{"id":"CVE-2026-125403","kind":"vulnerability","aliases":["CVE-2026-125403"],"related":[],"title":"Ettercap: malformed HTTPS response can corrupt memory in root process","description":"Ettercap through 0.8.4.1 contains an out-of-bounds read and size_t underflow vulnerability in sslw_remove_sts() in src/ec_sslwrap.c, caused by a stale length and an unchecked memmem() result when stripping Strict-Transport-Security headers. A malicious HTTPS server whose response passes through Ettercap's SSL interception can trigger out-of-bounds reads and memory corruption in the Ettercap process, which normally runs as root.","summary":"In sslw_remove_sts() (src/ec_sslwrap.c), Ettercap searches for the end of the Strict-Transport-Security header with a stale length and does not check for NULL. A malicious HTTPS server whose response contains a truncated header can cause an out-of-bounds read and a size_t underflow feeding memcpy. The maintainers confirmed the out-of-bounds read, NULL dereference and underflow, but not the double-free originally reported. Ettercap normally runs as root.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ettercap","fixed":[],"affected":"<= 0.8.4.1","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["ettercap","other","penetration-testing","security-testing","ssl-mitm"],"not_affected_if":["built-from-master-after-1d8badb","ettercap-not-installed","no-ssl-interception"],"how_to_check":"- Run ettercap --version; 0.8.4.1 or earlier is affected (no release has the fix yet).\n- Check whether you use SSL MITM / sslstrip (sslwrap) with Ettercap; the bug is only reachable on server-direction HTTPS responses in that mode.\n- If you build from git, check that your tree includes commit 1d8badb713579419a29a494bb463a1af59707e98 (PR #1330).","fix":"No released version fixes this: the advisory lists patched versions as None (affected <= 0.8.4.1). The fix is merged on master in commit 1d8badb (PR #1330); build from master at or after that commit until a release ships.","status":"open","published_at":"2026-11-10T00:17:14+00:00","first_seen_at":"2026-11-10T00:28:44+00:00","triaged_at":"2026-11-10T00:29:54+00:00","updated_at":"2026-11-10T00:31:14+00:00","category":"other","confidence":0.85,"triage":{"at":"2026-11-10T00:29:54Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Ettercap: malformed HTTPS response can corrupt memory in root process","impact":"high","summary":"Ettercap's SSL interception code mishandles Strict-Transport-Security header stripping, reading memory out of bounds and underflowing a size value. A malicious HTTPS server whose response passes through Ettercap can trigger memory corruption in the Ettercap process, which normally runs as root.","audience":"businesses","category":"other","nicknames":[],"who_cares":["ettercap","security-testing","penetration-testing"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Malicious server corrupts memory in root-running Ettercap process","analyst_note":"Confirm the fixed version and the patch from the linked GitHub patch and advisory pages; sources list no product ranges.","how_to_check":"- Check whether Ettercap is installed: `ettercap --version` or `which ettercap`\n- Confirm the installed version is 0.8.4.1 or earlier; the description says 'through 0.8.4.1'\n- Check whether SSL interception (sslwrap / HTTPS MITM) is enabled in the Ettercap configuration","plain_action":"","product_name":"ettercap","needs_analyst":true,"not_affected_if":["no-ssl-interception","ettercap-not-installed"],"who_is_affected":"Only teams that run Ettercap as a man-in-the-middle tool with SSL interception enabled are exposed, because the flaw is triggered by HTTPS responses passing through its sslwrap code. Systems that do not run Ettercap, or run it without SSL interception, are not described as affected. The sources do not name a fixed version.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000789,"input_tokens":4679,"output_tokens":642,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed version and the patch from the linked GitHub patch and advisory pages; sources list no product ranges.","search":"'-125403':13A,16A '-2026':12A,15A '0.8.4.1':109C 'bound':72B,88B,115C,162C 'caus':67B,128C 'check':53B 'confirm':83B 'contain':62B,110C 'corrupt':6A,166C 'cve':11A,14A 'derefer':91B 'doubl':98B 'double-fre':97B 'end':38B 'ettercap':1A,17A,18B,34B,102B,107C,153C,169C 'feed':79B 'free':99B 'header':45B,65B,144C 'https':3A,58B,147C 'intercept':156C 'length':49B,132C 'maintain':82B 'malform':2A 'malici':57B,146C 'memcpi':80B 'memmem':136C 'memori':7A,165C 'mitm':28B 