ETTERCAP · CVE-2026-125403 · Other
NO FIX YET · SEE WHAT TO DO
In sslw_remove_sts() (src/ec_sslwrap.c), Ettercap searches for the end of the Strict-Transport-Security header with a stale length and does not check for NULL. A malicious HTTPS server whose response contains a truncated header can cause an out-of-bounds read and a size_t underflow feeding memcpy. The maintainers confirmed the out-of-bounds read, NULL dereference and underflow, but not the double-free originally reported. Ettercap normally runs as root.
first public Nov 6, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Anyone running Ettercap 0.8.4.1 or earlier with SSL interception (sslwrap / sslstrip) enabled, when a victim client reaches an attacker-controlled or influenced HTTPS server through it. The attacker needs a position on the same network segment (CVSS attack vector adjacent). Ettercap usually runs as root, so a crash or heap corruption lands in a privileged process. Skip if you do not use Ettercap or run it without SSL interception.
Not affected if built-from-master-after-1d8badb, ettercap-not-installed, no-ssl-interception
Who cares ettercap, penetration-testing, security-testing, ssl-mitm
Ettercap through 0.8.4.1 contains an out-of-bounds read and size_t underflow vulnerability in sslw_remove_sts() in src/ec_sslwrap.c, caused by a stale length and an unchecked memmem() result when stripping Strict-Transport-Security headers. A malicious HTTPS server whose response passes through Ettercap's SSL interception can trigger out-of-bounds reads and memory corruption in the Ettercap process, which normally runs as root.
This page as .md ·
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
0.8.4.1)NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.