WIP
This issue tracks the upcoming 2.8.0 release.
Expected date: 01/10/2026.
Deprecation notice
- This major version will be the last to support Python 3.7 and 3.8. While this was initially planned for 2.7.0, support was extended because of how used those versions still were. They have been EoL for more than 2 years, and we highly encourage remaining users to upgrade.
Note
We have clarified our CONTRIBUTING and SECURITY guidelines. This notably includes some new guidance related to the use of AI, and some instructions regarding the submission of security issues. We encourage contributors to take a moment to read the updated versions.
Security
Scapy has taken part in OpenAI + Trail of Bits collab's initiative called "Patch the Planet". As part of this initiative, we have received a free security coverage of our code overseen by @KernelClint (Trail of Bits) and multiple OpenAI agents. This has led to the discovery of around 130+ bugs, among which were 54 issues that could be considered related to security, with various degrees of severity. You can find a partial list on https://github.com/secdev/scapy/security/advisories and here but please bear in mind that some reports have been written entirely by AI.
After analysis, we have marked 5 vulnerabilities with a "High" level of impact, which justify an immediate upgrade to 2.8.0, or backporting if packaged by downstream repositories:
The other issues have been triaged as "Moderate" or "Low" and don't justify immediate action from users or downstream package maintainers (those include crashes, issues in various protocol implementations, automatons and answering machines, mis-implementations of protocols like our TLS stack, etc. but nothing that leads to a potential compromission of the host machine).
We would like to thank again OpenAI and Trail of Bits (and in particular @KernelClint) for this opportunity and the time spent on this project.
Changelog
- Work has begun to clean up the remaining compatibility code that allowed the transition from Python 2.
WIP
This issue tracks the upcoming 2.8.0 release.
Expected date: 01/10/2026.
Deprecation notice
Note
We have clarified our CONTRIBUTING and SECURITY guidelines. This notably includes some new guidance related to the use of AI, and some instructions regarding the submission of security issues. We encourage contributors to take a moment to read the updated versions.
Security
Scapy has taken part in
OpenAI + Trail of Bitscollab's initiative called "Patch the Planet". As part of this initiative, we have received a free security coverage of our code overseen by @KernelClint (Trail of Bits) and multiple OpenAI agents. This has led to the discovery of around 130+ bugs, among which were 54 issues that could be considered related to security, with various degrees of severity. You can find a partial list on https://github.com/secdev/scapy/security/advisories and here but please bear in mind that some reports have been written entirely by AI.After analysis, we have marked 5 vulnerabilities with a "High" level of impact, which justify an immediate upgrade to
2.8.0, or backporting if packaged by downstream repositories:NetflowSessionrunning foreverThe other issues have been triaged as "Moderate" or "Low" and don't justify immediate action from users or downstream package maintainers (those include crashes, issues in various protocol implementations, automatons and answering machines, mis-implementations of protocols like our TLS stack, etc. but nothing that leads to a potential compromission of the host machine).
We would like to thank again
OpenAIandTrail of Bits(and in particular @KernelClint) for this opportunity and the time spent on this project.Changelog