# CVE-2026-13589: seladb PcapPlusPlus heap buffer overflow in TelnetLayer

Source: https://junglewise.ai/threats/cve-2026-13589-seladb-pcapplusplus-heap-buffer-overflow-in-telnetlayer  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-29. Updated: 2026-06-29  
License: CC BY 4.0 with a link back

CVE-2026-13589 · Severity: medium · CVSS 5.6 · Published 2026-06-29

PcapPlusPlus is a C++ library used for capturing and analyzing network traffic. A security flaw in how the library handles Telnet network data could allow a remote attacker to send specially crafted, malformed packets that cause the application using this library to crash. This could lead to a denial of service, impacting the availability of network monitoring or security tools that rely on PcapPlusPlus.

Technologies: [Seladb PcapPlusPlus](https://junglewise.ai/threats/technologies/pcapplusplus). Vendors: [Seladb](https://junglewise.ai/threats/vendors/seladb).

## Quick answers

**Is CVE-2026-13589 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-13589 being exploited in the wild.

**How severe is CVE-2026-13589?** Medium severity, with a CVSS score of 5.6, published 29 June 2026.

**Which products and versions are affected?** Seladb PcapPlusPlus 25.05.

**Is there a fix for CVE-2026-13589?** A patch was published on 2026-06-24: Fix merged into dev branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-13589 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-13589?** Check whether you run Seladb PcapPlusPlus at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A heap-based buffer overflow (out-of-bounds read) exists in the Telnet Subnegotiation Packet Handler of PcapPlusPlus 25.05. The vulnerability is located in the `pcpp::TelnetLayer::getSubCommand` function within `Packet++/src/TelnetLayer.cpp`. The root cause is a failure to rigorously verify buffer lengths when processing truncated Telnet packets; specifically, the code attempts to access memory at an offset of 2 without ensuring the buffer length is at least 3 bytes. A remote attacker can exploit this by sending malformed Telnet packets, potentially leading to a program crash (Denial of Service). A patch has been released in commit 98e671010bc7c87b95898c22ae289220ae92542b.

## Affected products

- seladb PcapPlusPlus 25.05

## Timeline

- 2026-05-25: disclosed: Issue reported on GitHub repository
- 2026-06-24: patched: Fix merged into dev branch
- 2026-06-29: advisory: NVD publication date

## References

- [https://github.com/seladb/PcapPlusPlus/](https://github.com/seladb/PcapPlusPlus/)
- [https://github.com/seladb/PcapPlusPlus/commit/98e671010bc7c87b95898c22ae289220ae92542b](https://github.com/seladb/PcapPlusPlus/commit/98e671010bc7c87b95898c22ae289220ae92542b)
- [https://github.com/seladb/PcapPlusPlus/issues/2152](https://github.com/seladb/PcapPlusPlus/issues/2152)
- [https://github.com/seladb/PcapPlusPlus/pull/2161](https://github.com/seladb/PcapPlusPlus/pull/2161)
- [https://github.com/user-attachments/files/28214571/poc.zip](https://github.com/user-attachments/files/28214571/poc.zip)
- [https://vuldb.com/cve/CVE-2026-13589](https://vuldb.com/cve/CVE-2026-13589)
- [https://vuldb.com/submit/844482](https://vuldb.com/submit/844482)

## Related threats

- [seladb PcapPlusPlus heap overflow in Modbus Protocol Handler](https://junglewise.ai/threats/cve-2026-13590-seladb-pcapplusplus-heap-overflow-in-modbus-protocol-handler)
- [seladb PcapPlusPlus heap buffer overflow in TLS Hello Handler](https://junglewise.ai/threats/cve-2026-13588-seladb-pcapplusplus-heap-buffer-overflow-in-tls-hello-handler)
- [seladb PcapPlusPlus heap overflow in LightPcapNg Parser](https://junglewise.ai/threats/cve-2026-13587-seladb-pcapplusplus-heap-overflow-in-lightpcapng-parser)