{"id":"CVE-2026-125402","kind":"vulnerability","aliases":["CVE-2026-125402"],"related":[],"title":"Ettercap: crafted TLS ClientHello leaks heap memory or crashes sniffer","description":"Ettercap through 0.8.4.1 contains a heap out-of-bounds read vulnerability in sslw_get_clienthello_sni() in src/ec_sslwrap.c that trusts the unchecked 16-bit SNI length field. Network-adjacent attackers can send crafted TLS ClientHello messages during SSL interception to leak up to 64 KB of heap memory upstream or crash Ettercap.","summary":"Ettercap, a network man-in-the-middle tool, has a heap out-of-bounds read in its SSL interception code that trusts an unchecked 16-bit SNI length field. A network-adjacent attacker can send a crafted TLS ClientHello during SSL interception to leak up to 64 KB of heap memory or crash Ettercap.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ettercap","fixed":[],"affected":"<= 0.8.4.1","ecosystem":"vendor"}],"ecosystems":[],"tags":["ettercap","network-security","openssl","package","ssl-interception"],"not_affected_if":["built-without-openssl-1.1.1","ettercap-not-installed","ssl-interception-disabled"],"how_to_check":"Run 'ettercap --version'. 0.8.4.1 and earlier are affected, and there is no patched release yet. You are exposed only if Ettercap was built with OpenSSL 1.1.1 or later support (HAVE_OPENSSL_1_1_1) and you run SSL MITM/interception. Check that your build includes commit 1d8badb or later if you build from git.","fix":"No released version fixes this. The latest release, 0.8.4.1, is affected. The fix is merged on master in PR #1330 (commit 1d8badb, touches src/ec_sslwrap.c). Build from master at or after that commit until a release is cut.","status":"open","published_at":"2026-11-10T00:17:14+00:00","first_seen_at":"2026-11-10T00:28:44+00:00","triaged_at":"2026-11-10T00:29:55+00:00","updated_at":"2026-11-10T00:32:23+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-11-10T00:29:55Z","model":"claude-haiku-5-5","output":{"fix":"- unknown: the sources given name a patch on GitHub but do not state a fixed version in the product ranges.","reach":"network","title":"Ettercap: crafted TLS ClientHello leaks heap memory or crashes sniffer","impact":"medium","summary":"Ettercap, a network man-in-the-middle tool, has a heap out-of-bounds read in its SSL interception code that trusts an unchecked 16-bit SNI length field. A network-adjacent attacker can send a crafted TLS ClientHello during SSL interception to leak up to 64 KB of heap memory or crash Ettercap.","audience":"developers","category":"package","nicknames":[],"who_cares":["ettercap","network-security","ssl-interception"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Heap memory leaks upstream or Ettercap crashes","analyst_note":"Confirm the fixed Ettercap version and the patch commit from the GitHub advisory and patch links, and whether the vendor advisory names a release.","how_to_check":"- Check the installed Ettercap version with `ettercap --version` and compare it against the fixed release.\n- Look for SSL interception (sslwrap / `-S` or `-s` options) in how Ettercap is launched.\n- unknown for the exact affected package build paths.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["ssl-interception-disabled","ettercap-not-installed"],"who_is_affected":"Teams running Ettercap with SSL interception enabled on a network an attacker can reach, such as security testing or lab networks. Systems that do not run Ettercap or do not use SSL interception are unlikely to be affected. The sources do not say which Ettercap builds are patched beyond the upstream commit.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000791,"input_tokens":4656,"output_tokens":650,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed Ettercap version and the patch commit from the GitHub advisory and patch links, and whether the vendor advisory names a release.","search":"'-125402':13A,16A '-2026':12A,15A '0.8.4.1':86C '16':53B,107C '64':76B,129C 'adjac':61B,114C 'attack':62B,115C 'bit':54B,108C 'bound':42B,93C 'clienthello':4A,68B,99C,120C 'code':48B 'contain':87C 'craft':2A,66B,118C 'crash':9A,82B,136C 'cve':11A,14A 'ettercap':1A,17A,18B,27B,83B,84C,137C 'field':57B,111C 'get':98C 'heap':6A,38B,79B,89C,132C 'intercept':26B,47B,71B,124C 'kb':77B,130C 'leak':5A,73B,126C 'length':56B,110C 