What’s Vulnerable › Vulnerabilities

CVE-2026-6554: infinte loop in libpcap before 1.10.7

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-05 · updated 2026-10-22
• Weakness: CWE-835

Description

libpcap BPF interpreter treats the offset in the 'ja L' BPF instruction as a signed integer to implement looping via backward jumps, but it does not limit the number of loop iterations. A crafted filter program or the 'protochain' primitive used on a crafted network packet can cause the interpreter to loop infinitely.

Affected products

• The Tcpdump Group libpcap: before 1.10.7 — fixed in 1.10.7

How to fix

Upgrade to a fixed version: The Tcpdump Group libpcap 1.10.7. Check the vendor advisory for mitigations.

References

• https://github.com/the-tcpdump-group/libpcap/commit/ff3c83475ac303c6b681c52ad0b6e14795a8e0ce
• http://www.openwall.com/lists/oss-security/2026/10/22/3

Get alerted when CVE-2026-6554 or the next vulnerability affects your stack