Vulnerability research

Advisories and CVEs we worked on.

Published advisories where Fenko or Foxhound found the bug, analysed the report, wrote the fix or verified it. Each row names the reporter and our role, and links to the advisory.

Further advisories are in coordinated disclosure and will be listed here once they are published.

Published advisories
27
Found
2
Analysed
8
Fixed
15
Fix verified
2
  1. GHSA-fwqx-cc24-3j43

    Owner account takeover through onboarding

    Reported by Hamid Babaee. Foxhound is credited as a tool. Leantime lists 3.10.0 as patched; we have not independently retested that release.

    Found with Foxhound
    Leantime 3.9.0 to 3.9.8
    8.8 High
  2. CVE-2026-65819

    Eleven layer decoders panic on crafted packets

    Discovery credited to Fenko. Published as GHSA-8mcr-459q-5mx2.

    Found by Fenko
    gopacket fixed in 1.7.1
    5.9 Medium
  3. GHSA-rrrf-6rxv-5554

    TCP reassembly misattributes, hides or ends streams on crafted traffic

    Reported by oss-scanner. Foxhound is credited as remediation developer.

    Fixed by Foxhound
    gopacket fixed in 1.7.6
    7.5 High
  4. GHSA-73q7-f8wh-66rf

    DHCP, DNS and GRE serializers emit bytes of an earlier packet

    Reported by oss-scanner. Foxhound is credited as remediation developer.

    Fixed by Foxhound
    gopacket fixed in 1.7.6
    5.3 Medium
  5. GHSA-c3q5-67f6-rx5w

    pcap, pcapgo, afpacket and lcmdefrag crash, hang or hold unbounded memory

    Reported by oss-scanner. Foxhound is credited as remediation developer.

    Fixed by Foxhound
    gopacket fixed in 1.7.6
    7.5 High
  6. GHSA-27q8-99gx-2jhw

    IPv4 and IPv6 defragmentation differs from the receiving host

    Reported by oss-scanner. Foxhound is credited as remediation developer.

    Fixed by Foxhound
    gopacket fixed in 1.7.6
    7.5 High
  7. GHSA-rf8g-g3f7-2v59

    IPv6, tunnel and link-layer decoders hide or misplace the transport layer

    Reported by oss-scanner. Foxhound is credited as remediation developer.

    Fixed by Foxhound
    gopacket fixed in 1.7.6
    5.3 Medium
  8. GHSA-2qf9-j66w-rgm2

    TLS, SCTP, SIP, DNS, Diameter and industrial decoders forge or hide application data

    Reported by oss-scanner. Foxhound is credited as remediation developer.

    Fixed by Foxhound
    gopacket fixed in 1.7.6
    5.3 Medium
  9. GHSA-c68q-5h9r-235g

    Seven decoders read packets differently from the receiving host

    Reported by oss-scanner. Foxhound is credited as remediation developer.

    Fixed by Foxhound
    gopacket fixed in 1.7.7
    5.3 Medium
  10. GHSA-63gp-f575-ch7c

    CDP, RadioTap, OSPF, LLDP and other decoders panic, run quadratic or read stale bytes

    Reported by oss-scanner, MaxRink and Reeeid. Foxhound is credited as remediation developer.

    Fixed by Foxhound
    gopacket fixed in 1.7.6
    7.5 High
  11. GHSA-67h6-mp9c-5v57

    TCP reassembly and IPv4 defragmentation panic on crafted segments

    Reported by oss-scanner. Foxhound is credited as remediation developer.

    Fixed by Foxhound
    gopacket fixed in 1.7.5
    7.5 High
  12. GHSA-7mcm-qfgv-q3hh

    pcapgo readers allocate up to 4 GiB or panic on crafted capture files

    Reported by oss-scanner. Foxhound is credited as remediation developer.

    Fixed by Foxhound
    gopacket fixed in 1.7.5
    5.5 Medium
  13. GHSA-5jhc-7qgc-hmgp

    OSPF, LLDP, TCP option and endpoint decoders panic or retain memory

    Reported by oss-scanner. Foxhound is credited as remediation developer.

