Heap Buffer Overflow in PcapPlusPlus: SSL Server Name Indication Extension Vulnerability
Summary
OSV-2026-1287: Heap-buffer-overflow in pcpp::SSLServerNameIndicationExtension::getHostName. Affects pcapplusplus versions >= 813f15b87f5e76a62d64360f8cbdf449c21316e4, < b561c50d911ab102d8add2737fdfb8421653bc8b. Fixed in b561c50d911ab102d8add2737fdfb8421653bc8b. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PcapPlusPlus is an open-source C++ library designed for packet processing and network analysis. It provides a high-level interface for capturing, analyzing, and crafting network packets. The library is widely used in network security applications, performance monitoring, and protocol analysis. However, it is susceptible to vulnerabilities that can lead to severe security issues, such as buffer overflows, which can compromise the integrity of applications utilizing the library.
Vulnerability Detail
The vulnerability identified is a heap buffer overflow in the function pcpp::SSLServerNameIndicationExtension::getHostName. This issue arises from improper handling of memory allocation when parsing SSL packets, which can lead to unauthorized memory access and potential application crashes. The vulnerability was reported through OSS-Fuzz, indicating that it can be exploited during fuzz testing, where unexpected inputs can cause the application to behave erratically. If exploited, this vulnerability could allow an attacker to execute arbitrary code or crash the application, leading to denial of service.
How To Fix
Minimum fixed version
b561c50d911ab102d8add2737fdfb8421653bc8b
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can avoid using the SSLServerNameIndicationExtension functionality until the library is updated. This may limit some features of your application but can help mitigate the risk of exploitation until a proper fix is applied.
Conclusion
The heap buffer overflow vulnerability in PcapPlusPlus's SSLServerNameIndicationExtension poses significant risks to applications using this library. It is crucial to update to the patched version to ensure the security and stability of your applications. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for pcapplusplus →
FAQ
A heap buffer overflow occurs when a program writes more data to a buffer located on the heap than it can hold, potentially overwriting adjacent memory and leading to unpredictable behavior.
You can use Vulert, which monitors open-source vulnerabilities in your software by analyzing the manifest file like package-lock.json. Visit Vulert Scanner to check if your application is affected without requiring any signup.
Exploitation of this vulnerability could lead to application crashes, unauthorized access to sensitive data, or execution of arbitrary code, posing significant security risks.
Yes, the fixed version of PcapPlusPlus is b561c50d911ab102d8add2737fdfb8421653bc8b. Updating to this version will mitigate the vulnerability.
If immediate updates are not possible, consider implementing the suggested workaround by avoiding the use of the SSLServerNameIndicationExtension functionality until the library is updated.
References
Related vulnerabilities
Recent vulnerabilities recorded for pcapplusplus.
