Live › vulnerability › CVE-2026-119299
gopacket's SCTP decoder reads attacker-controlled lengths and counts without bounds checks, so a crafted SCTP segment causes a slice panic. Applications that skip the default panic recovery terminate; the impact is availability only.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 17:31 UTC. All times on this page are UTC.
Go applications that parse untrusted network traffic with gopacket and that either disable its default panic recovery (SkipDecodeRecovery, IgnorePanic) or call registered decoders directly. Default recovery-enabled APIs turn the panic into a per-packet decode error, so those applications are less exposed.
No product ranges from the sources yet.
go.mod or go list -m github.com/google/gopacketDecodeOptions.SkipDecodeRecovery, direct registered decoders, or DecodingLayerParser with IgnorePanic enabled1.7.2Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
gopacket provides packet processing capabilities for Go. Prior to 1.7.2, the SCTP chunk chain in layers/sctp.go passes attacker-controlled declared lengths and counts to decodeSCTPInit, decodeSCTPShutdown, decodeSCTPError, decodeSCTPSack, and decodeSCTPParameter without checking that each chunk contains the fixed fields, parameter TLVs, gap acknowledgements, or duplicate TSNs those sub-decoders read. A crafted SCTP segment can therefore cause out-of-bounds or inverted slice panics; the panic can terminate applications that use gopacket.DecodeOptions.SkipDecodeRecovery, direct registered decoders, or DecodingLayerParser with IgnorePanic enabled, while the default recovery-enabled APIs convert it to a per-packet decode error. This is the SCTP sub-decoder residual named but not remediated by CVE-2026-65819, whose version 1.7.1 changes bounded the generic dispatcher but left these per-type reads and loops unchecked. The impact is availability only, with no data disclosure, modification, or allocation amplification. This issue is fixed in version 1.7.2.
This page as .md · .json · in your agent: get_signal("CVE-2026-119299")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.