{"id":"CVE-2026-129431","kind":"vulnerability","aliases":["CVE-2026-129431"],"related":[],"title":"Ettercap: SOCKS5 parser over-reads heap memory and leaks it into logs","description":"Ettercap through 0.8.5.1 contains a heap out-of-bounds read vulnerability in dissector_socks() in src/dissectors/ec_socks.c that allows network-adjacent attackers to read heap memory via unchecked SOCKS5 username/password lengths. Attackers can send a crafted SOCKS5 authentication packet observed by Ettercap to read up to 255 bytes past the heap buffer, disclosing memory printed and logged as captured credentials.","summary":"Ettercap through 0.8.5.1 has a heap out-of-bounds read in its SOCKS5 dissector, where username and password lengths are not checked. A network-adjacent attacker can send a crafted SOCKS5 authentication packet that makes Ettercap read up to 255 bytes past a heap buffer and print or log that memory as captured credentials.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ettercap","fixed":[],"affected":"<= 0.8.5.1","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["ettercap","heap-oob-read","network-sniffing","other","security-testing"],"not_affected_if":["ettercap-above-0.8.5.1","ettercap-not-installed","no-socks5-traffic-observed"],"how_to_check":"- Run ettercap --version: 0.8.5.1 and earlier are affected.\n- Check whether src/dissectors/ec_socks.c in your build has the bounds check from PR #1340 (it checks ptr + user_len + pass_len + 3 <= end).\n- Only matters if ettercap runs on a network where an attacker can send SOCKS5 packets that it observes.","fix":"No released fixed version found. Upstream PR #1340 (ec_socks.c: bound SOCKS5 user/pass lengths against packet end) is closed, not confirmed merged; 0.8.5.1 is the newest release and is affected. Watch Ettercap/ettercap releases/master; until then avoid sniffing untrusted SOCKS5 traffic.","status":"open","published_at":"2026-11-14T13:17:22+00:00","first_seen_at":"2026-11-14T13:28:10+00:00","triaged_at":"2026-11-14T13:29:02+00:00","updated_at":"2026-11-14T13:31:38+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-11-14T13:29:02Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Ettercap: SOCKS5 parser over-reads heap memory and leaks it into logs","impact":"low","summary":"Ettercap through 0.8.5.1 has a heap out-of-bounds read in its SOCKS5 dissector, where username and password lengths are not checked. A network-adjacent attacker can send a crafted SOCKS5 authentication packet that makes Ettercap read up to 255 bytes past a heap buffer and print or log that memory as captured credentials.","audience":"businesses","category":"other","nicknames":[],"who_cares":["ettercap","network-sniffing","security-testing"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"memory contents leak into logged captured credentials","analyst_note":"Find the upstream fixed version and the vulncheck advisory details for CVE-2026-129431 to confirm the fix and affected range.","how_to_check":"- Run `ettercap --version` or check the installed version against the ranges below.\n- Confirm whether ettercap is used to sniff or intercept traffic on a shared network where SOCKS5 is observed.","plain_action":"","product_name":"ettercap","needs_analyst":true,"not_affected_if":["ettercap-not-installed","no-socks5-traffic-observed","ettercap-above-0.8.5.1"],"who_is_affected":"Only hosts running Ettercap through 0.8.5.1 that actively observe network traffic, such as security testers or lab machines on a shared network, are exposed. The sources do not say which fixed version exists, and the flaw needs an attacker on the same network segment sending SOCKS5 traffic.