VYPR
← All advisories
Unrated severityNVD Advisory· Published Oct 3, 2019· Updated Dec 3, 2025

CVE-2018-16300

CVE-2018-16300

Description

A stack consumption vulnerability in tcpdump's BGP parser before 4.9.3 allows denial of service via crafted BGP packets.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A stack consumption vulnerability in tcpdump's BGP parser before 4.9.3 allows denial of service via crafted BGP packets.

Vulnerability

The BGP parser in tcpdump before version 4.9.3 contains a vulnerability in print-bgp.c within the bgp_attr_print() function. This flaw allows unlimited recursion, leading to stack consumption when processing specially crafted BGP packets.

Exploitation

An unauthenticated attacker with network access can send a malicious BGP packet to a system running a vulnerable tcpdump version. The packet triggers infinite recursion in the parser, causing the stack to grow uncontrollably.

Impact

Successful exploitation results in a denial of service (DoS) condition, as the stack exhaustion causes tcpdump to crash. No code execution is indicated.

Mitigation

Upgrade to tcpdump version 4.9.3 or later. For Debian systems, fixed versions are 4.9.3-1~deb9u1 (stretch) and 4.9.3-1~deb10u1 (buster) [4]. No workarounds are documented.

References
  1. [SECURITY] [DSA 4547-1] tcpdump security update

AI Insight generated on May 25, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

11

Patches

0

No patches discovered yet.

Vulnerability mechanics

Root cause

"Unbounded recursion in bgp_attr_print() when processing nested ATTR_SET attributes allows stack exhaustion."

Attack vector

An attacker crafts a BGP UPDATE message containing deeply nested ATTR_SET attributes. When tcpdump parses this message, `bgp_attr_print()` recurses into each nested ATTR_SET without bound, consuming the call stack until exhaustion and causing a crash [ref_id=1]. The attacker only needs to send a single malicious BGP packet to trigger the vulnerability.

Affected code

The vulnerability is in `print-bgp.c` in the function `bgp_attr_print()`. The function recursively processes ATTR_SET attributes without any depth limit, leading to stack exhaustion [ref_id=1].

What the fix does

The patch adds an `attr_set_level` parameter to `bgp_attr_print()` that tracks the current nesting depth of ATTR_SET attributes [ref_id=1]. When the depth reaches 10, the function prints a warning and stops recursing instead of continuing indefinitely [ref_id=1]. The initial call site in `bgp_update_print()` passes 0 as the starting level [ref_id=1]. This prevents stack exhaustion by enforcing a hard limit on recursion depth.

Preconditions

  • networkAttacker must be able to send a crafted BGP UPDATE packet to a target that uses tcpdump to capture or analyze BGP traffic
  • configTarget must be running tcpdump version prior to 4.9.3

Generated on May 27, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

16

News mentions

0

No linked articles in our index yet.