{"id":"CVE-2026-119299","kind":"vulnerability","aliases":["CVE-2026-119299"],"related":[],"title":"gopacket: crafted SCTP packet can crash Go apps decoding it","description":"gopacket provides packet processing capabilities for Go. Prior to 1.7.2, the SCTP chunk chain in layers/sctp.go passes attacker-controlled declared lengths and counts to decodeSCTPInit, decodeSCTPShutdown, decodeSCTPError, decodeSCTPSack, and decodeSCTPParameter without checking that each chunk contains the fixed fields, parameter TLVs, gap acknowledgements, or duplicate TSNs those sub-decoders read. A crafted SCTP segment can therefore cause out-of-bounds or inverted slice panics; the panic can terminate applications that use gopacket.DecodeOptions.SkipDecodeRecovery, direct registered decoders, or DecodingLayerParser with IgnorePanic enabled, while the default recovery-enabled APIs convert it to a per-packet decode error. This is the SCTP sub-decoder residual named but not remediated by CVE-2026-65819, whose version 1.7.1 changes bounded the generic dispatcher but left these per-type reads and loops unchecked. The impact is availability only, with no data disclosure, modification, or allocation amplification. This issue is fixed in version 1.7.2.","summary":"gopacket's SCTP decoder reads attacker-controlled lengths and counts without bounds checks, so a crafted SCTP segment causes a slice panic. Applications that skip the default panic recovery terminate; the impact is availability only.","severity":"medium","cvss":5.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["go","gopacket","network-tools","package","packet-capture"],"not_affected_if":["default-config","no-sctp-traffic","panic-recovery-enabled"],"how_to_check":"- Check the gopacket version in `go.mod` or `go list -m github.com/google/gopacket`\n- Look for use of `DecodeOptions.SkipDecodeRecovery`, direct registered decoders, or `DecodingLayerParser` with `IgnorePanic` enabled","fix":"- gopacket: move to `1.7.2`","status":"open","published_at":"2026-10-30T17:17:18+00:00","first_seen_at":"2026-10-30T17:31:39+00:00","triaged_at":"2026-10-30T17:32:10+00:00","updated_at":"2026-10-30T17:32:10+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-30T17:32:10Z","model":"claude-haiku-5-5","output":{"fix":"- gopacket: move to `1.7.2`","reach":"network","title":"gopacket: crafted SCTP packet can crash Go apps decoding it","impact":"low","summary":"gopacket's SCTP decoder reads attacker-controlled lengths and counts without bounds checks, so a crafted SCTP segment causes a slice panic. Applications that skip the default panic recovery terminate; the impact is availability only.","audience":"developers","category":"package","nicknames":[],"who_cares":["go","gopacket","packet-capture","network-tools"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"crafted SCTP packet crashes the application process decoding it","analyst_note":"","how_to_check":"- Check the gopacket version in `go.mod` or `go list -m github.com/google/gopacket`\n- Look for use of `DecodeOptions.SkipDecodeRecovery`, direct registered decoders, or `DecodingLayerParser` with `IgnorePanic` enabled","plain_action":"","needs_analyst":false,"not_affected_if":["default-config","no-sctp-traffic","panic-recovery-enabled"],"who_is_affected":"Go applications that parse untrusted network traffic with gopacket and that either disable its default panic recovery (SkipDecodeRecovery, IgnorePanic) or call registered decoders directly. Default recovery-enabled APIs turn the panic into a per-packet decode error, so those applications are less exposed.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000718,"input_tokens":4413,"output_tokens":553,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119299':12A,15A '-2026':11A,14A,173C '-65819':174C '1.7.1':177C '1.7.2':69C,212C 'acknowledg':103C 'alloc':204C 'amplif':205C 'api':149C 'app':8A 'applic':48B,131C 'attack':31B,78C 'attacker-control':30B,77C 'avail':59B,196C 'bound':37B,122C,179C 'capabl':64C 'captur':24B 'caus':44B,118C 'chain':73C 'chang':178C 'check':38B,92C 'chunk':72C,95C 'contain':96C 'control':32B,79C 'convert':150C 'count':35B,83C 'craft':2A,41B,113C 'crash':6A 'cve':10A,13A,172C 'data':200C 'declar':80C 'decod':9A,28B,110C,137C,157C,165C 'decodesctperror':87C 'decodesctpinit':85C 'decodesctpparamet':90C 'decodesctpsack':88C 'decodesctpshutdown':86C 'decodinglayerpars':139C 'default':52B,145C 'direct':135C 'disclosur':201C 'dispatch':182C 'duplic':105C 'enabl':142C,148C 'error':158C 'field':99C 'fix':98C,209C 'gap':102C 'generic':181C 'go':7A,16B,66C 'gopacket':1A,17B,25B,60C 'gopacket.decodeoptions.skipdecoderecovery':134C 'ignorepan':141C 'impact':57B,194C 'invert':124C 'issu':207C 'layers/sctp.go':75C 'left':184C 'length':33B,81C 'loop':191C 'modif':202C 'name':167C 'network':19B 'network-tool':18B 'out-of-bound':119C 'packag':21B 'packet':4A,23B,62C,156C 'packet-captur':22B 'panic':47B,53B,126C,128C 'paramet':100C 'pass':76C 'per':155C,187C 'per-packet':154C 'per-typ':186C 'prior':67C 'process':63C 'provid':61C 'read':29B,111C,189C 'recoveri':54B,147C 'recovery-en':146C 'regist':136C 'remedi':170C 'residu':166C 'sctp':3A,27B,42B,71C,114C,162C 'segment':43B,115C 'skip':50B 'slice':46B,125C 'sub':109C,164C 'sub-decod':108C,163C 'termin':55B,130C 'therefor':117C 'tlvs':101C 'tool':20B 'tsns':106C 'type':188C 'uncheck':192C 'use':133C 'version':176C,211C 'whose':175C 'without':36B,91C","nicknames":[],"mitigations":[],"who_affected":"Go applications that parse untrusted network traffic with gopacket and that either disable its default panic recovery (SkipDecodeRecovery, IgnorePanic) or call registered decoders directly. Default recovery-enabled APIs turn the panic into a per-packet decode error, so those applications are less exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"first_public_at":"2026-10-30T17:17:18+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119299","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119299","severity":null,"published_at":"2026-10-30T17:17:18+00:00","modified_at":"2026-10-30T17:17:18+00:00","first_seen_at":"2026-10-30T17:31:39+00:00","fetched_at":"2026-10-30T17:31:39+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}