate the attack remotely. The attack's complexity is rated as high. The exploitability is described as difficult. The exploit has been made public and could be used.

A vulnerability was found in seladb PcapPlusPlus 25.05. The affected element is the function parse_by_block_type of the file light_pcapng.c of the component LightPcapNg Parser. Performing a manipulation of the argument captured_packet_length results in heap-based buffer overflow. It is possible to initiate the attack remotely. The attack's complexity is rated as high. The exploitability is described as difficult. The exploit has been made public and could be used.

A vulnerability was found in seladb PcapPlusPlus 25.05. The affected element is the function parse_by_block_type of the file light_pcapng.c of the component LightPcapNg Parser. Performing a manipulation of the argument captured_packet_length results in heap-based buffer overflow. It is possible to initiate the attack remotely. The attack's complexity is rated as high. The exploitability is described as difficult. The exploit has been made public and could be used.

A vulnerability was found in seladb PcapPlusPlus 25.05. The affected element is the function parse_by_block_type of the file light_pcapng.c of the component LightPcapNg Parser. Performing a manipulation of the argument captured_packet_length results in heap-based buffer overflow. It is possible to initiate the attack remotely. The attack's complexity is rated as high. The exploitability is described as difficult. The exploit has been made public and could be used.

A vulnerability was found in seladb PcapPlusPlus 25.05. The affected element is the function parse_by_block_type of the file light_pcapng.c of the component LightPcapNg Parser. Performing a manipulation of the argument captured_packet_length results in heap-based buffer overflow. It is possible to initiate the attack remotely. The attack's complexity is rated as high. The exploitability is described as difficult. The exploit has been made public and could be used.

These are all security issues fixed in the pcapplusplus-devel-26.07-1.1 package on the GA media of openSUSE Tumbleweed.

This update for pcapplusplus fixes the following issues:

Changes in pcapplusplus:

• Update to version 26.07

  • libpcap / WinPcap / Npcap is now optional.
  • Bumped the minimum required C++ standard to C++14

  Protocol support:

  • Added Modbus protocol
  • Added DoIP - Diagnostic over Internet Protocol
  • Added PostgreSQL Wire Protocol (PGWire), including additional message types
  • Added MySQL Wire Protocol
  • Discrete FTPControl and FTPData protocol types
  • Add support for AccurateECN TCP flag
  • Improve SIP packet detection using heuristic parsing
  • Recognize LLC payload in SLL2

  Added extensive X.509 / cryptography support:

  • X.509 certificate decoding, extension parsing, and parsing of X.509 certificates embedded in SSL/TLS messages
  • Export/import of X.509 certificates to PEM format, plus a new general-purpose PEM codec
  • Cryptographic key decoders (RSA/EC private and public keys)
  • Base64 encoding/decoding
  • A new X509Toolkit example application
  • Expanded ASN.1 codec support: BitString, UTCTime/GeneralizedTime, ObjectIdentifier and string records, plus arbitrary-size integer support
  • IFileReaderDevice::createReader() and IFileReaderDevice::tryCreateReader() use file-content heuristics to automatically pick the right reader (pcap/pcapng/snoop) instead of relying solely on the file extension
  • Add incremental packet parsing support with Packet::parsePacket()
  • Added multi-language README support: Japanese
  • IPv4Address/IPv6Address/MacAddress user-defined literals, e.g. constructing addresses directly from string literals, and sized buffer-construction overloads
  • Explicit-ownership overloads for RawPacket::setRawData(), and a sized overload for Layer::copyData()
  • Improved zstd support: added a build flag to control zstd support
  • A new SuppressLogs RAII class for temporarily suppressing log output
  • Large-scale internal refactoring of the device layer (PcapLiveDevice, DpdkDeviceList, file readers/writers, statistics tracking), the logging infrastructure, and the packet parsing infrastructure, improving encapsulation, thread-safety, and maintainability
  • Improved benchmarking: added a pure-parsing benchmark and extended benchmarks to support PcapNG and Snoop files
  • Test refactoring: replace packet creation macros in with C++ functions
  • Tons of security and correctness bug fixes

  Breaking changes:

  • The minimum required C++ standard has been raised to C++14
  • IPcapDevice has been removed; its logic now lives in PcapLiveDevice
  • libpcap/WinPcap/Npcap is now an optional dependency - building without it disables Pcap++ capture features, though Common++/Packet++ (including pcap file I/O) remain fully usable
  • Various internal APIs around device lists and statistics tracking were reworked as part of the refactoring above; this may affect code relying on undocumented internals

  Deprecation list:

  • IPv6Address::copyTo() has been deprecated, please use IPv6Address::copyToNewBuffer() instead
  • MacAddress::copyTo() has been deprecated, please use MacAddress::copyToNewBuffer() instead
  • Asn1IntegerRecord::getValue() has been deprecated, please use Asn1IntegerRecord::getIntValue() instead
  • RawPacket::getObjectType() has been deprecated due to unclear semantics
  • RawPacket::setRawData() has been deprecated, please use the overload that takes takeOwnership parameter for explicit control
  • RawPacket::initWithRawData() has been deprecated, please use RawPacket::setRawData() with takeOwnership=false instead
  • SSLExtension::SSLExtension() has been deprecated, please use the constructor with bounded span instead
  • Several TcpOptionBuilder constructors have been deprecated, please use the new constructors with TcpOptionEnumType instead
  • TcpLayer::getTcpOption(TcpOptionType option) has been deprecated,…