Log in Start free

Vulnerability · Published Sep 5, 2026 · Assigned by Tcpdump

CVE-2026-6554infinte loop in libpcap before 1.10.7

High 7.5

In plain English

A high-severity infinite loop in libpcap from The Tcpdump Group. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.4%top 61.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

libpcap BPF interpreter treats the offset in the 'ja L' BPF instruction as a signed integer to implement looping via backward jumps, but it does not limit the number of loop iterations. A crafted filter program or the 'protochain' primitive used on a crafted network packet can cause the interpreter to loop infinitely.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.21libpcap1.10.7-r0ALPINE-CVE-2026-6554
Alpine:v3.22libpcap1.10.7-r0ALPINE-CVE-2026-6554
Alpine:v3.23libpcap1.10.7-r0ALPINE-CVE-2026-6554
Alpine:v3.24libpcap1.10.7-r0ALPINE-CVE-2026-6554
Debian:12libpcapno fix listedDEBIAN-CVE-2026-6554
Debian:13libpcapno fix listedDEBIAN-CVE-2026-6554
Debian:14libpcap1.10.7-1DEBIAN-CVE-2026-6554
Ubuntu:22.04:LTSlibpcapno fix listedUBUNTU-CVE-2026-6554
Ubuntu:24.04:LTSlibpcapno fix listedUBUNTU-CVE-2026-6554
Ubuntu:26.04:LTSlibpcapno fix listedUBUNTU-CVE-2026-6554
Ubuntu:26.10libpcapno fix listedUBUNTU-CVE-2026-6554

Affected products (as reported)

VendorProductVersions
The Tcpdump Group libpcap 0 – before 1.10.7

Weakness: CWE-835 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References