CVE-2026-13590: seladb PcapPlusPlus heap overflow in Modbus Protocol Handler

CVE-2026-13590 · Severity: medium · CVSS 5.6 · Published 2026-06-29

A security vulnerability exists in PcapPlusPlus, a popular library used for capturing and analyzing network traffic. The flaw occurs when the library processes specially crafted Modbus network packets that are shorter than expected, which can cause the application using the library to crash. This could lead to a denial-of-service, impacting the availability of network monitoring or security tools that rely on this software.

Technologies: Seladb PcapPlusPlus. Vendors: Seladb.

Quick answers

Is CVE-2026-13590 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-13590 being exploited in the wild.
How severe is CVE-2026-13590?
Medium severity, with a CVSS score of 5.6, published 29 June 2026.
Which products and versions are affected?
Seladb PcapPlusPlus 25.05.
Is there a fix for CVE-2026-13590?
A patch was published on 2026-06-24: Fix merged into development branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-13590 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-13590?
Check whether you run Seladb PcapPlusPlus at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A heap-based buffer overflow vulnerability exists in PcapPlusPlus 25.05 within the Modbus Protocol Handler. The root cause is a lack of bounds checking in the `pcpp::ModbusLayer::getLength` function (and related getters like `getTransactionId`) located in `ModbusLayer.cpp`. When the library attempts to parse truncated Modbus TCP packets (shorter than the required 6-8 bytes), it performs out-of-bounds memory reads. A remote attacker can exploit this by sending malformed Modbus traffic to a system running the library, potentially leading to a denial-of-service (DoS) via application crash. A patch has been released in commit 4c90c3e3418a2b09dc82b7ca5775e9c1e22fe454 which implements an `isDataValid` check.

Affected products

  • seladb PcapPlusPlus 25.05

Timeline

  • 2026-05-26: disclosed: Issue reported on GitHub repository
  • 2026-06-24: patched: Fix merged into development branch
  • 2026-06-29: advisory: CVE published and NVD entry created

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.