ETK-2026-3581Zero's internal tracking ID, independent of the CVE number.

{
  "etk_id": "ETK-2026-3581",
  "cve_id": null,
  "display_id": "ETK-2026-3581",
  "ghsa_id": "GHSA-c3q5-67f6-rx5w",
  "euvd_id": null,
  "status": "published",
  "anchor_state": "awaiting_cve",
  "title": "Input-handling flaws in gopacket capture components",
  "summary": "gopacket components for packet capture and LCM defragmentation can mishandle malformed capture data or network traffic. An attacker may cause an affected application to exit, hang, lose or mislabel packet data, or consume excessive memory when the application processes untrusted capture files, captures attacker-reachable traffic, or defragments LCM messages.",
  "mitigation": "Upgrade github.com/gopacket/gopacket to version 1.7.6. Until upgraded, validate capture files before use, avoid sharing compiled BPF filters between goroutines, and do not enable VLAN-header insertion on non-Ethernet interfaces.",
  "vendor": "go",
  "product": "go:github.com/gopacket/gopacket",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "<= 1.7.5"
      ],
      "ecosystem": "go",
      "fixed_versions": [
        "1.7.6"
      ],
      "package_name": "github.com/gopacket/gopacket",
      "purl": "pkg:golang/github.com/gopacket/gopacket"
    }
  ],
  "cwes": [
    129
  ],
  "cvss_score": 7.5,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 8.413207633333334,
  "t0_at": null,
  "signals": {
    "trigger_signal": {
      "at": "2026-11-05T02:16:00+00:00",
      "days": -0.41776762681712964,
      "is_lower_bound": true,
      "measured_at": "2026-11-05T12:17:35.179308+00:00",
      "url": "https://github.com/gopacket/gopacket/security/advisories/GHSA-c3q5-67f6-rx5w"
    }
  }
}