SCAPY · CVE-2025-71463 · Package
NO FIX YET · SEE WHAT TO DO
Scapy before 2.7.0 unpickles session files in its load_session function without checks. A crafted .pkl.gz session file can execute embedded Python code when a user loads it with the -s option or conf.session.
first public Oct 22, 2025 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Anyone who runs Scapy below 2.7.0 and loads session files that were not created locally. The risk depends on opening session files from outside sources; using Scapy without loading saved sessions is not affected. Teams that only run Scapy on their own captured sessions can deprioritize it.
Not affected if no-session-loading, scapy-2.7.0-or-later
Who cares python, scapy, security-tools
pip show scapy or python -c "import scapy; print(scapy.VERSION)"-s or conf.session from untrusted sources2.7.0 or later (from the sources' fixed version)Scapy before 2.7.0 contains an insecure deserialization vulnerability in the load_session function that allows attackers to execute code by supplying a malicious pickle session file. Attackers can trick users into loading a crafted .pkl.gz file via the -s option or conf.session, executing embedded Python code through reduce().
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.