CVE-2026-13588

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-13588

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-13588.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-13588

Published

2026-06-29T16:15:12.047Z

Modified

2026-07-15T19:14:43.886648Z

Severity

2.9 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

seladb PcapPlusPlus TLS Hello SSLHandshake.cpp getHandshakeVersion heap-based overflow

Details

A vulnerability was determined in seladb PcapPlusPlus 25.05. The impacted element is the function pcpp::SSLClientHelloMessage::getHandshakeVersion of the file Packet++/src/SSLHandshake.cpp of the component TLS Hello Handler. Executing a manipulation of the argument handshakeVersion can lead to heap-based buffer overflow. It is possible to launch the attack remotely. This attack is characterized by high complexity. The exploitability is regarded as difficult. The exploit has been publicly disclosed and may be utilized. This patch is called 98e671010bc7c87b95898c22ae289220ae92542b. It is best practice to apply a patch to resolve this issue.

Database specific

{
    "cwe_ids": [
        "CWE-119",
        "CWE-122"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/13xxx/CVE-2026-13588.json",
    "cna_assigner": "VulDB"
}

References

Affected packages

Git / github.com/seladb/pcapplusplus

Affected ranges

Type

GIT

Repo

https://github.com/seladb/pcapplusplus

Events

Introduced

a49a79e0b67b402ad75ffa96c1795def36df75c8

Fixed

98e671010bc7c87b95898c22ae289220ae92542b

Database specific

{
    "extracted_events": [
        {
            "introduced": "25.05"
        },
        {
            "last_affected": "25.05"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

