CVE-2026-13589: PcapPlusPlus Buffer Overflow Vulnerability

CVE-2026-13589 Overview

CVE-2026-13589 is a heap-based buffer overflow [CWE-119] in seladb PcapPlusPlus 25.05. The flaw resides in the pcpp::TelnetLayer::getSubCommand function within Packet++/src/TelnetLayer.cpp, part of the Telnet Subnegotiation Packet Handler component. An attacker can trigger the overflow by sending crafted Telnet packets over the network, causing PcapPlusPlus to read past the bounds of an allocated heap buffer. A public proof-of-concept exists, though exploitation is reported as difficult due to high attack complexity. The upstream patch is tracked under commit 98e671010bc7c87b95898c22ae289220ae92542b.

Critical Impact
Applications and network analysis tools that link against PcapPlusPlus 25.05 and parse untrusted Telnet traffic may suffer memory corruption leading to information disclosure or denial of service.

Affected Products

seladb PcapPlusPlus 25.05
Applications embedding the PcapPlusPlus Packet++ library for Telnet parsing
Network analysis and packet inspection tools built on affected library versions

Discovery Timeline

2026-06-29 - CVE-2026-13589 published to NVD
2026-06-29 - Last updated in NVD database

Technical Details for CVE-2026-13589

Vulnerability Analysis

The vulnerability exists in the Telnet subnegotiation parsing path of PcapPlusPlus. When pcpp::TelnetLayer::getSubCommand walks a Telnet command stream, it assumes that WILL, WONT, DO, and DONT commands are followed by a valid option byte. The parser returns a fixed length of 3 bytes without confirming that at least 3 bytes remain in the packet buffer. When the packet is truncated, subsequent reads move beyond the allocated heap region and touch adjacent memory.

The adjacent SSL/TLS handshake parser exhibits a related issue. SSLClientHelloMessage::getHandshakeVersion dereferences a handshakeVersion field without verifying that the layer contains enough bytes to hold the handshake header plus the version field.

Root Cause

The root cause is missing bounds validation between the declared Telnet command length and the actual remaining buffer length. Trust in packet-supplied structure without cross-checking maxLength produces an out-of-bounds heap read classified under [CWE-119].

Attack Vector

Exploitation requires delivering a malformed Telnet packet to a process using PcapPlusPlus to parse network capture data or live traffic. The attack is remote but complex, requiring precise packet crafting to hit the vulnerable code path. A proof-of-concept is publicly attached to the upstream issue.

cpp

// Patch: Packet++/src/TelnetLayer.cpp
// Clamp the returned command length to the remaining buffer size.
// Only WILL, WONT, DO, DONT have option. Ref http://pcmicro.com/netfoss/telnet.html
else if (startPos[1] >= static_cast<int>(TelnetCommand::WillPerform) &&
         startPos[1] <= static_cast<int>(TelnetCommand::DontPerform))
-    return 3;
+    return std::min<size_t>(3, maxLength);
return 2;

Source: GitHub PcapPlusPlus Commit 98e6710

cpp

// Patch: Packet++/src/SSLHandshake.cpp
// Reject truncated ClientHello messages before reading the version field.
SSLVersion SSLClientHelloMessage::getHandshakeVersion() const
{
+   if (m_DataLen < sizeof(ssl_tls_handshake_layer) + sizeof(uint16_t))
+       return SSLVersion(0);
+
    uint16_t handshakeVersion = be16toh(getClientHelloHeader()->handshakeVersion);
    return SSLVersion(handshakeVersion);
}

Source: GitHub PcapPlusPlus Commit 98e6710

Detection Methods for CVE-2026-13589

Indicators of Compromise

Unexpected crashes or SIGSEGV events in processes linking against libPacket++ while parsing Telnet or TLS traffic
Truncated Telnet subnegotiation frames arriving from untrusted peers, particularly IAC sequences followed by fewer than three bytes
Heap corruption traces referencing pcpp::TelnetLayer::getSubCommand in core dumps or sanitizer output

Detection Strategies

Run PcapPlusPlus-based tools under AddressSanitizer during test ingestion of untrusted PCAPs to surface out-of-bounds reads
Inventory internal tooling and third-party binaries linked against PcapPlusPlus 25.05 using software composition analysis
Inspect network capture pipelines for malformed Telnet packets, using IDS signatures that flag truncated IAC command sequences

Monitoring Recommendations

Alert on repeated crashes or restart loops in packet analysis services that ingest live traffic
Log the source of PCAP files processed by analysis workflows to attribute crash-inducing inputs
Monitor the PcapPlusPlus GitHub repository for follow-on fixes and version tags

How to Mitigate CVE-2026-13589

Immediate Actions Required

Upgrade PcapPlusPlus past commit 98e671010bc7c87b95898c22ae289220ae92542b or apply the patch from Pull Request #2161
Rebuild and redeploy any downstream tooling statically linked against the vulnerable version
Restrict PcapPlusPlus-based analyzers to trusted PCAP sources until the fix is deployed

Patch Information

The fix is committed upstream as 98e671010bc7c87b95898c22ae289220ae92542b and merged through Pull Request #2161. Refer to the tracking Issue #2152 and VulDB entry for CVE-2026-13589 for additional context.

Workarounds

Filter or drop Telnet traffic at the network boundary if the analyzer does not need to inspect it
Sandbox packet parsers in isolated processes with limited privileges so that memory corruption cannot pivot into the host
Disable Telnet layer parsing in custom PcapPlusPlus builds where the protocol is not required

bash

# Rebuild PcapPlusPlus from a patched revision
git clone https://github.com/seladb/PcapPlusPlus.git
cd PcapPlusPlus
git fetch origin
git checkout 98e671010bc7c87b95898c22ae289220ae92542b
cmake -S . -B build -DCMAKE_BUILD_TYPE=Release
cmake --build build --parallel
sudo cmake --install build