CVE-2026-119299
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk41th percentile - higher than 41% of all known CVEs
Summary
gopacket, a Go packet processing library, prior to 1.7.2 passes attacker-controlled declared lengths and counts in layers/sctp.go to the SCTP sub-decoders (decodeSCTPInit, decodeSCTPShutdown, decodeSCTPError, decodeSCTPSack, decodeSCTPParameter) without checking that each chunk contains the required fields. A crafted SCTP segment can cause out-of-bounds or inverted slice panics. The panic can terminate applications using SkipDecodeRecovery, direct registered decoders, or DecodingLayerParser with IgnorePanic; default recovery-enabled APIs convert it to a per-packet decode error.
Risk Assessment
A remote attacker can trigger a panic and crash an application processing SCTP packets, causing denial of service. Impact is limited to availability with no data disclosure or modification.
Recommendation
Upgrade gopacket to version 1.7.2 or later. If upgrading is not possible, avoid SkipDecodeRecovery and IgnorePanic configurations and consider validating SCTP segments before decoding.
Other vulnerabilities in gopacket
See all- CVE-2026-65819High
gopacket provides packet processing capabilities for Go. Through version 1.7.0, multiple layer decoders use attacker-controlled lengths, counts, or offsets before validating them against packet buffers, allowing a crafted packet decoded through DecodingLayerParser or DecodeFromBytes to trigger an unrecovered panic and remotely deny service. A patch commit is available at 210f25f.
- CVE-2026-54345High
The gopacket library for Go version 1.6.0 and earlier has a vulnerability in the Diameter AVP decoder. An attacker can control the Length field in an AVP, causing an unsigned 32-bit underflow and allocation of about 4 GiB memory. Two such messages can cause OOM and denial of service.
- CVE-2026-54332High
The gopacket library for Go version 1.6.0 and earlier has a vulnerability in the sFlow ExtendedGatewayFlow decoder. An attacker controls 32-bit community and AS path member counts, leading to allocation of up to 16 GiB memory from a 104-byte UDP datagram, causing denial of service.
Original NVD description (English source)
gopacket provides packet processing capabilities for Go. Prior to 1.7.2, the SCTP chunk chain in layers/sctp.go passes attacker-controlled declared lengths and counts to decodeSCTPInit, decodeSCTPShutdown, decodeSCTPError, decodeSCTPSack, and decodeSCTPParameter without checking that each chunk contains the fixed fields, parameter TLVs, gap acknowledgements, or duplicate TSNs those sub-decoders read. A crafted SCTP segment can therefore cause out-of-bounds or inverted slice panics; the panic can terminate applications that use gopacket.DecodeOptions.SkipDecodeRecovery, direct registered decoders, or DecodingLayerParser with IgnorePanic enabled, while the default recovery-enabled APIs convert it to a per-packet decode error. This is the SCTP sub-decoder residual named but not remediated by CVE-2026-65819, whose version 1.7.1 changes bounded the generic dispatcher but left these per-type reads and loops unchecked. The impact is availability only, with no data disclosure, modification, or allocation amplification. This issue is fixed in version 1.7.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS