CVE-2026-65819

gopacket: Multiple layer decoders panic on crafted packets (out-of-bounds/underflow) enabling unauthenticated remote DoS via DecodingLayerParser

7.5 HighFix available

gopacket provides packet processing capabilities for Go. Through version 1.7.0, multiple layer decoders use attacker-controlled lengths, counts, or offsets before validating them against packet buffers, allowing a crafted packet decoded through DecodingLayerParser or DecodeFromBytes to trigger an unrecovered panic and remotely deny service. A patch commit is available at 210f25f.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

0.36%Unchanged since Aug 8, 2026

What each source reports

CVE List Score used 7.5

gopacket: Multiple layer decoders panic on crafted packets (out-of-bounds/underflow) enabling unauthenticated remote DoS via DecodingLayerParser

Record: CVE-2026-65819
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-125, CWE-400
Updated: 2026-11-02

EUVDEUVD-2026-54609 7.5

Record: EUVD-2026-54609
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

NVD 7.5

Record: CVE-2026-65819
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-125, CWE-400
Updated: 2026-11-02

OSV 7.5

gopacket: Multiple layer decoders panic on crafted packets (out-of-bounds/underflow) enabling unauthenticated remote DoS via DecodingLayerParser

Record: CVE-2026-65819
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-125, CWE-400
Updated: 2026-11-02

OSVDEBIAN-CVE-2026-65819 7.5

Record: DEBIAN-CVE-2026-65819
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2026-65819 7.5

Record: UBUNTU-CVE-2026-65819
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVAZL-95490 No score

CVE-2026-65819 affecting package telegraf for versions less than 1.31.0-31

Record: AZL-95490
Updated: 2026-11-05

Affected products

gopacket

Affected packages

Affected packages
Package	Affected	Fixed
`telegraf` Azure Linux:3	before 1.31.0-31	1.31.0-31
`golang-github-gopacket-gopacket` Debian:12	All versions, plus listed versions 1.0.0-11.2.0-11.2.0-21.3.0-11.3.0-2	None known
`golang-github-gopacket-gopacket` Debian:13	All versions, plus listed versions 1.3.0-2	None known
`golang-github-gopacket-gopacket` Debian:14	All versions, plus listed versions 1.3.0-2	None known
`gopacket` Debian:12	All versions, plus listed versions 1.1.19-31.1.19-41.1.19-51.1.19-61.1.19-6.11.1.19-6.2	None known
`gopacket` Debian:13	All versions, plus listed versions 1.1.19-6.2	None known
`gopacket` Debian:14	All versions, plus listed versions 1.1.19-6.2	None known
`golang-github-gopacket-gopacket` Ubuntu:24.04:LTS	All versions, plus listed versions 1.0.0-11.2.0-11.2.0-2	None known
`golang-github-gopacket-gopacket` Ubuntu:26.10	All versions, plus listed versions 1.3.0-2	None known
`golang-github-gopacket-gopacket` Ubuntu:26.04:LTS	All versions, plus listed versions 1.3.0-2	None known

History

History
Recorded	Changed	Sources
Nov 5, 2026	facts	OSV
Nov 2, 2026	affected, aliases, published	EUVD
Nov 2, 2026	first indexed	CVE List, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-65819 is a high vulnerability (CVSS 7.5) in Gopacket, published August 7, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.36%, the 30th percentile. Fixed in telegraf 1.31.0-31.