CVE-2026-13588: PcapPlusPlus Buffer Overflow Vulnerability

CVE-2026-13588 Overview

CVE-2026-13588 is a heap-based buffer overflow in seladb PcapPlusPlus 25.05, affecting the pcpp::SSLClientHelloMessage::getHandshakeVersion function in Packet++/src/SSLHandshake.cpp. The flaw resides in the TLS Hello Handler component and is triggered by manipulation of the handshakeVersion argument. An attacker can reach the vulnerable code path remotely by supplying a truncated or malformed TLS Client Hello. The exploit has been publicly disclosed, though the reported attack complexity is high. The weakness is categorized under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer).

Critical Impact
Remote attackers can trigger an out-of-bounds heap read in applications that parse untrusted TLS handshakes using PcapPlusPlus 25.05, potentially causing information disclosure or process crashes.

Affected Products

seladb PcapPlusPlus 25.05
Applications and network analysis tools linking against the vulnerable Packet++ library
Downstream projects consuming the SSLHandshake parser prior to commit 98e6710

Discovery Timeline

2026-06-29 - CVE-2026-13588 published to NVD
2026-06-29 - Last updated in NVD database

Technical Details for CVE-2026-13588

Vulnerability Analysis

The vulnerability exists in the TLS Client Hello parser of PcapPlusPlus, a C++ library for capturing, parsing, and crafting network packets. When SSLClientHelloMessage::getHandshakeVersion() is invoked, the function reads a 16-bit handshakeVersion field from the packet buffer without validating that the buffer is large enough to contain both the SSL/TLS handshake layer header and the version field. Processing a truncated Client Hello causes the parser to read past the end of the allocated heap buffer.

The issue is reachable by any code path that feeds attacker-supplied network data into the PcapPlusPlus SSL parser, including intrusion detection systems, packet analyzers, and network telemetry tools. A public proof-of-concept has been published as a poc.zip attachment on the upstream GitHub issue tracker.

Root Cause

The root cause is missing length validation in getHandshakeVersion(). The function assumes that m_DataLen is at least sizeof(ssl_tls_handshake_layer) + sizeof(uint16_t) before dereferencing getClientHelloHeader()->handshakeVersion. A related truncation issue was also identified in Packet++/src/TelnetLayer.cpp, where a fixed return length of 3 was returned without checking against maxLength.

Attack Vector

An attacker delivers a crafted TLS Client Hello packet that terminates before the handshakeVersion field. When the vulnerable library parses the truncated frame, it reads adjacent heap memory. Exploitation is remote and unauthenticated but requires the target application to consume attacker-controlled packet data through the PcapPlusPlus SSL parser.

cpp

// Patch in Packet++/src/SSLHandshake.cpp adding a length guard
SSLVersion SSLClientHelloMessage::getHandshakeVersion() const
{
    if (m_DataLen < sizeof(ssl_tls_handshake_layer) + sizeof(uint16_t))
        return SSLVersion(0);

    uint16_t handshakeVersion = be16toh(getClientHelloHeader()->handshakeVersion);
    return SSLVersion(handshakeVersion);
}
// Source: https://github.com/seladb/PcapPlusPlus/commit/98e671010bc7c87b95898c22ae289220ae92542b

cpp

// Companion fix in Packet++/src/TelnetLayer.cpp bounding the return length
// Only WILL, WONT, DO, DONT have option. Ref http://pcmicro.com/netfoss/telnet.html
else if (startPos[1] >= static_cast<int>(TelnetCommand::WillPerform) &&
         startPos[1] <= static_cast<int>(TelnetCommand::DontPerform))
    return std::min<size_t>(3, maxLength);
return 2;
// Source: https://github.com/seladb/PcapPlusPlus/commit/98e671010bc7c87b95898c22ae289220ae92542b

Detection Methods for CVE-2026-13588

Indicators of Compromise

Crash reports or ASAN/heap sanitizer alerts referencing SSLClientHelloMessage::getHandshakeVersion or SSLHandshake.cpp
Unexpected termination of packet capture, IDS, or network telemetry processes shortly after receiving TLS traffic
Inbound TLS Client Hello records with a record length shorter than the minimum handshake header plus version field

Detection Strategies

Perform a software bill of materials (SBOM) scan for PcapPlusPlus version 25.05 across build pipelines and deployed binaries
Enable AddressSanitizer or HeapSanitizer in development and fuzzing builds to surface out-of-bounds reads in the SSL parser
Correlate process crashes in network analysis tooling with recent TLS handshake activity from untrusted sources

Monitoring Recommendations

Monitor host telemetry for repeated crashes of PcapPlusPlus-based services and capture core dumps for analysis
Log and alert on malformed TLS handshakes observed at network ingress, including truncated Client Hello records
Track upstream advisories on the PcapPlusPlus GitHub repository and VulDB entry for CVE-2026-13588

How to Mitigate CVE-2026-13588

Immediate Actions Required

Identify all applications and services statically or dynamically linked against PcapPlusPlus 25.05
Rebuild affected binaries against a patched source tree that includes commit 98e6710
Restrict exposure of PcapPlusPlus-based parsers to trusted network segments until patching is complete

Patch Information

The upstream fix is delivered in commit 98e671010bc7c87b95898c22ae289220ae92542b, merged via pull request #2161 and tracked in issue #2151. The patch adds a length check in SSLClientHelloMessage::getHandshakeVersion() and bounds the Telnet command length by maxLength. Consumers should update to a release that incorporates this commit and recompile dependent binaries.

Workarounds

Wrap calls to SSLClientHelloMessage::getHandshakeVersion() with an explicit m_DataLen size check equal to sizeof(ssl_tls_handshake_layer) + sizeof(uint16_t)
Filter or drop TLS Client Hello records shorter than the minimum expected length at network ingress
Isolate packet analysis workloads that cannot be patched immediately from untrusted traffic sources

bash

# Apply the upstream patch directly to a local PcapPlusPlus source tree
git clone https://github.com/seladb/PcapPlusPlus.git
cd PcapPlusPlus
git checkout 98e671010bc7c87b95898c22ae289220ae92542b
cmake -S . -B build && cmake --build build