'normal':103B,172C 'null':55B,90B 'origin':100B 'out-of-bound':69B,85B,112C,159C 'pass':151C 'penetr':21B 'penetration-test':20B 'process':10A,170C 'read':73B,89B,116C,163C 'remov':31B,124C 'report':101B 'respons':4A,61B,150C 'result':137C 'root':9A,106B,175C 'run':104B,173C 'search':35B 'secur':24B,44B,143C 'security-test':23B 'server':59B,148C 'size':76B,118C 'src/ec_sslwrap.c':33B,127C 'ssl':27B,155C 'ssl-mitm':26B 'sslw':30B,123C 'stale':48B,131C 'strict':42B,141C 'strict-transport-secur':41B,140C 'strip':139C 'sts':32B,125C 'test':22B,25B 'transport':43B,142C 'trigger':158C 'truncat':64B 'uncheck':135C 'underflow':78B,93B,120C 'vulner':121C 'whose':60B,149C","nicknames":[],"mitigations":[],"who_affected":"Anyone running Ettercap 0.8.4.1 or earlier with SSL interception (sslwrap / sslstrip) enabled, when a victim client reaches an attacker-controlled or influenced HTTPS server through it. The attacker needs a position on the same network segment (CVSS attack vector adjacent). Ettercap usually runs as root, so a crash or heap corruption lands in a privileged process. Skip if you do not use Ettercap or run it without SSL interception.","tier":"B","verified":{"fix":{"at":"2026-11-10T00:31:14Z","by":"analyst","doc":"https://github.com/Ettercap/ettercap/commit/1d8badb713579419a29a494bb463a1af59707e98","run_id":2359},"who_affected":{"at":"2026-11-10T00:31:14Z","by":"analyst","doc":"https://github.com/Ettercap/ettercap/commit/1d8badb713579419a29a494bb463a1af59707e98","run_id":2359}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["ettercap"],"ptokens":["ettercap"],"labels":["ettercap","high","other","penetrationtesting","securitytesting","sslmitm","vendor"],"campaign_type":null,"search_a":"'-125403':13A,16A '-2026':12A,15A 'corrupt':6A 'cve':11A,14A 'ettercap':1A,17A 'https':3A 'malform':2A 'memori':7A 'process':10A 'respons':4A 'root':9A","search_b":"'bound':72B,88B 'caus':67B 'check':53B 'confirm':83B 'contain':62B 'derefer':91B 'doubl':98B 'double-fre':97B 'end':38B 'ettercap':18B,34B,102B 'feed':79B 'free':99B 'header':45B,65B 'https':58B 'length':49B 'maintain':82B 'malici':57B 'memcpi':80B 'mitm':28B 'normal':103B 'null':55B,90B 'origin':100B 'out-of-bound':69B,85B 'penetr':21B 'penetration-test':20B 'read':73B,89B 'remov':31B 'report':101B 'respons':61B 'root':106B 'run':104B 'search':35B 'secur':24B,44B 'security-test':23B 'server':59B 'size':76B 'src/ec_sslwrap.c':33B 'ssl':27B 'ssl-mitm':26B 'sslw':30B 'stale':48B 'strict':42B 'strict-transport-secur':41B 'sts':32B 'test':22B,25B 'transport':43B 'truncat':64B 'underflow':78B,93B 'whose':60B","search_c":"'0.8.4.1':109C 'bound':115C,162C 'caus':128C 'contain':110C 'corrupt':166C 'ettercap':107C,153C,169C 'header':144C 'https':147C 'intercept':156C 'length':132C 'malici':146C 'memmem':136C 'memori':165C 'normal':172C 'out-of-bound':112C,159C 'pass':151C 'process':170C 'read':116C,163C 'remov':124C 'respons':150C 'result':137C 'root':175C 'run':173C 'secur':143C 'server':148C 'size':118C 'src/ec_sslwrap.c':127C 'ssl':155C 'sslw':123C 'stale':131C 'strict':141C 'strict-transport-secur':140C 'strip':139C 'sts':125C 'transport':142C 'trigger':158C 'uncheck':135C 'underflow':120C 'vulner':121C 'whose':149C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-06T02:58:22+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125403","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125403","severity":null,"published_at":"2026-11-10T00:17:14+00:00","modified_at":"2026-11-10T00:17:14+00:00","first_seen_at":"2026-11-10T00:28:44+00:00","fetched_at":"2026-11-10T00:28:44+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-125403:2359","url":null,"severity":null,"published_at":"2026-11-10T00:31:14+00:00","modified_at":"2026-11-10T00:31:14+00:00","first_seen_at":"2026-11-10T00:31:14+00:00","fetched_at":"2026-11-10T00:31:14+00:00","note":"Read GHSA-hq2w-pg4m-6w63: affected <=0.8.4.1, patched versions None; fix merged to master in 1d8badb (PR #1330). No release yet. Not exploited, no PoC found; did not search social."}],"documents":[{"id":111602,"url":"https://github.com/Ettercap/ettercap/commit/1d8badb713579419a29a494bb463a1af59707e98","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":111612,"url":"https://github.com/Ettercap/ettercap/security/advisories/GHSA-hq2w-pg4m-6w63","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-06T02:58:22+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":111613,"url":"https://www.vulncheck.com/advisories/ettercap-through-0.8.4.1-out-of-bounds-read-via-sslw-remove-sts","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}