Tcpdump

Don't miss out!

Thousands of developers use stack.watch to stay informed.
Get an email whenever new security vulnerabilities are reported in any Tcpdump product.

RSS Feeds for Tcpdump security vulnerabilities

Create a CVE RSS feed including security vulnerabilities found in Tcpdump products with stack.watch. Just hit watch, then grab your custom RSS feed url.

Products by Tcpdump Sorted by Most Security Vulnerabilities since 2018

Tcpdump34 vulnerabilities

Tcpdump Libpcap7 vulnerabilities

Tcpdump Tcpslice1 vulnerability

By the Year

In 2026 there have been 0 vulnerabilities in Tcpdump. Tcpdump did not have any published security vulnerabilities last year.

Year	Vulnerabilities	Average Score
2026	0	0.00
2025	0	0.00
2024	2	4.40
2023	1	6.50
2022	2	7.30
2021	0	0.00
2020	2	0.00
2019	30	7.45
2018	1	5.50

It may take a day or so for new Tcpdump vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.

Recent Tcpdump Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2024-8006	Aug 31, 2024	libpcap NULL pointer deref in pcap_findalldevs_ex() Remote packet capture support is disabled by default in libpcap. When a user builds libpcap with remote packet capture support enabled, one of the functions that become available is pcap_findalldevs_ex(). One of the function arguments can be a filesystem path, which normally means a directory with input data files. When the specified path cannot be used as a directory, the function receives NULL from opendir(), but does not check the return value and passes the NULL value to readdir(), which causes a NULL pointer derefence.	Libpcap
CVE-2023-7256	Aug 31, 2024	Libpcap Double-Free in getaddrinfo() Handling In affected libpcap versions during the setup of a remote packet capture the internal function sock_initaddress() calls getaddrinfo() and possibly freeaddrinfo(), but does not clearly indicate to the caller function whether freeaddrinfo() still remains to be called after the function returns. This makes it possible in some scenarios that both the function and its caller call freeaddrinfo() for the same allocated memory block. A similar problem was reported in Apple libpcap, to which Apple assigned CVE-2023-40400.	Libpcap
CVE-2023-1801	Apr 07, 2023	Tcpdump 4.99.3 SMB OOB Write via Protocol Decoder The SMB protocol decoder in tcpdump version 4.99.3 can perform an out-of-bounds write when decoding a crafted network packet.	Tcpdump
CVE-2019-15167	Aug 27, 2022	CVE-2019-15167: Buffer Over-Read in tcpdump (<4.9.3) VRRP Parser vrrp_print() The VRRP parser in tcpdump before 4.9.3 has a buffer over-read in print-vrrp.c:vrrp_print() for VRRP version 3, a different vulnerability than CVE-2018-14463.	Tcpdump
CVE-2021-41043	Jan 05, 2022	Use after free in tcpslice triggers AddressSanitizer Use after free in tcpslice triggers AddressSanitizer, no other confirmed impact.	Tcpslice
CVE-2020-8036	Nov 04, 2020	The tok2strbuf() function in tcpdump 4.10.0-PRE-GIT was used by the SOME/IP dissector in an unsafe way. The tok2strbuf() function in tcpdump 4.10.0-PRE-GIT was used by the SOME/IP dissector in an unsafe way.	Tcpdump
CVE-2020-8037	Nov 04, 2020	The ppp decapsulator in tcpdump 4.9.3 The ppp decapsulator in tcpdump 4.9.3 can be convinced to allocate a large amount of memory.	Tcpdump
CVE-2019-15165	Oct 03, 2019	sf-pcapng.c in libpcap before 1.9.1 does not properly validate the PHB header length before allocating memory. sf-pcapng.c in libpcap before 1.9.1 does not properly validate the PHB header length before allocating memory.	Libpcap
CVE-2019-15164	Oct 03, 2019	rpcapd/daemon.c in libpcap before 1.9.1 rpcapd/daemon.c in libpcap before 1.9.1 allows SSRF because a URL may be provided as a capture source.	Libpcap
CVE-2019-15163	Oct 03, 2019	rpcapd/daemon.c in libpcap before 1.9.1 rpcapd/daemon.c in libpcap before 1.9.1 allows attackers to cause a denial of service (NULL pointer dereference and daemon crash) if a crypt() call fails.	Libpcap