Critical Memory Allocation Vulnerability in libpcap: CVE-2019-15165

libpcap Updated 02 Oct 2025

Summary

03/10/2019

Disclosed on

N/A

Severity

Yes i

Fix available

Medium

Severity

5.3

CVSS Score

ALPINE-CVE-2019-15165: sf-pcapng.c in libpcap before 1.9.1 does not properly validate the PHB header length before allocating memory. Affects libpcap versions < 1.1.1-r0. Fixed in 1.1.1-r0. How to fix ↓

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

libpcap is a widely used library for network traffic capture and analysis. It provides a high-level interface for capturing packets and is essential for various network monitoring tools and applications. The library is designed to abstract the complexities of packet capture across different operating systems, making it a crucial component for developers working in network security and analysis. However, a vulnerability identified as CVE-2019-15165 has been discovered in libpcap versions prior to 1.9.1, which could lead to potential memory allocation issues.

Vulnerability Detail

The vulnerability arises from the sf-pcapng.c file in libpcap, where the PHB header length is not properly validated before memory allocation occurs. This oversight can lead to memory corruption, potentially allowing an attacker to exploit the vulnerability to execute arbitrary code or crash the application. The lack of validation means that crafted packets could be used to manipulate memory allocation, leading to severe consequences in applications relying on libpcap for packet capture.

How To Fix

Minimum fixed version

1.1.1-r0

This is the first release that contains the fix.

sudo apk add --upgrade libpcap

Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →

Workaround

If immediate upgrading is not feasible, consider implementing input validation checks in your application to ensure that any packets processed by libpcap are well-formed and do not exploit this vulnerability. However, this is not a foolproof solution and should only be a temporary measure until the library is updated.

Conclusion

In summary, CVE-2019-15165 is a critical vulnerability in the libpcap library that can lead to memory allocation issues due to improper validation. Users are strongly advised to update to version 1.9.1 or later to mitigate the risk. Additionally, utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.

See every vulnerability recorded for libpcap →