CVE-2026-6554

Public on 2026-09-05
Modified on 2026-09-08
Description
libpcap BPF interpreter treats the offset in the 'ja L' BPF instruction as a signed integer to implement looping via backward jumps, but it does not limit the number of loop iterations. In particular uncommon use cases a crafted filter program can cause the interpreter to loop infinitely.
Severity
Medium severity
Medium
See what this means
CVSS v3 Base Score
6.2
See breakdown

Affected Packages

Platform Package Release Date Advisory Status
Amazon Linux 2 - Core libpcap 2026-09-28 ALAS2-2026-3927 Fixed
Amazon Linux 2023 libpcap 2026-09-29 ALAS2023-2026-3100 Fixed
Amazon Linux 2027 Preview libpcap 2026-09-18 ALAS2027-2026-007 Fixed

CVSS Scores

Score Type Score Vector
Amazon Linux CVSSv3 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H