Cleartext transmission of sensitive information in scapy - #VU148431
Published: September 9, 2026
Vulnerability identifier: #VU148431
CSH Severity: Low
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-319
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to improper connection reuse in HTTP_Client when sending an HTTPS request after an HTTP request to the same host and explicitly selected port. A remote attacker can observe the reused plaintext connection to disclose sensitive information.
The HTTPS request is sent without TLS encryption when the earlier plaintext socket is reused.
Affected software
scapy
Remediation
Install security update from vendor's website.
scapy - update to 2.8.0