CVE-2026-13588

A vulnerability was determined in seladb PcapPlusPlus 25.05. The impacted element is the function pcpp::SSLClientHelloMessage::getHandshakeVersion of the file Packet++/src/SSLHandshake.cpp of the component TLS Hello Handler. Executing a manipulation of the argument handshakeVersion can lead to heap-based buffer overflow. It is possible to launch the attack remotely. This attack is characterized by high complexity. The exploitability is regarded as difficult. The exploit has been publicly disclosed and may be utilized. This patch is called 98e671010bc7c87b95898c22ae289220ae92542b. It is best practice to apply a patch to resolve this issue.

A vulnerability was determined in seladb PcapPlusPlus 25.05. The impacted element is the function pcpp::SSLClientHelloMessage::getHandshakeVersion of the file Packet++/src/SSLHandshake.cpp of the component TLS Hello Handler. Executing a manipulation of the argument handshakeVersion can lead to heap-based buffer overflow. It is possible to launch the attack remotely. This attack is characterized by high complexity. The exploitability is regarded as difficult. The exploit has been publicly disclosed and may be utilized. This patch is called 98e671010bc7c87b95898c22ae289220ae92542b. It is best practice to apply a patch to resolve this issue.

A vulnerability was determined in seladb PcapPlusPlus 25.05. The impacted element is the function pcpp::SSLClientHelloMessage::getHandshakeVersion of the file Packet++/src/SSLHandshake.cpp of the component TLS Hello Handler. Executing a manipulation of the argument handshakeVersion can lead to heap-based buffer overflow. It is possible to launch the attack remotely. This attack is characterized by high complexity. The exploitability is regarded as difficult. The exploit has been publicly disclosed and may be utilized. This patch is called 98e671010bc7c87b95898c22ae289220ae92542b. It is best practice to apply a patch to resolve this issue.

A vulnerability was determined in seladb PcapPlusPlus 25.05. The impacted element is the function pcpp::SSLClientHelloMessage::getHandshakeVersion of the file Packet++/src/SSLHandshake.cpp of the component TLS Hello Handler. Executing a manipulation of the argument handshakeVersion can lead to heap-based buffer overflow. It is possible to launch the attack remotely. This attack is characterized by high complexity. The exploitability is regarded as difficult. The exploit has been publicly disclosed and may be utilized. This patch is called 98e671010bc7c87b95898c22ae289220ae92542b. It is best practice to apply a patch to resolve this issue.

A vulnerability was determined in seladb PcapPlusPlus 25.05. The impacted element is the function pcpp::SSLClientHelloMessage::getHandshakeVersion of the file Packet++/src/SSLHandshake.cpp of the component TLS Hello Handler. Executing a manipulation of the argument handshakeVersion can lead to heap-based buffer overflow. It is possible to launch the attack remotely. This attack is characterized by high complexity. The exploitability is regarded as difficult. The exploit has been publicly disclosed and may be utilized. This patch is called 98e671010bc7c87b95898c22ae289220ae92542b. It is best practice to apply a patch to resolve this issue.

These are all security issues fixed in the pcapplusplus-devel-26.07-1.1 package on the GA media of openSUSE Tumbleweed.

This update for pcapplusplus fixes the following issues:

Changes in pcapplusplus:

• Update to version 26.07

  • libpcap / WinPcap / Npcap is now optional.
  • Bumped the minimum required C++ standard to C++14

  Protocol support:

  • Added Modbus protocol
  • Added DoIP - Diagnostic over Internet Protocol
  • Added PostgreSQL Wire Protocol (PGWire), including additional message types
  • Added MySQL Wire Protocol
  • Discrete FTPControl and FTPData protocol types
  • Add support for AccurateECN TCP flag
  • Improve SIP packet detection using heuristic parsing
  • Recognize LLC payload in SLL2

  Added extensive X.509 / cryptography support:

  • X.509 certificate decoding, extension parsing, and parsing of X.509 certificates embedded in SSL/TLS messages
  • Export/import of X.509 certificates to PEM format, plus a new general-purpose PEM codec
  • Cryptographic key decoders (RSA/EC private and public keys)
  • Base64 encoding/decoding
  • A new X509Toolkit example application
  • Expanded ASN.1 codec support: BitString, UTCTime/GeneralizedTime, ObjectIdentifier and string records, plus arbitrary-size integer support
  • IFileReaderDevice::createReader() and IFileReaderDevice::tryCreateReader() use file-content heuristics to automatically pick the right reader (pcap/pcapng/snoop) instead of relying solely on the file extension
  • Add incremental packet parsing support with Packet::parsePacket()
  • Added multi-language README support: Japanese
  • IPv4Address/IPv6Address/MacAddress user-defined literals, e.g. constructing addresses directly from string literals, and sized buffer-construction overloads
  • Explicit-ownership overloads for RawPacket::setRawData(), and a sized overload for Layer::copyData()
  • Improved zstd support: added a build flag to control zstd support
  • A new SuppressLogs RAII class for temporarily suppressing log output
  • Large-scale internal refactoring of the device layer (PcapLiveDevice, DpdkDeviceList, file readers/writers, statistics tracking), the logging infrastructure, and the packet parsing infrastructure, improving encapsulation, thread-safety, and maintainability
  • Improved benchmarking: added a pure-parsing benchmark and extended benchmarks to support PcapNG and Snoop files
  • Test refactoring: replace packet creation macros in with C++ functions
  • Tons of security and correctness bug fixes

  Breaking changes:

  • The minimum required C++ standard has been raised to C++14
  • IPcapDevice has been removed; its logic now lives in PcapLiveDevice
  • libpcap/WinPcap/Npcap is now an optional dependency - building without it disables Pcap++ capture features, though Common++/Packet++ (including pcap file I/O) remain fully usable
  • Various internal APIs around device lists and statistics tracking were reworked as part of the refactoring above; this may affect code relying on undocumented internals

  Deprecation list:

  • IPv6Address::copyTo() has been deprecated, please use IPv6Address::copyToNewBuffer() instead
  • MacAddress::copyTo() has been deprecated, please use MacAddress::copyToNewBuffer() instead
  • Asn1IntegerRecord::getValue() has been deprecated, please use Asn1IntegerRecord::getIntValue() instead
  • RawPacket::getObjectType() has been deprecated due to unclear semantics
  • RawPacket::setRawData() has been deprecated, please use the overload that takes takeOwnership parameter for explicit control
  • RawPacket::initWithRawData() has been deprecated, please use RawPacket::setRawData() with takeOwnership=false instead
  • SSLExtension::SSLExtension() has been deprecated, please use the constructor with bounded span instead
  • Several TcpOptionBuilder constructors have been deprecated, please use the new constructors with TcpOptionEnumType instead
  • TcpLayer::getTcpOption(TcpOptionType option) has been deprecated,…