---
id: "CVE-2026-125402"
page: "https://infrastack.ai/live/CVE-2026-125402"
kind: "vulnerability"
aliases: ["CVE-2026-125402"]
title: "Ettercap: crafted TLS ClientHello leaks heap memory or crashes sniffer"
severity: "high"
cvss: 8.1
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "ettercap", "fixed": [], "affected": "<= 0.8.4.1", "ecosystem": "vendor"}]
ecosystems: []
tags: ["ettercap", "network-security", "openssl", "package", "ssl-interception"]
not_affected_if: ["built-without-openssl-1.1.1", "ettercap-not-installed", "ssl-interception-disabled"]
published_at: "2026-11-10T00:17:14+00:00"
first_seen_at: "2026-11-10T00:28:44+00:00"
updated_at: "2026-11-10T00:32:23+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-125402", "first_seen_at": "2026-11-10T00:28:44+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-10T00:32:23+00:00"}]
exploit_sources: []
---

# Ettercap: crafted TLS ClientHello leaks heap memory or crashes sniffer

Link for people: https://infrastack.ai/live/CVE-2026-125402 (this .md is for agents)

Ettercap, a network man-in-the-middle tool, has a heap out-of-bounds read in its SSL interception code that trusts an unchecked 16-bit SNI length field. A network-adjacent attacker can send a crafted TLS ClientHello during SSL interception to leak up to 64 KB of heap memory or crash Ettercap.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:ettercap affected <= 0.8.4.1 fixed no fixed version listed

## How to check

Run 'ettercap --version'. 0.8.4.1 and earlier are affected, and there is no patched release yet. You are exposed only if Ettercap was built with OpenSSL 1.1.1 or later support (HAVE_OPENSSL_1_1_1) and you run SSL MITM/interception. Check that your build includes commit 1d8badb or later if you build from git.

## Fix

No released version fixes this. The latest release, 0.8.4.1, is affected. The fix is merged on master in PR #1330 (commit 1d8badb, touches src/ec_sslwrap.c). Build from master at or after that commit until a release is cut.

## Timeline

- 2026-11-10T00:28:44+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-125402
- 2026-11-10T00:32:23+00:00 analyst — Read GHSA-v48w-7cvh-c7f4: affected <= 0.8.4.1, patched versions None; preconditions SSL MITM active + HAVE_OPENSSL_1_1_1. Fix merged to master via PR #1330 (1d8badb); releases page shows no release after 0.8.4.1 (2026-04-07). Advisory notes the reported double-free was not confirmed, only the OOB read (plus a minor leak). No exploitation or PoC found; did not search social.

## Documents

- [advisory] Vendor advisory: github.com https://github.com/Ettercap/ettercap/security/advisories/GHSA-v48w-7cvh-c7f4
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/ettercap-through-0.8.4.1-heap-out-of-bounds-read-via-tls-sni-parsing
- [fix] Patch: github.com https://github.com/Ettercap/ettercap/commit/1d8badb713579419a29a494bb463a1af59707e98

## From the sources

Ettercap through 0.8.4.1 contains a heap out-of-bounds read vulnerability in sslw_get_clienthello_sni() in src/ec_sslwrap.c that trusts the unchecked 16-bit SNI length field. Network-adjacent attackers can send crafted TLS ClientHello messages during SSL interception to leak up to 64 KB of heap memory upstream or crash Ettercap.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_