CVE-2026-128237

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-128237

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-128237.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-128237

Aliases

GHSA-xx44-g48m-mjp6

Published

2026-11-13T09:33:49Z

Modified

2026-11-14T02:47:32Z

Severity

6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N CVSS Calculator

Summary

Scapy before 2.8.0 Denial of Service via Quadratic BER OID Decoding

Details

Scapy before 2.8.0 contains a denial of service vulnerability in BER_num_dec() and BERcodec_OID.do_dec() that allows remote attackers to exhaust CPU by supplying oversized OID arcs. Attackers can send ASN.1/BER data with many base-128 continuation bytes to cause quadratic CPU consumption or an uncaught ValueError crash on Python 3.11+.

Database specific

{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-407"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/128xxx/CVE-2026-128237.json"
}

References

Affected packages

Git / github.com/secdev/scapy

Affected ranges

Type

GIT

Repo

https://github.com/secdev/scapy

Events

Introduced

Fixed

e2e35c07bce2f40e7513e1b29a6d300d5329dbc3

Database specific

Show details

{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "2.8.0"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        }
    ]
}

Affected versions

v0.*

v0.9.10.1

v0.9.10.2

v0.9.10.3

v0.9.10.4

v0.9.10.5

v0.9.10.6

v0.9.10.7

v0.9.10.8

v0.9.11.1

v0.9.11.2

v0.9.11.3

v0.9.11.4

v0.9.11.5

v0.9.12.1

v0.9.12.2

v0.9.12.3

v0.9.12.4

v0.9.12.5

v0.9.12.6

v0.9.12.7

v0.9.12.8

v0.9.12.9

v0.9.13.1

v0.9.13.2

v0.9.13.3

v0.9.13.4

v0.9.13.5

v0.9.14.1

v0.9.14.2

v0.9.14.3

v0.9.14.4

v0.9.14.5

v0.9.14.6

v0.9.14.7

v0.9.14.8

v0.9.15.1

v0.9.15.10

v0.9.15.11

v0.9.15.12

v0.9.15.13

v0.9.15.14

v0.9.15.15

v0.9.15.2

v0.9.15.3

v0.9.15.4

v0.9.15.5

v0.9.15.6

v0.9.15.7

v0.9.15.8

v0.9.15.9

v0.9.16.1

v0.9.16.10

v0.9.16.11

v0.9.16.12

v0.9.16.13

v0.9.16.14

v0.9.16.15

v0.9.16.16

v0.9.16.17

v0.9.16.18

v0.9.16.2

v0.9.16.3

v0.9.16.4

v0.9.16.5

v0.9.16.6

v0.9.16.7

v0.9.16.8

v0.9.16.9

v0.9.17.1

v0.9.17.10

v0.9.17.100

v0.9.17.101

v0.9.17.102

v0.9.17.103

v0.9.17.104

v0.9.17.105

v0.9.17.106

v0.9.17.107

v0.9.17.108

v0.9.17.109

v0.9.17.11

v0.9.17.110

v0.9.17.12

v0.9.17.13

v0.9.17.14

v0.9.17.15

v0.9.17.16

v0.9.17.17

v0.9.17.18

v0.9.17.19

v0.9.17.2

v0.9.17.20