25.*

25.05

v25.*

v25.05

Database specific

vanir_signatures

[
    {
        "source": "https://github.com/seladb/pcapplusplus/commit/98e671010bc7c87b95898c22ae289220ae92542b",
        "signature_version": "v1",
        "signature_type": "Function",
        "digest": {
            "function_hash": "217823748971136744959445098459058081666",
            "length": 13943.0
        },
        "deprecated": false,
        "id": "CVE-2026-13588-07e1f6c6",
        "target": {
            "function": "main",
            "file": "Tests/Packet++Test/main.cpp"
        }
    },
    {
        "source": "https://github.com/seladb/pcapplusplus/commit/98e671010bc7c87b95898c22ae289220ae92542b",
        "signature_version": "v1",
        "signature_type": "Line",
        "digest": {
            "line_hashes": [
                "336449698719518472553756953738360504482",
                "273608790671295807465392600420095041407",
                "284257564066288198691951438609838729710"
            ],
            "threshold": 0.9
        },
        "deprecated": false,
        "id": "CVE-2026-13588-0ad55539",
        "target": {
            "file": "Tests/Packet++Test/Tests/TelnetTests.cpp"
        }
    },
    {
        "source": "https://github.com/seladb/pcapplusplus/commit/98e671010bc7c87b95898c22ae289220ae92542b",
        "signature_version": "v1",
        "signature_type": "Function",
        "digest": {
            "function_hash": "240910796103947242340320125644092402158",
            "length": 134.0
        },
        "deprecated": false,
        "id": "CVE-2026-13588-39fad3f7",
        "target": {
            "function": "SSLClientHelloMessage::getHandshakeVersion",
            "file": "Packet++/src/SSLHandshake.cpp"
        }
    },
    {
        "source": "https://github.com/seladb/pcapplusplus/commit/98e671010bc7c87b95898c22ae289220ae92542b",
        "signature_version": "v1",
        "signature_type": "Line",
        "digest": {
            "line_hashes": [
                "23475467191258109890865392587990559415",
                "317513418531556080825557898863692637889",
                "249260188854115796949255803486406517662",
                "100460988187327377984120895877738435220",
                "151961159786647446665951699392540973342",
                "18343601474698899798836485120080880023",
                "168503510838904995196688509466266917373"
            ],
            "threshold": 0.9
        },
        "deprecated": false,
        "id": "CVE-2026-13588-5520e881",
        "target": {
            "file": "Packet++/src/SSLHandshake.cpp"
        }
    },
    {
        "source": "https://github.com/seladb/pcapplusplus/commit/98e671010bc7c87b95898c22ae289220ae92542b",
        "signature_version": "v1",
        "signature_type": "Function",
        "digest": {
            "function_hash": "64530128048131850997437488756051018090",
            "length": 516.0
        },
        "deprecated": false,
        "id": "CVE-2026-13588-8482bf9a",
        "target": {
            "function": "TelnetLayer::getFieldLen",
            "file": "Packet++/src/TelnetLayer.cpp"
        }
    },
    {
        "source": "https://github.com/seladb/pcapplusplus/commit/98e671010bc7c87b95898c22ae289220ae92542b",
        "signature_version": "v1",
        "signature_type": "Function",
        "digest": {
            "function_hash": "84954212636711382870343475381041124570",
            "length": 400.0
        },
        "deprecated": false,
        "id": "CVE-2026-13588-9cc8c63f",
        "target": {
            "function": "SSLServerHelloMessage::getHandshakeVersion",
            "file": "Packet++/src/SSLHandshake.cpp"
        }
    },
    {
        "source": "https://github.com/seladb/pcapplusplus/commit/98e671010bc7c87b95898c22ae289220ae92542b",
        "signature_version": "v1",
        "signature_type": "Line",
        "digest": {
            "line_hashes": [
                "160620450379764715478761082873010800112",
                "253833480575525124639451525535943841751",
                "194976479760050435721766871619608773730",
                "46955084236245203878693397626678664794",
                "283172730666298634771863218536021364580",
                "191201273829929289785622157974965850998",
                "263737484405563882428156022705558191791",
                "159328907277084608301356414977276027123"
            ],
            "threshold": 0.9
        },
        "deprecated": false,
        "id": "CVE-2026-13588-d679a041",
        "target": {
            "file": "Tests/Packet++Test/TestDefinition.h"
        }
    },
    {
        "source": "https://github.com/seladb/pcapplusplus/commit/98e671010bc7c87b95898c22ae289220ae92542b",
        "signature_version": "v1",
        "signature_type": "Line",
        "digest": {
            "line_hashes": [
                "54585861972326685238396232403613731607",
                "7021892063312519075160858833607803688",
                "319885028695741780411797402061569415935"
            ],
            "threshold": 0.9
        },
        "deprecated": false,
        "id": "CVE-2026-13588-ee5ca307",
        "target": {
            "file": "Tests/Packet++Test/Tests/SSLTests.cpp"
        }
    },
    {
        "source": "https://github.com/seladb/pcapplusplus/commit/98e671010bc7c87b95898c22ae289220ae92542b",
        "signature_version": "v1",
        "signature_type": "Line",
        "digest": {
            "line_hashes": [
                "280976480208517297156902697721174951266",
                "303998403583394841415768396797453391173",
                "83055894726114644735311484752152298180",
                "308224595456431346839335098757625952668"
            ],
            "threshold": 0.9
        },
        "deprecated": false,
        "id": "CVE-2026-13588-f4490427",
        "target": {
            "file": "Packet++/src/TelnetLayer.cpp"
        }
    },
    {
        "source": "https://github.com/seladb/pcapplusplus/commit/98e671010bc7c87b95898c22ae289220ae92542b",
        "signature_version": "v1",
        "signature_type": "Line",
        "digest": {
            "line_hashes": [
                "61657402017217737840873166431747985178",
                "173948576258895969704569629774232708977",
                "36666762383856653548870154842157625636",
                "280544293123603308998507562536566251918",
                "321137452563574503563737364946071241101",
                "96725043861684903173141092725143264031",
                "310799868980042191080388059526410241120",
                "265139228192807838662176692787931767322"
            ],
            "threshold": 0.9
        },
        "deprecated": false,
        "id": "CVE-2026-13588-f8a01232",
        "target": {
            "file": "Tests/Packet++Test/main.cpp"
        }
    }
]

vanir_signatures_modified

"2026-07-15T19:14:43Z"

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-13588.json"