    Fixed by Foxhound
    gopacket fixed in 1.7.5
    7.5 High
  14. GHSA-wxp2-jvxp-88hw

    Reused decoders grow memory without bound and keep stale fields

    Reported by oss-scanner. Foxhound is credited as remediation developer.

    Fixed by Foxhound
    gopacket fixed in 1.7.5
    7.5 High
  15. GHSA-4j42-3cgx-5gc2

    Unbounded recursion in eager decoding, TLS, sFlow and GRE

    Reported by oss-scanner. Foxhound is credited as remediation developer.

    Fixed by Foxhound
    gopacket fixed in 1.7.5
    7.5 High
  16. GHSA-6r5j-pg9f-7g7r

    DNS compression pointers exhaust memory and CPU

    Reported by oss-scanner. Foxhound is credited as remediation developer.

    Fixed by Foxhound
    gopacket fixed in 1.7.5
    7.5 High
  17. GHSA-7599-hx7j-j9fv

    BFD, 802.11 and RadioTap serializers panic on layers decoded from valid input

    Reported by oss-scanner. Foxhound is credited as remediation developer.

    Fixed by Foxhound
    gopacket fixed in 1.7.5
    5.9 Medium
  18. GHSA-w3r9-77cj-r246

    Diameter decoder: grouped-AVP recursion exhausts memory

    Reported by manus-pi and manus-use. Foxhound is credited as analyst.

    Analysed by Foxhound
    gopacket fixed in 1.7.3
    7.5 High
  19. GHSA-xcf2-23pj-86cv

    Seven layer decoders panic on crafted input

    Reported by tikipiya. Foxhound is credited as analyst.

    Analysed by Foxhound
    gopacket fixed in 1.7.4
    5.9 Medium
  20. GHSA-r93c-g7pr-x4hw

    DHCPv6 option printing and STP serialization panic on crafted input

    Reported by tikipiya. Foxhound is credited as analyst.

    Analysed by Foxhound
    gopacket fixed in 1.7.3
    6.5 Medium
  21. CVE-2026-119299

    SCTP chunk decoders panic on crafted segments

    Reported by Reload3d. Foxhound is credited as analyst. Published as GHSA-358w-w75h-x6rx.

    Analysed by Foxhound
    gopacket fixed in 1.7.2
    5.9 Medium
  22. GHSA-25xj-ggj7-jqgf

    SIP decoder panics on a continuation line before any header

    Reported by manus-use. Foxhound is credited as analyst.

    Analysed by Foxhound
    gopacket fixed in 1.7.1
    5.9 Medium
  23. GHSA-6h9g-cjv3-pg2c

    TCP MPTCP option decoder panics on a crafted segment

    Reported by manus-use. Foxhound is credited as analyst.

    Analysed by Foxhound
    gopacket fixed in 1.7.1
    5.9 Medium
  24. GHSA-cxrr-2gv2-m94w

    Twelve more layer decoders panic on crafted input

    Reported by manus-use. Foxhound is credited as analyst.

    Analysed by Foxhound
    gopacket fixed in 1.7.1
    5.9 Medium
  25. CVE-2026-12606

    HTTP request smuggling via header-name parsing

    Same defect and same fix as CVE-2026-12606, which Eclipse assigned from a separate trailer-section report. Our analysis reached security@eclipse.org on 7 June 2026 and reproduces back to 2.1.11, wider than the 4.0.0 to 5.0.1 range published against that ID.

    Fenko analysis
    Eclipse Grizzly 2.1.11 to 5.0.1
    Medium
  26. CVE-2026-54345

    Diameter AVP decoder: uint32 underflow drives a 4 GiB allocation

    Reported by tonghuaroot. Fenko is credited as remediation verifier: we confirmed the fix, we did not find the bug.

    Fix verified by Fenko
    gopacket fixed in 1.6.1
    Medium
  27. CVE-2026-54332

    sFlow decoder: unbounded allocation from a 104-byte datagram

    Reported by tonghuaroot. Fenko is credited as remediation verifier: we confirmed the fix, we did not find the bug.

    Fix verified by Fenko
    gopacket fixed in 1.6.1
    Medium