CVE-2026-6554
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
The libpcap BPF interpreter treats the offset in the 'ja L' BPF instruction as a signed integer to implement looping via backward jumps, but does not limit the number of loop iterations. A crafted filter program or the 'protochain' primitive used on a crafted network packet can cause the interpreter to loop infinitely.
Risk Assessment
An attacker can cause the packet-processing process to hang or exhaust resources, resulting in denial of service. This may disrupt network monitoring and analysis tools.
Recommendation
Update libpcap to a version containing the fix. Until then, avoid processing untrusted BPF filters and network packets.
Other vulnerabilities in libpcap
See all- CVE-2011-1935Critical
In pcap-linux.c in libpcap 1.1.1 before commit ea9432fabdf4b33cbc76d9437200e028f1c47c93, setting snaplen may truncate packets, allowing remote attackers to send arbitrary data while avoiding detection via crafted packets.
- CVE-2026-6244Medium
The libpcap BPF interpreter for the 'div #k' and 'mod #k' ALU instructions does not check whether the immediate value is zero. In particular uncommon use cases a crafted filter program can cause a division by zero.
- CVE-2026-31912Medium
The libpcap BPF interpreter detects neither reaching the end of the filter program buffer due to lack of a return instruction nor executing a jump instruction with an offset that translates to a pointer outside of the buffer. In particular uncommon use cases a crafted filter program can cause the interpreter to try reading the OS process memory in the 32GiB around the buffer on 64-bit architectures and in the entire address space on 32-bit architectures.
- CVE-2026-31911Medium
The libpcap BPF interpreter calls abort() if it encounters a BPF instruction that has an invalid opcode. In particular uncommon use cases a crafted filter program can terminate the OS process.
- CVE-2026-18313Medium
rpcapd can allocate up to 65536 bytes per each RPCAP_MSG_UPDATEFILTER_REQ or RPCAP_MSG_STARTCAP_REQ message received from the client, but it never frees the memory, so it leaks memory even under normal use. A malicious client can cause the server to leak memory substantially faster.
- CVE-2026-18238Medium
The rpcap client code that processes a RPCAP_MSG_PACKET message received from the server incorrectly validates its headers. A malicious server can send a crafted message and cause the client to treat up to 20 bytes of the client process memory beyond the end of the buffer as if it was a part of the captured packet.
- CVE-2026-0799High
In BPF instructions that load/store a value from/to a scratch memory register the register index is an unsigned 32-bit integer and must not exceed 15, but libpcap BPF interpreter does not validate the value. In particular uncommon use cases a crafted filter program can cause the interpreter to try reading and writing the OS process memory in the 16GiB starting at the current stack frame on 64-bit architectures and in the entire address space on 32-bit architectures.
Original NVD description (English source)
libpcap BPF interpreter treats the offset in the 'ja L' BPF instruction as a signed integer to implement looping via backward jumps, but it does not limit the number of loop iterations. A crafted filter program or the 'protochain' primitive used on a crafted network packet can cause the interpreter to loop infinitely.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS