CVE-2026-31911
published 2026-09-05CVE-2026-31911: libpcap BPF interpreter calls abort() if it encounters a BPF instruction that has an invalid opcode. In particular uncommon use cases a crafted filter program…
PriorityP421medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.10%
1.0th percentile
libpcap BPF interpreter calls abort() if it encounters a BPF instruction that has an invalid opcode. In particular uncommon use cases a crafted filter program can terminate the OS process.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| openshift | ose-rhel-coreos-8 | — | — |
| openshift | ose-rhel-coreos-9 | — | — |
| the_tcpdump_group | libpcap | < 1.10.7 | 1.10.7 |
| the_tcpdump_group | libpcap | — | — |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
libpcap BPF interpreter calls abort() if it encounters a BPF instruction that has an invalid opcode.
ghsa_unreviewed·2026-09-05
CVE-2026-31911 [MEDIUM] CWE-617 libpcap BPF interpreter calls abort() if it encounters a BPF instruction that has an invalid opcode.
libpcap BPF interpreter calls abort() if it encounters a BPF instruction that has an invalid opcode. In particular uncommon use cases a crafted filter program can terminate the OS process.
VulDB
Tcpdump Group libpcap up to 1.10.6 BPF Interpreter abort input validation (EUVD-2026-72017)
vuldb·2026-09-05·CVSS 5.5
CVE-2026-31911 [MEDIUM] Tcpdump Group libpcap up to 1.10.6 BPF Interpreter abort input validation (EUVD-2026-72017)
A vulnerability was found in Tcpdump Group libpcap up to 1.10.6. It has been rated as critical. This affects the function abort of the component BPF Interpreter. Performing a manipulation results in improper input validation.
This vulnerability is reported as CVE-2026-31911. The attack is possible to be carried out remotely. No exploit exists.
Upgrading the affected component is advised.
Red Hat
libpcap: libpcap: Denial of Service via crafted BPF opcode
vendor_redhat·2026-09-05·CVSS 5.5
CVE-2026-31911 [MEDIUM] CWE-617 libpcap: libpcap: Denial of Service via crafted BPF opcode
libpcap: libpcap: Denial of Service via crafted BPF opcode
libpcap BPF interpreter calls abort() if it encounters a BPF instruction that has an invalid opcode. In particular uncommon use cases a crafted filter program can terminate the OS process.
A flaw was found in libpcap. A local attacker could provide a crafted filter program containing an invalid Berkeley Packet Filter (BPF) opcode. This could cause the operating system (OS) process using libpcap to terminate, leading to a Denial of Service (DoS).
Statement: This Moderate impact flaw in libpcap allows a local attacker to cause a denial of service by providing a specially crafted BPF filter program. The vulnerability arises from the BPF interpreter's handling of invalid opcodes, leading to process termination in uncommon scenarios
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-31911 libpcap: libpcap: Denial of Service via crafted BPF opcode [fedora-all]
bugzilla·2026-09-09·CVSS 5.5
CVE-2026-31911 [MEDIUM] CVE-2026-31911 libpcap: libpcap: Denial of Service via crafted BPF opcode [fedora-all]
CVE-2026-31911 libpcap: libpcap: Denial of Service via crafted BPF opcode [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
libpcap BPF interpreter calls abort() if it encounters a BPF instruction that has an invalid opcode. In particular uncommon use cases a crafted filter program can terminate the OS process.
Bugzilla
CVE-2026-31911 libpcap: libpcap: Denial of Service via crafted BPF opcode
bugzilla·2026-09-05·CVSS 5.5
CVE-2026-31911 [MEDIUM] CVE-2026-31911 libpcap: libpcap: Denial of Service via crafted BPF opcode
CVE-2026-31911 libpcap: libpcap: Denial of Service via crafted BPF opcode
libpcap BPF interpreter calls abort() if it encounters a BPF instruction that has an invalid opcode. In particular uncommon use cases a crafted filter program can terminate the OS process.
2026-09-05
Published