ETTERCAP · CVE-2026-125405 · Other
NO FIX YET · SEE WHAT TO DO
Ettercap through 0.8.4.1 fails to validate NTLM message offsets in Parse_NTLM_Auth(), so reading an HTTP Authorization header can read beyond the buffer. An attacker who sends a crafted header that Ettercap observes can disclose process memory or crash it.
first public Nov 6, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Hosts running Ettercap (0.8.4.1 and earlier) with the HTTP dissector active are exposed: a peer on the same network segment can send an HTTP Authorization or Proxy-Authorization NTLM Type 3 header that makes Ettercap read heap memory beyond its buffer. The leaked bytes are printed and logged on the operator's console, and the process can crash. Teams that do not run Ettercap for sniffing or MITM work can skip it.
Not affected if ettercap-not-installed
Who cares ettercap, network-security, out-of-bounds-read, pentesting
ettercap --version; 0.8.4.1 and earlier are affected, and no released version contains the fix yet.git merge-base --is-ancestor 1d8badb HEAD).Ettercap through 0.8.4.1 contains an out-of-bounds read vulnerability in Parse_NTLM_Auth() in src/dissectors/ec_http.c due to unvalidated NTLM message offsets. Attackers can send a crafted HTTP Authorization header observed by Ettercap to read beyond the buffer, disclosing memory or crashing the process.
This page as .md · .json · CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.