---
id: "CVE-2026-125403"
page: "https://infrastack.ai/live/CVE-2026-125403"
kind: "vulnerability"
aliases: ["CVE-2026-125403"]
title: "Ettercap: malformed HTTPS response can corrupt memory in root process"
severity: "high"
cvss: 8.1
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "ettercap", "fixed": [], "affected": "<= 0.8.4.1", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["ettercap", "other", "penetration-testing", "security-testing", "ssl-mitm"]
not_affected_if: ["built-from-master-after-1d8badb", "ettercap-not-installed", "no-ssl-interception"]
published_at: "2026-11-10T00:17:14+00:00"
first_seen_at: "2026-11-10T00:28:44+00:00"
updated_at: "2026-11-10T00:31:14+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-125403", "first_seen_at": "2026-11-10T00:28:44+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-10T00:31:14+00:00"}]
exploit_sources: []
---

# Ettercap: malformed HTTPS response can corrupt memory in root process

Link for people: https://infrastack.ai/live/CVE-2026-125403 (this .md is for agents)

In sslw_remove_sts() (src/ec_sslwrap.c), Ettercap searches for the end of the Strict-Transport-Security header with a stale length and does not check for NULL. A malicious HTTPS server whose response contains a truncated header can cause an out-of-bounds read and a size_t underflow feeding memcpy. The maintainers confirmed the out-of-bounds read, NULL dereference and underflow, but not the double-free originally reported. Ettercap normally runs as root.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:ettercap affected <= 0.8.4.1 fixed no fixed version listed

## How to check

- Run ettercap --version; 0.8.4.1 or earlier is affected (no release has the fix yet).
- Check whether you use SSL MITM / sslstrip (sslwrap) with Ettercap; the bug is only reachable on server-direction HTTPS responses in that mode.
- If you build from git, check that your tree includes commit 1d8badb713579419a29a494bb463a1af59707e98 (PR #1330).

## Fix

No released version fixes this: the advisory lists patched versions as None (affected <= 0.8.4.1). The fix is merged on master in commit 1d8badb (PR #1330); build from master at or after that commit until a release ships.

## Timeline

- 2026-11-10T00:28:44+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-125403
- 2026-11-10T00:31:14+00:00 analyst — Read GHSA-hq2w-pg4m-6w63: affected <=0.8.4.1, patched versions None; fix merged to master in 1d8badb (PR #1330). No release yet. Not exploited, no PoC found; did not search social.

## Documents

- [advisory] Vendor advisory: github.com https://github.com/Ettercap/ettercap/security/advisories/GHSA-hq2w-pg4m-6w63
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/ettercap-through-0.8.4.1-out-of-bounds-read-via-sslw-remove-sts
- [fix] Patch: github.com https://github.com/Ettercap/ettercap/commit/1d8badb713579419a29a494bb463a1af59707e98

## From the sources

Ettercap through 0.8.4.1 contains an out-of-bounds read and size_t underflow vulnerability in sslw_remove_sts() in src/ec_sslwrap.c, caused by a stale length and an unchecked memmem() result when stripping Strict-Transport-Security headers. A malicious HTTPS server whose response passes through Ettercap's SSL interception can trigger out-of-bounds reads and memory corruption in the Ettercap process, which normally runs as root.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_