'man':31B 'man-in-the-middl':30B 'memori':7A,80B,133C 'messag':121C 'middl':34B 'network':20B,29B,60B,113C 'network-adjac':59B,112C 'network-secur':19B 'openssl':22B 'out-of-bound':39B,90C 'packag':23B 'read':43B,94C 'secur':21B 'send':64B,117C 'sni':55B,100C,109C 'sniffer':10A 'src/ec_sslwrap.c':102C 'ssl':25B,46B,70B,123C 'ssl-intercept':24B 'sslw':97C 'tls':3A,67B,119C 'tool':35B 'trust':50B,104C 'uncheck':52B,106C 'upstream':134C 'vulner':95C","nicknames":[],"mitigations":[],"who_affected":"Teams running Ettercap with SSL interception enabled on a network an attacker can reach, such as security testing or lab networks. Systems that do not run Ettercap or do not use SSL interception are unlikely to be affected. The sources do not say which Ettercap builds are patched beyond the upstream commit.","tier":"B","verified":{"fix":{"at":"2026-11-10T00:32:23Z","by":"analyst","doc":"https://github.com/Ettercap/ettercap/commit/1d8badb713579419a29a494bb463a1af59707e98","run_id":2360},"how_to_check":{"at":"2026-11-10T00:32:23Z","by":"analyst","doc":"https://github.com/Ettercap/ettercap/commit/1d8badb713579419a29a494bb463a1af59707e98","run_id":2360},"who_affected":{"at":"2026-11-10T00:32:23Z","by":"analyst","doc":"https://github.com/Ettercap/ettercap/commit/1d8badb713579419a29a494bb463a1af59707e98","run_id":2360}},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":["ettercap"],"ptokens":["ettercap"],"labels":["ettercap","high","networksecurity","openssl","package","sslinterception"],"campaign_type":null,"search_a":"'-125402':13A,16A '-2026':12A,15A 'clienthello':4A 'craft':2A 'crash':9A 'cve':11A,14A 'ettercap':1A,17A 'heap':6A 'leak':5A 'memori':7A 'sniffer':10A 'tls':3A","search_b":"'16':53B '64':76B 'adjac':61B 'attack':62B 'bit':54B 'bound':42B 'clienthello':68B 'code':48B 'craft':66B 'crash':82B 'ettercap':18B,27B,83B 'field':57B 'heap':38B,79B 'intercept':26B,47B,71B 'kb':77B 'leak':73B 'length':56B 'man':31B 'man-in-the-middl':30B 'memori':80B 'middl':34B 'network':20B,29B,60B 'network-adjac':59B 'network-secur':19B 'openssl':22B 'out-of-bound':39B 'packag':23B 'read':43B 'secur':21B 'send':64B 'sni':55B 'ssl':25B,46B,70B 'ssl-intercept':24B 'tls':67B 'tool':35B 'trust':50B 'uncheck':52B","search_c":"'0.8.4.1':86C '16':107C '64':129C 'adjac':114C 'attack':115C 'bit':108C 'bound':93C 'clienthello':99C,120C 'contain':87C 'craft':118C 'crash':136C 'ettercap':84C,137C 'field':111C 'get':98C 'heap':89C,132C 'intercept':124C 'kb':130C 'leak':126C 'length':110C 'memori':133C 'messag':121C 'network':113C 'network-adjac':112C 'out-of-bound':90C 'read':94C 'send':117C 'sni':100C,109C 'src/ec_sslwrap.c':102C 'ssl':123C 'sslw':97C 'tls':119C 'trust':104C 'uncheck':106C 'upstream':134C 'vulner':95C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-06T02:58:22+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125402","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125402","severity":null,"published_at":"2026-11-10T00:17:14+00:00","modified_at":"2026-11-10T00:17:14+00:00","first_seen_at":"2026-11-10T00:28:44+00:00","fetched_at":"2026-11-10T00:28:44+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-125402:2360","url":null,"severity":null,"published_at":"2026-11-10T00:32:23+00:00","modified_at":"2026-11-10T00:32:23+00:00","first_seen_at":"2026-11-10T00:32:23+00:00","fetched_at":"2026-11-10T00:32:23+00:00","note":"Read GHSA-v48w-7cvh-c7f4: affected <= 0.8.4.1, patched versions None; preconditions SSL MITM active + HAVE_OPENSSL_1_1_1. Fix merged to master via PR #1330 (1d8badb); releases page shows no release after 0.8.4.1 (2026-04-07). Advisory notes the reported double-free was not confirmed, only the OOB read (plus a minor leak). No exploitation or PoC found; did not search social."}],"documents":[{"id":111602,"url":"https://github.com/Ettercap/ettercap/commit/1d8badb713579419a29a494bb463a1af59707e98","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":111609,"url":"https://github.com/Ettercap/ettercap/security/advisories/GHSA-v48w-7cvh-c7f4","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-06T02:58:22+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":111610,"url":"https://www.vulncheck.com/advisories/ettercap-through-0.8.4.1-heap-out-of-bounds-read-via-tls-sni-parsing","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}