ISUParser is developed with a single active release line. Only the latest tagged release receives security fixes; older versions are not patched.

If you discover a security vulnerability in ISUParser, please report it privately using GitHub Security Advisories rather than opening a public issue.

Please include as much detail as possible:

• A description of the vulnerability and its potential impact
• Steps to reproduce, including a sample pcap file if applicable
• The affected version/commit
• Any suggested fix or mitigation, if known

You should expect an initial response within a few days. If the report is accepted, we will work with you on a fix and coordinate a disclosure timeline. If declined, we will explain why.

ISUParser parses untrusted, binary network capture data (pcap files containing SCTP/M2PA/M3UA/MTP3/ISUP traffic). Because it processes attacker-controllable input by design, issues such as out-of-bounds reads, panics/crashes, or excessive resource consumption triggered by a malformed or malicious pcap file are considered valid security reports.

Please do not report:

• Vulnerabilities in third-party dependencies (report these upstream, e.g. to gopacket)
• Issues that require local, trusted access to run the tool with attacker-supplied command-line arguments in a way already documented as unsupported