ETTERCAP · CVE-2026-129431 · Other
NO FIX YET · SEE WHAT TO DO
Ettercap through 0.8.5.1 has a heap out-of-bounds read in its SOCKS5 dissector, where username and password lengths are not checked. A network-adjacent attacker can send a crafted SOCKS5 authentication packet that makes Ettercap read up to 255 bytes past a heap buffer and print or log that memory as captured credentials.
first public Nov 14, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Ettercap through 0.8.5.1 is affected, meaning machines used for sniffing or MITM testing. An attacker on the same network segment can send a crafted SOCKS5 auth packet (after a server 05 02/05 00 reply creates the session). Ettercap then reads up to 255 bytes past a heap buffer and prints or logs them as credentials. Anyone not running ettercap, or not letting it dissect SOCKS5 traffic, can skip it.
Not affected if ettercap-above-0.8.5.1, ettercap-not-installed, no-socks5-traffic-observed
Who cares ettercap, heap-oob-read, network-sniffing, security-testing
0.8.5.1 is the newest release and is affectedEttercap through 0.8.5.1 contains a heap out-of-bounds read vulnerability in dissector_socks() in src/dissectors/ec_socks.c that allows network-adjacent attackers to read heap memory via unchecked SOCKS5 username/password lengths. Attackers can send a crafted SOCKS5 authentication packet observed by Ettercap to read up to 255 bytes past the heap buffer, disclosing memory printed and logged as captured credentials.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.