What is GHSA-f572-w3j5-2qmc?

GHSA-f572-w3j5-2qmc is a security advisory published by GitHub Security Advisories with Medium severity. Scapy before 2.7.0 contains an insecure deserialization vulnerability in the load_session...

Which CVE IDs does GHSA-f572-w3j5-2qmc cover?

GHSA-f572-w3j5-2qmc covers the following CVE IDs: CVE-2025-71463. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-f572-w3j5-2qmc?

GHSA-f572-w3j5-2qmc has a CVSS v3 base score of 6.7, published by GitHub Security Advisories.

GHSA-f572-w3j5-2qmcMediumCVSS 6.7

Scapy before 2.7.0 contains an insecure deserialization vulnerability in the load_session...

Vendor

GitHub Security Advisories

Published

November 13, 2026

Last Modified

November 13, 2026

🔗 CVE IDs covered (1)

CVE-2025-71463 →

📋 Description

Scapy before 2.7.0 contains an insecure deserialization vulnerability in the load_session function that allows attackers to execute code by supplying a malicious pickle session file. Attackers can trick users into loading a crafted .pkl.gz file via the -s option or conf.session, executing embedded Python code through reduce().

🔗 References (4)

https://github.com/secdev/scapy/security/advisories/GHSA-cq46-m9x9-j8w2
https://nvd.nist.gov/vuln/detail/CVE-2025-71463
https://www.vulncheck.com/advisories/scapy-before-2.7.0-insecure-deserialization-rce-via-session-files
https://github.com/advisories/GHSA-f572-w3j5-2qmc