CVE-2026-6554 PUBLISHED

infinte loop in libpcap before 1.10.7

Assigner: Tcpdump
Reserved: 17.04.2026 Published: 05.09.2026 Updated: 05.09.2026

libpcap BPF interpreter treats the offset in the 'ja L' BPF instruction as a signed integer to implement looping via backward jumps, but it does not limit the number of loop iterations. In particular uncommon use cases a crafted filter program can cause the interpreter to loop infinitely.

Metrics

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS Score: 5.5

Product Status

Vendor The Tcpdump Group
Product libpcap
Versions Default: unaffected
  • affected from 0 to 1.10.7 (excl.)

Affected Configurations

The problem is specific to applications that use pcap_offline_filter() or bpf_filter() with an externally-supplied compiled filter program without validating the program first.

Exploits

A functional exploit exists.

Solutions

Upgrade to libpcap 1.10.7.

Credits

  • Kaixuan LI reporter

References

Problem Types

  • CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop') CWE