CVE-2025-71463

CVSS 6.7 (medium) · published 2026-11-13

Scapy before 2.7.0 contains an insecure deserialization vulnerability in the load_session function that allows attackers to execute code by supplying a malicious pickle session file. Attackers can trick users into loading a crafted .pkl.gz file via the -s option or conf.session, executing embedded Python code through __reduce__().

Weakness: CWE-502

Source: NVD CVE-2025-71463

References

• https://github.com/secdev/scapy/security/advisories/GHSA-cq46-m9x9-j8w2
• https://www.vulncheck.com/advisories/scapy-before-2.7.0-insecure-deserialization-rce-via-session-files

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.