ETK-2026-3459Zero's internal tracking ID, independent of the CVE number.

{
  "etk_id": "ETK-2026-3459",
  "cve_id": null,
  "display_id": "ETK-2026-3459",
  "ghsa_id": "GHSA-4j42-3cgx-5gc2",
  "euvd_id": null,
  "status": "published",
  "anchor_state": "awaiting_cve",
  "title": "Unbounded packet decoding in gopacket",
  "summary": "gopacket applications using default decoding can be disrupted by specially constructed network data or capture files that drive excessive nesting or memory use. An attacker must be able to supply data that the application decodes; GRE-related impact additionally depends on packet rendering or logging.",
  "mitigation": "Upgrade github.com/gopacket/gopacket to version 1.7.5. Until upgraded, restrict decoding of untrusted capture files and reject records larger than the expected link MTU where feasible.",
  "vendor": "go",
  "product": "go:github.com/gopacket/gopacket",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "<= 1.7.4"
      ],
      "ecosystem": "go",
      "fixed_versions": [
        "1.7.5"
      ],
      "package_name": "github.com/gopacket/gopacket",
      "purl": "pkg:golang/github.com/gopacket/gopacket"
    }
  ],
  "cwes": [
    400
  ],
  "cvss_score": 7.5,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 12.299971933333333,
  "t0_at": null,
  "signals": {
    "trigger_signal": {
      "at": "2026-11-04T05:38:42+00:00",
      "days": -0.18613271726851852,
      "is_lower_bound": true,
      "measured_at": "2026-11-04T10:06:44.003783+00:00",
      "url": "https://github.com/gopacket/gopacket/security/advisories/GHSA-4j42-3cgx-5gc2"
    }
  }
}