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000779,"input_tokens":4638,"output_tokens":631,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the upstream fixed version and the vulncheck advisory details for CVE-2026-129431 to confirm the fix and affected range.","search":"'-129431':16A,19A '-2026':15A,18A '0.8.5.1':35B,91C '255':74B,136C 'adjac':59B,110C 'allow':107C 'attack':60B,111C,121C 'authent':66B,127C 'bound':42B,98C 'buffer':79B,141C 'byte':75B,137C 'captur':87B,148C 'check':55B 'contain':92C 'craft':64B,125C 'credenti':88B,149C 'cve':14A,17A 'disclos':142C 'dissector':47B,102C 'ettercap':1A,20A,21B,33B,70B,89C,131C 'heap':7A,23B,38B,78B,94C,114C,140C 'heap-oob-read':22B 'leak':10A 'length':52B,120C 'log':13A,83B,146C 'make':69B 'memori':8A,85B,115C,143C 'network':27B,58B,109C 'network-adjac':57B,108C 'network-snif':26B 'observ':129C 'oob':24B 'out-of-bound':39B,95C 'over-read':4A 'packet':67B,128C 'parser':3A 'password':51B 'past':76B,138C 'print':81B,144C 'read':6A,25B,43B,71B,99C,113C,133C 'secur':31B 'security-test':30B 'send':62B,123C 'snif':28B 'sock':103C 'socks5':2A,46B,65B,118C,126C 'src/dissectors/ec_socks.c':105C 'test':32B 'uncheck':117C 'usernam':49B 'username/password':119C 'via':116C 'vulner':100C","nicknames":[],"mitigations":[],"who_affected":"Ettercap through 0.8.5.1 is affected, meaning machines used for sniffing or MITM testing. An attacker on the same network segment can send a crafted SOCKS5 auth packet (after a server 05 02/05 00 reply creates the session). Ettercap then reads up to 255 bytes past a heap buffer and prints or logs them as credentials. Anyone not running ettercap, or not letting it dissect SOCKS5 traffic, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":["ettercap"],"ptokens":["ettercap"],"labels":["ettercap","heapoobread","high","networksniffing","other","securitytesting","vendor"],"campaign_type":null,"search_a":"'-129431':16A,19A '-2026':15A,18A 'cve':14A,17A 'ettercap':1A,20A 'heap':7A 'leak':10A 'log':13A 'memori':8A 'over-read':4A 'parser':3A 'read':6A 'socks5':2A","search_b":"'0.8.5.1':35B '255':74B 'adjac':59B 'attack':60B 'authent':66B 'bound':42B 'buffer':79B 'byte':75B 'captur':87B 'check':55B 'craft':64B 'credenti':88B 'dissector':47B 'ettercap':21B,33B,70B 'heap':23B,38B,78B 'heap-oob-read':22B 'length':52B 'log':83B 'make':69B 'memori':85B 'network':27B,58B 'network-adjac':57B 'network-snif':26B 'oob':24B 'out-of-bound':39B 'packet':67B 'password':51B 'past':76B 'print':81B 'read':25B,43B,71B 'secur':31B 'security-test':30B 'send':62B 'snif':28B 'socks5':46B,65B 'test':32B 'usernam':49B","search_c":"'0.8.5.1':91C '255':136C 'adjac':110C 'allow':107C 'attack':111C,121C 'authent':127C 'bound':98C 'buffer':141C 'byte':137C 'captur':148C 'contain':92C 'craft':125C 'credenti':149C 'disclos':142C 'dissector':102C 'ettercap':89C,131C 'heap':94C,114C,140C 'length':120C 'log':146C 'memori':115C,143C 'network':109C 'network-adjac':108C 'observ':129C 'out-of-bound':95C 'packet':128C 'past':138C 'print':144C 'read':99C,113C,133C 'send':123C 'sock':103C 'socks5':118C,126C 'src/dissectors/ec_socks.c':105C 'uncheck':117C 'username/password':119C 'via':116C 'vulner':100C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-14T13:17:22+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-129431","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-129431","severity":null,"published_at":"2026-11-14T13:17:22+00:00","modified_at":"2026-11-14T13:17:22+00:00","first_seen_at":"2026-11-14T13:28:10+00:00","fetched_at":"2026-11-14T13:28:10+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-129431:3984","url":"https://github.com/Ettercap/ettercap/pull/1340","severity":null,"published_at":"2026-11-14T13:31:38+00:00","modified_at":"2026-11-14T13:31:38+00:00","first_seen_at":"2026-11-14T13:31:38+00:00","fetched_at":"2026-11-14T13:31:38+00:00","note":"VulnCheck: ettercap <=0.8.5.1 affected. Maintainer PR #1340 (GHSA-4hmx-frcf-g9g5) bounds user/pass lengths in ec_socks.c, but the PR is closed and its commit is a PR-preview merge. I found no release containing the fix; CHANGELOG ends at 0.8.5.1 (20261110). No vendor statement that no fix exists, so fix status stays unknown.","cites":["https://github.com/Ettercap/ettercap/pull/1340","https://github.com/Ettercap/ettercap/blob/master/CHANGELOG"]}],"documents":[{"id":155848,"url":"https://www.vulncheck.com/advisories/ettercap-through-0.8.5.1-heap-out-of-bounds-read-via-socks5-dissector","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"},{"id":155870,"url":"https://github.com/Ettercap/ettercap/pull/1340","title":"socks: bound user/pass lengths against the packet end (heap OOB read) #1340","kind":"issue","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":155871,"url":"https://github.com/Ettercap/ettercap/blob/master/CHANGELOG","title":"Ettercap CHANGELOG","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}