CVE-2026-18313

rpcapd can allocate up to 65536 bytes per each RPCAP_MSG_UPDATEFILTER_REQ or RPCAP_MSG_STARTCAP_REQ message received from the client, but it never frees the memory, so it leaks memory even under normal use. A malicious client can cause the server to leak memory substantially faster.

Database specific

{
    "cna_assigner":  "Tcpdump",
    "cwe_ids":  [
        "CWE-401"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/18xxx/CVE-2026-18313.json"
}

References

Affected packages

Git / github.com/the-tcpdump-group/libpcap

Affected ranges

Type

GIT

Repo

https://github.com/the-tcpdump-group/libpcap

Events

Introduced

8c6c412779eb5bc57c9d07fe5a25f8046088bef5

Introduced

82001f32ed9e76b0515a19ee0cc5be28c8ee0541

Fixed

f9775af1a0ec76db60c7213241e6b48f1be10ac7

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "1.10.x"
        },
        {
            "fixed":  "1.10.7"
        },
        {
            "introduced":  "1.9.x"
        },
        {
            "last_affected":  "1.9.x"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

1.*

1.9.x

libpcap-1.*

libpcap-1.10-bp

libpcap-1.10.0

libpcap-1.10.1

libpcap-1.10.2

libpcap-1.10.3

libpcap-1.10.4

libpcap-1.10.5

libpcap-1.10.6

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-18313.json"

vanir_signatures

[
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "277286431125731113753577220540607800933",
                "310287301396215292472603327614505895066",
                "13308025512888773093676422163443226306",
                "53655009404094493863216046712586535193",
                "25110073367291118553042984480090902737",
                "124614544356523393757357363679496182354",
                "20120128971763781583312504216590202487",
                "158524013488243767937161439115032544009",
                "97510527504415412974213691961063243908",
                "276626020291007073509684460307892736766",
                "322659395838062879773091477871152181372",
                "126010167104050920460092375951709965469",
                "46498358299002725646686203280236746990",
                "304157104837686640736395304063586672827",
                "49910197953755647576489570782038815630",
                "273074336872437356646355748260309628962",
                "72392989514099484162167688742882252601",
                "53527072917656164329110130841299810004",
                "33088874624062974902551018792986486762",
                "13255044863552552841072397589797951654",
                "40871188566960555797534865343993917120",
                "67351878776155574680218283111024918721"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-18313-a2f595d4",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/the-tcpdump-group/libpcap/commit/f9775af1a0ec76db60c7213241e6b48f1be10ac7",
        "target":  {
            "file":  "rpcapd/daemon.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "276061219323428994871975247569544909862",
            "length":  1592
        },
        "id":  "CVE-2026-18313-fe78373f",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/the-tcpdump-group/libpcap/commit/f9775af1a0ec76db60c7213241e6b48f1be10ac7",
        "target":  {
            "file":  "rpcapd/daemon.c",
            "function":  "daemon_unpackapplyfilter"
        }
    }
]

vanir_signatures_modified

"2026-09-10T08:43:23Z"