Information disclosure in scapy - #VU148430
Published: September 9, 2026
Vulnerability identifier: #VU148430
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-200
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to disclose sensitive information.
The vulnerability exists due to improper handling of additional PEM objects in the Cert class when processing a combined certificate and private-key PEM file configured for a TLS server. A local user can cause the server to include the private key in its TLS Certificate message to disclose sensitive information.
The disclosure is limited to additional valid PEM objects in the configured certificate file.
Affected software
scapy
Remediation
Install security update from vendor's website.
scapy - update to 2.8.0