v0.9.17.21

v0.9.17.22

v0.9.17.23

v0.9.17.24

v0.9.17.25

v0.9.17.26

v0.9.17.27

v0.9.17.28

v0.9.17.29

v0.9.17.3

v0.9.17.30

v0.9.17.31

v0.9.17.32

v0.9.17.33

v0.9.17.34

v0.9.17.35

v0.9.17.36

v0.9.17.37

v0.9.17.38

v0.9.17.39

v0.9.17.4

v0.9.17.40

v0.9.17.41

v0.9.17.42

v0.9.17.43

v0.9.17.44

v0.9.17.45

v0.9.17.46

v0.9.17.47

v0.9.17.48

v0.9.17.49

v0.9.17.5

v0.9.17.50

v0.9.17.51

v0.9.17.52

v0.9.17.53

v0.9.17.54

v0.9.17.55

v0.9.17.56

v0.9.17.57

v0.9.17.58

v0.9.17.59

v0.9.17.6

v0.9.17.60

v0.9.17.61

v0.9.17.62

v0.9.17.63

v0.9.17.64

v0.9.17.65

v0.9.17.66

v0.9.17.67

v0.9.17.68

v0.9.17.69

v0.9.17.7

v0.9.17.70

v0.9.17.71

v0.9.17.72

v0.9.17.73

v0.9.17.74

v0.9.17.75

v0.9.17.76

v0.9.17.77

v0.9.17.78

v0.9.17.79

v0.9.17.8

v0.9.17.80

v0.9.17.81

v0.9.17.82

v0.9.17.83

v0.9.17.84

v0.9.17.85

v0.9.17.86

v0.9.17.87

v0.9.17.88

v0.9.17.89

v0.9.17.9

v0.9.17.90

v0.9.17.91

v0.9.17.92

v0.9.17.93

v0.9.17.94

v0.9.17.95

v0.9.17.96

v0.9.17.97

v0.9.17.98

v0.9.17.99

v0.9.7.2

v0.9.7.3

v0.9.7.4

v0.9.7.5

v0.9.7.6

v0.9.7.7

v0.9.7.8

v0.9.7.9

v0.9.8.1

v0.9.8.2

v0.9.8.3

v0.9.8.4

v0.9.8.5

v0.9.8.6

v0.9.8.7

v0.9.8.8

v0.9.8.9

v0.9.9.1

v0.9.9.10

v0.9.9.11

v0.9.9.12

v0.9.9.13

v0.9.9.14

v0.9.9.15

v0.9.9.2

v0.9.9.3

v0.9.9.4

v0.9.9.5

v0.9.9.6

v0.9.9.7

v0.9.9.8

v0.9.9.9

v1.*

v1.0

v1.0.0.1

v1.0.0.10

v1.0.0.11

v1.0.0.12

v1.0.0.13

v1.0.0.14

v1.0.0.15

v1.0.0.16

v1.0.0.17

v1.0.0.18

v1.0.0.19

v1.0.0.2

v1.0.0.20

v1.0.0.21

v1.0.0.22

v1.0.0.23

v1.0.0.24

v1.0.0.25

v1.0.0.26

v1.0.0.27

v1.0.0.28

v1.0.0.29

v1.0.0.3

v1.0.0.30

v1.0.0.31

v1.0.0.32

v1.0.0.33

v1.0.0.34

v1.0.0.35

v1.0.0.36

v1.0.0.37

v1.0.0.38

v1.0.0.39

v1.0.0.4

v1.0.0.40

v1.0.0.41

v1.0.0.42

v1.0.0.43

v1.0.0.44

v1.0.0.45

v1.0.0.46

v1.0.0.47

v1.0.0.48

v1.0.0.49

v1.0.0.5

v1.0.0.50

v1.0.0.51

v1.0.0.52

v1.0.0.53

v1.0.0.54

v1.0.0.55

v1.0.0.56

v1.0.0.57

v1.0.0.58

v1.0.0.59

v1.0.0.6

v1.0.0.60

v1.0.0.61

v1.0.0.7

v1.0.0.8

v1.0.0.9

v1.0.1.1

v1.0.1.10

v1.0.1.11

v1.0.1.12

v1.0.1.13

v1.0.1.2

v1.0.1.3

v1.0.1.4

v1.0.1.5

v1.0.1.6

v1.0.1.7

v1.0.1.8

v1.0.1.9

v1.0.2.1

v1.0.2.10

v1.0.2.11

v1.0.2.12

v1.0.2.13

v1.0.2.14

v1.0.2.15

v1.0.2.16

v1.0.2.17

v1.0.2.18

v1.0.2.19

v1.0.2.2

v1.0.2.20

v1.0.2.21

v1.0.2.22

v1.0.2.23

v1.0.2.24

v1.0.2.25

v1.0.2.26

v1.0.2.27

v1.0.2.28

v1.0.2.29

v1.0.2.3

v1.0.2.30

