ETK-2026-3448Zero's internal tracking ID, independent of the CVE number.

{
  "etk_id": "ETK-2026-3448",
  "cve_id": null,
  "display_id": "ETK-2026-3448",
  "ghsa_id": "GHSA-67h6-mp9c-5v57",
  "euvd_id": null,
  "status": "published",
  "anchor_state": "awaiting_cve",
  "title": "Packet reassembly denial of service in gopacket",
  "summary": "Applications using gopacket reassembly or IPv4 defragmentation can be affected by crafted TCP segments or IPv4 fragments. An attacker able to send such traffic through the application may crash the monitoring process and can cause reconstructed traffic to differ from traffic seen by the destination.",
  "mitigation": "Upgrade github.com/gopacket/gopacket to version 1.7.5 or later. Prioritize systems that process untrusted TCP traffic or IPv4 fragments.",
  "vendor": "go",
  "product": "go:github.com/gopacket/gopacket",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "<= 1.7.4"
      ],
      "ecosystem": "go",
      "fixed_versions": [
        "1.7.5"
      ],
      "package_name": "github.com/gopacket/gopacket",
      "purl": "pkg:golang/github.com/gopacket/gopacket"
    }
  ],
  "cwes": [
    125
  ],
  "cvss_score": 7.5,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 8.475648633333334,
  "t0_at": null,
  "signals": {
    "trigger_signal": {
      "at": "2026-11-04T04:08:57+00:00",
      "days": -0.05181857039351852,
      "is_lower_bound": true,
      "measured_at": "2026-11-04T05:23:34.234184+00:00",
      "url": "https://github.com/gopacket/gopacket/security/advisories/GHSA-67h6-mp9c-5v57"
    }
  }
}