# CVE-2026-13588: seladb PcapPlusPlus heap buffer overflow in TLS Hello Handler

Source: https://junglewise.ai/threats/cve-2026-13588-seladb-pcapplusplus-heap-buffer-overflow-in-tls-hello-handler  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-29. Updated: 2026-06-29  
License: CC BY 4.0 with a link back

CVE-2026-13588 · Severity: medium · CVSS 5.6 · Published 2026-06-29

PcapPlusPlus, a library used for capturing and analyzing network traffic, contains a memory handling flaw in its TLS (encryption) processing component. An attacker could send specially crafted, truncated network packets to trigger a memory error. This could potentially lead to service instability or unauthorized access to small amounts of memory during packet inspection.

Technologies: [Seladb PcapPlusPlus](https://junglewise.ai/threats/technologies/pcapplusplus). Vendors: [Seladb](https://junglewise.ai/threats/vendors/seladb).

## Quick answers

**Is CVE-2026-13588 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-13588 being exploited in the wild.

**How severe is CVE-2026-13588?** Medium severity, with a CVSS score of 5.6, published 29 June 2026.

**Which products and versions are affected?** Seladb PcapPlusPlus 25.05.

**Is there a fix for CVE-2026-13588?** A patch was published on 2026-06-24: Fix merged into dev branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-13588 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-13588?** Check whether you run Seladb PcapPlusPlus at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A heap-based buffer overflow (CWE-122) exists in PcapPlusPlus 25.05 within the TLS Hello Handler component. The vulnerability is located in the `pcpp::SSLClientHelloMessage::getHandshakeVersion` function in `Packet++/src/SSLHandshake.cpp`. The root cause is a failure to validate that the packet data is large enough to contain the full TLS Client Hello header before accessing the `handshakeVersion` field. An attacker can exploit this by sending truncated or malformed TLS packets, leading to an out-of-bounds read/overflow. While the attack can be launched remotely, it is considered high complexity due to the specific packet structures required. A patch has been released in commit 98e671010bc7c87b95898c22ae289220ae92542b.

## Affected products

- seladb PcapPlusPlus 25.05

## Timeline

- 2026-06-09: disclosed: Issue reported on GitHub
- 2026-06-24: patched: Fix merged into dev branch
- 2026-06-29: advisory: CVE published

## References

- [https://github.com/seladb/PcapPlusPlus/](https://github.com/seladb/PcapPlusPlus/)
- [https://github.com/seladb/PcapPlusPlus/commit/98e671010bc7c87b95898c22ae289220ae92542b](https://github.com/seladb/PcapPlusPlus/commit/98e671010bc7c87b95898c22ae289220ae92542b)
- [https://github.com/seladb/PcapPlusPlus/issues/2151](https://github.com/seladb/PcapPlusPlus/issues/2151)
- [https://github.com/seladb/PcapPlusPlus/pull/2161](https://github.com/seladb/PcapPlusPlus/pull/2161)
- [https://github.com/user-attachments/files/28213479/poc.zip](https://github.com/user-attachments/files/28213479/poc.zip)
- [https://vuldb.com/cve/CVE-2026-13588](https://vuldb.com/cve/CVE-2026-13588)
- [https://vuldb.com/submit/844481](https://vuldb.com/submit/844481)

## Related threats

- [seladb PcapPlusPlus heap overflow in Modbus Protocol Handler](https://junglewise.ai/threats/cve-2026-13590-seladb-pcapplusplus-heap-overflow-in-modbus-protocol-handler)
- [seladb PcapPlusPlus heap buffer overflow in TelnetLayer](https://junglewise.ai/threats/cve-2026-13589-seladb-pcapplusplus-heap-buffer-overflow-in-telnetlayer)
- [seladb PcapPlusPlus heap overflow in LightPcapNg Parser](https://junglewise.ai/threats/cve-2026-13587-seladb-pcapplusplus-heap-overflow-in-lightpcapng-parser)