CVE-2026-13590

A security flaw has been discovered in seladb PcapPlusPlus 25.05. This impacts the function pcpp::ModbusLayer::getLength in the library Packet++/header/ModbusLayer.h of the component Modbus Protocol Handler. The manipulation of the argument length results in heap-based buffer overflow. The attack can be launched remotely. A high complexity level is associated with this attack. The exploitability is said to be difficult. The exploit has been released to the public and may be used for attacks. The patch is identified as 4c90c3e3418a2b09dc82b7ca5775e9c1e22fe454. Applying a patch is advised to resolve this issue.

A security flaw has been discovered in seladb PcapPlusPlus 25.05. This impacts the function pcpp::ModbusLayer::getLength in the library Packet++/header/ModbusLayer.h of the component Modbus Protocol Handler. The manipulation of the argument length results in heap-based buffer overflow. The attack can be launched remotely. A high complexity level is associated with this attack. The exploitability is said to be difficult. The exploit has been released to the public and may be used for attacks. The patch is identified as 4c90c3e3418a2b09dc82b7ca5775e9c1e22fe454. Applying a patch is advised to resolve this issue.

A security flaw has been discovered in seladb PcapPlusPlus 25.05. This impacts the function pcpp::ModbusLayer::getLength in the library Packet++/header/ModbusLayer.h of the component Modbus Protocol Handler. The manipulation of the argument length results in heap-based buffer overflow. The attack can be launched remotely. A high complexity level is associated with this attack. The exploitability is said to be difficult. The exploit has been released to the public and may be used for attacks. The patch is identified as 4c90c3e3418a2b09dc82b7ca5775e9c1e22fe454. Applying a patch is advised to resolve this issue.

A security flaw has been discovered in seladb PcapPlusPlus 25.05. This impacts the function pcpp::ModbusLayer::getLength in the library Packet++/header/ModbusLayer.h of the component Modbus Protocol Handler. The manipulation of the argument length results in heap-based buffer overflow. The attack can be launched remotely. A high complexity level is associated with this attack. The exploitability is said to be difficult. The exploit has been released to the public and may be used for attacks. The patch is identified as 4c90c3e3418a2b09dc82b7ca5775e9c1e22fe454. Applying a patch is advised to resolve this issue.

A security flaw has been discovered in seladb PcapPlusPlus 25.05. This impacts the function pcpp::ModbusLayer::getLength in the library Packet++/header/ModbusLayer.h of the component Modbus Protocol Handler. The manipulation of the argument length results in heap-based buffer overflow. The attack can be launched remotely. A high complexity level is associated with this attack. The exploitability is said to be difficult. The exploit has been released to the public and may be used for attacks. The patch is identified as 4c90c3e3418a2b09dc82b7ca5775e9c1e22fe454. Applying a patch is advised to resolve this issue.

These are all security issues fixed in the pcapplusplus-devel-26.07-1.1 package on the GA media of openSUSE Tumbleweed.

This update for pcapplusplus fixes the following issues:

Changes in pcapplusplus:

• Update to version 26.07

  • libpcap / WinPcap / Npcap is now optional.
  • Bumped the minimum required C++ standard to C++14

  Protocol support:

  • Added Modbus protocol
  • Added DoIP - Diagnostic over Internet Protocol
  • Added PostgreSQL Wire Protocol (PGWire), including additional message types
  • Added MySQL Wire Protocol
  • Discrete FTPControl and FTPData protocol types
  • Add support for AccurateECN TCP flag
  • Improve SIP packet detection using heuristic parsing
  • Recognize LLC payload in SLL2

  Added extensive X.509 / cryptography support:

  • X.509 certificate decoding, extension parsing, and parsing of X.509 certificates embedded in SSL/TLS messages
  • Export/import of X.509 certificates to PEM format, plus a new general-purpose PEM codec
  • Cryptographic key decoders (RSA/EC private and public keys)
  • Base64 encoding/decoding
  • A new X509Toolkit example application
  • Expanded ASN.1 codec support: BitString, UTCTime/GeneralizedTime, ObjectIdentifier and string records, plus arbitrary-size integer support
  • IFileReaderDevice::createReader() and IFileReaderDevice::tryCreateReader() use file-content heuristics to automatically pick the right reader (pcap/pcapng/snoop) instead of relying solely on the file extension
  • Add incremental packet parsing support with Packet::parsePacket()
  • Added multi-language README support: Japanese
  • IPv4Address/IPv6Address/MacAddress user-defined literals, e.g. constructing addresses directly from string literals, and sized buffer-construction overloads
  • Explicit-ownership overloads for RawPacket::setRawData(), and a sized overload for Layer::copyData()
  • Improved zstd support: added a build flag to control zstd support
  • A new SuppressLogs RAII class for temporarily suppressing log output
  • Large-scale internal refactoring of the device layer (PcapLiveDevice, DpdkDeviceList, file readers/writers, statistics tracking), the logging infrastructure, and the packet parsing infrastructure, improving encapsulation, thread-safety, and maintainability
  • Improved benchmarking: added a pure-parsing benchmark and extended benchmarks to support PcapNG and Snoop files
  • Test refactoring: replace packet creation macros in with C++ functions
  • Tons of security and correctness bug fixes

  Breaking changes:

  • The minimum required C++ standard has been raised to C++14
  • IPcapDevice has been removed; its logic now lives in PcapLiveDevice
  • libpcap/WinPcap/Npcap is now an optional dependency - building without it disables Pcap++ capture features, though Common++/Packet++ (including pcap file I/O) remain fully usable
  • Various internal APIs around device lists and statistics tracking were reworked as part of the refactoring above; this may affect code relying on undocumented internals

  Deprecation list:

  • IPv6Address::copyTo() has been deprecated, please use IPv6Address::copyToNewBuffer() instead
  • MacAddress::copyTo() has been deprecated, please use MacAddress::copyToNewBuffer() instead
  • Asn1IntegerRecord::getValue() has been deprecated, please use Asn1IntegerRecord::getIntValue() instead
  • RawPacket::getObjectType() has been deprecated due to unclear semantics
  • RawPacket::setRawData() has been deprecated, please use the overload that takes takeOwnership parameter for explicit control
  • RawPacket::initWithRawData() has been deprecated, please use RawPacket::setRawData() with takeOwnership=false instead
  • SSLExtension::SSLExtension() has been deprecated, please use the constructor with bounded span instead
  • Several TcpOptionBuilder constructors have been deprecated, please use the new constructors with TcpOptionEnumType instead
  • TcpLayer::getTcpOption(TcpOptionType option) has been deprecated,…