---
id: "CVE-2026-129431"
page: "https://infrastack.ai/live/CVE-2026-129431"
kind: "vulnerability"
aliases: ["CVE-2026-129431"]
title: "Ettercap: SOCKS5 parser over-reads heap memory and leaks it into logs"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "ettercap", "fixed": [], "affected": "<= 0.8.5.1", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["ettercap", "heap-oob-read", "network-sniffing", "other", "security-testing"]
not_affected_if: ["ettercap-above-0.8.5.1", "ettercap-not-installed", "no-socks5-traffic-observed"]
published_at: "2026-11-14T13:17:22+00:00"
first_seen_at: "2026-11-14T13:28:10+00:00"
updated_at: "2026-11-14T13:31:38+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-129431", "first_seen_at": "2026-11-14T13:28:10+00:00"}, {"source": "analyst", "url": "https://github.com/Ettercap/ettercap/pull/1340", "first_seen_at": "2026-11-14T13:31:38+00:00", "cites": ["https://github.com/Ettercap/ettercap/pull/1340", "https://github.com/Ettercap/ettercap/blob/master/CHANGELOG"]}]
exploit_sources: []
---

# Ettercap: SOCKS5 parser over-reads heap memory and leaks it into logs

Link for people: https://infrastack.ai/live/CVE-2026-129431 (this .md is for agents)

Ettercap through 0.8.5.1 has a heap out-of-bounds read in its SOCKS5 dissector, where username and password lengths are not checked. A network-adjacent attacker can send a crafted SOCKS5 authentication packet that makes Ettercap read up to 255 bytes past a heap buffer and print or log that memory as captured credentials.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:ettercap affected <= 0.8.5.1 fixed no fixed version listed

## How to check

- Run ettercap --version: 0.8.5.1 and earlier are affected.
- Check whether src/dissectors/ec_socks.c in your build has the bounds check from PR #1340 (it checks ptr + user_len + pass_len + 3 <= end).
- Only matters if ettercap runs on a network where an attacker can send SOCKS5 packets that it observes.

## Fix

No released fixed version found. Upstream PR #1340 (ec_socks.c: bound SOCKS5 user/pass lengths against packet end) is closed, not confirmed merged; 0.8.5.1 is the newest release and is affected. Watch Ettercap/ettercap releases/master; until then avoid sniffing untrusted SOCKS5 traffic.

## Timeline

- 2026-11-14T13:28:10+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-129431
- 2026-11-14T13:31:38+00:00 analyst https://github.com/Ettercap/ettercap/pull/1340 — VulnCheck: ettercap <=0.8.5.1 affected. Maintainer PR #1340 (GHSA-4hmx-frcf-g9g5) bounds user/pass lengths in ec_socks.c, but the PR is closed and its commit is a PR-preview merge. I found no release containing the fix; CHANGELOG ends at 0.8.5.1 (20261110). No vendor statement that no fix exists, so fix status stays unknown.

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/ettercap-through-0.8.5.1-heap-out-of-bounds-read-via-socks5-dissector
- [fix] socks: bound user/pass lengths against the packet end (heap OOB read) #1340 https://github.com/Ettercap/ettercap/pull/1340
- [mentions] Ettercap CHANGELOG https://github.com/Ettercap/ettercap/blob/master/CHANGELOG

## From the sources

Ettercap through 0.8.5.1 contains a heap out-of-bounds read vulnerability in dissector_socks() in src/dissectors/ec_socks.c that allows network-adjacent attackers to read heap memory via unchecked SOCKS5 username/password lengths. Attackers can send a crafted SOCKS5 authentication packet observed by Ettercap to read up to 255 bytes past the heap buffer, disclosing memory printed and logged as captured credentials.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_