v1.0.2.31

v1.0.2.32

v1.0.2.33

v1.0.2.34

v1.0.2.35

v1.0.2.36

v1.0.2.37

v1.0.2.4

v1.0.2.5

v1.0.2.6

v1.0.2.7

v1.0.2.8

v1.0.2.9

v1.0.3.1

v1.0.3.10

v1.0.3.11

v1.0.3.12

v1.0.3.13

v1.0.3.14

v1.0.3.15

v1.0.3.16

v1.0.3.17

v1.0.3.18

v1.0.3.19

v1.0.3.2

v1.0.3.20

v1.0.3.21

v1.0.3.22

v1.0.3.23

v1.0.3.24

v1.0.3.25

v1.0.3.26

v1.0.3.27

v1.0.3.28

v1.0.3.29

v1.0.3.3

v1.0.3.30

v1.0.3.31

v1.0.3.32

v1.0.3.33

v1.0.3.34

v1.0.3.4

v1.0.3.5

v1.0.3.6

v1.0.3.7

v1.0.3.8

v1.0.3.9

v1.0.4.1

v1.0.4.10

v1.0.4.100

v1.0.4.101

v1.0.4.102

v1.0.4.103

v1.0.4.104

v1.0.4.105

v1.0.4.106

v1.0.4.11

v1.0.4.12

v1.0.4.13

v1.0.4.14

v1.0.4.15

v1.0.4.16

v1.0.4.17

v1.0.4.18

v1.0.4.19

v1.0.4.2

v1.0.4.20

v1.0.4.21

v1.0.4.22

v1.0.4.23

v1.0.4.24

v1.0.4.25

v1.0.4.26

v1.0.4.27

v1.0.4.28

v1.0.4.29

v1.0.4.3

v1.0.4.30

v1.0.4.31

v1.0.4.32

v1.0.4.33

v1.0.4.34

v1.0.4.35

v1.0.4.36

v1.0.4.37

v1.0.4.38

v1.0.4.39

v1.0.4.4

v1.0.4.40

v1.0.4.41

v1.0.4.42

v1.0.4.43

v1.0.4.44

v1.0.4.45

v1.0.4.46

v1.0.4.47

v1.0.4.48

v1.0.4.49

v1.0.4.5

v1.0.4.50

v1.0.4.51

v1.0.4.52

v1.0.4.53

v1.0.4.54

v1.0.4.55

v1.0.4.56

v1.0.4.57

v1.0.4.58

v1.0.4.59

v1.0.4.6

v1.0.4.60

v1.0.4.61

v1.0.4.62

v1.0.4.63

v1.0.4.64

v1.0.4.65

v1.0.4.66

v1.0.4.67

v1.0.4.68

v1.0.4.69

v1.0.4.7

v1.0.4.70

v1.0.4.71

v1.0.4.72

v1.0.4.73

v1.0.4.74

v1.0.4.75

v1.0.4.76

v1.0.4.77

v1.0.4.78

v1.0.4.79

v1.0.4.8

v1.0.4.80

v1.0.4.81

v1.0.4.82

v1.0.4.83

v1.0.4.84

v1.0.4.85

v1.0.4.86

v1.0.4.87

v1.0.4.88

v1.0.4.89

v1.0.4.9

v1.0.4.90

v1.0.4.91

v1.0.4.92

v1.0.4.93

v1.0.4.94

v1.0.4.95

v1.0.4.96

v1.0.4.97

v1.0.4.98

v1.0.4.99

v1.0.5.1

v1.0.5.10

v1.0.5.11

v1.0.5.12

v1.0.5.13

v1.0.5.14

v1.0.5.15

v1.0.5.16

v1.0.5.17

v1.0.5.18

v1.0.5.19

v1.0.5.2

v1.0.5.20

v1.0.5.3

v1.0.5.4

v1.0.5.5

v1.0.5.6

v1.0.5.7

v1.0.5.8

v1.0.5.9

v1.0.6.1

v1.2.0

v1.2.0.2

v2.*

v2.0.0.1-alpha

v2.0.0.10

v2.0.0.11

v2.0.0.2

v2.0.0.3

v2.0.0.4

v2.0.0.5

v2.0.0.6

v2.0.0.7

v2.0.0.8

v2.0.0.9

v2.0.1

v2.1.1

v2.2.0

v2.3.0

v2.3.1

v2.3.2

v2.3.3

v2.4-rc1

v2.4.0

v2.4.0rc3

v2.4.0rc4

v2.4.0rc5

v2.4.1

v2.4.2

v2.4.3

v2.4.3rc1

v2.4.3rc2

v2.4.3rc3

v2.4.3rc4

v2.4.4

v2.4.4rc1

v2.4.4rc2

v2.4.5rc1

v2.4rc2

v2.5.0

v2.5.0rc1

v2.5.0rc2

v2.5.0rc3

v2.6.0

v2.6.0rc1

v2.6.0rc2

v2.6.1

v2.7.0

v2.7.0rc1

v2.7.1rc1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-128237.json"