CVE-2026-119299 in gopacket
Summary
by MITRE • 10/30/2026
gopacket provides packet processing capabilities for Go. Prior to 1.7.2, the SCTP chunk chain in layers/sctp.go passes attacker-controlled declared lengths and counts to decodeSCTPInit, decodeSCTPShutdown, decodeSCTPError, decodeSCTPSack, and decodeSCTPParameter without checking that each chunk contains the fixed fields, parameter TLVs, gap acknowledgements, or duplicate TSNs those sub-decoders read. A crafted SCTP segment can therefore cause out-of-bounds or inverted slice panics; the panic can terminate applications that use gopacket.DecodeOptions.SkipDecodeRecovery, direct registered decoders, or DecodingLayerParser with IgnorePanic enabled, while the default recovery-enabled APIs convert it to a per-packet decode error. This is the SCTP sub-decoder residual named but not remediated by CVE-2026-65819, whose version 1.7.1 changes bounded the generic dispatcher but left these per-type reads and loops unchecked. The impact is availability only, with no data disclosure, modification, or allocation amplification. This issue is fixed in version 1.7.2.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/30/2026
The gopacket library serves as a foundational tool for network packet processing within the Go programming language ecosystem, enabling developers to parse and analyze various protocol layers including SCTP. A critical vulnerability exists in versions prior to 1.7.2 regarding the handling of Stream Control Transmission Protocol segments. Specifically, the implementation in layers/sctp.go fails to adequately validate input data before passing it to specific sub-decoders such as decodeSCTPInit, decodeSCTPShutdown, decodeSCTPError, decodeSCTPSack, and decodeSCTPParameter. These functions are responsible for interpreting complex SCTP chunk structures that rely on fixed field lengths, parameter Type-Length-Value configurations, gap acknowledgements, and duplicate Transmission Sequence Numbers. The core technical flaw lies in the acceptance of attacker-controlled declared lengths and counts without verifying that the actual packet data conforms to these structural expectations. This lack of validation allows a crafted SCTP segment with malformed or maliciously sized fields to trigger out-of-bounds memory access or inverted slice panics during the decoding process.
The operational impact of this vulnerability is primarily centered on service availability rather than confidentiality or integrity. When an application utilizes gopacket APIs that do not implement panic recovery, such as DecodeOptions configured with SkipDecodeRecovery enabled, direct registered decoders without error handling wrappers, or DecodingLayerParser instances where IgnorePanic is set to true, the execution of these applications will terminate abruptly upon processing a malicious packet. This results in a denial-of-service condition for services relying on gopacket for real-time network monitoring or traffic analysis. In contrast, applications using default recovery-enabled APIs will convert this panic into a per-packet decode error, thereby maintaining service continuity but potentially disrupting specific parsing logic that expects successful decoding of all segments. The vulnerability represents a residual issue from CVE-2026-65819, where version 1.7.1 attempted to bound the generic dispatcher but inadvertently left these specific per-type reads and loops unchecked, highlighting the complexity of securing deeply nested protocol parsers against malformed input variations.
From a classification perspective, this vulnerability aligns with CWE-20 Improper Input Validation as the root cause stems from insufficient checks on incoming data structures before processing. It also relates to CWE-125 Out-of-bounds Read due to the potential for accessing memory outside allocated slices when length fields are manipulated. In terms of attack tactics, this flaw can be exploited via ATT&CK technique T1498 Network Denial of Service, specifically through resource exhaustion or service disruption caused by application crashes triggered by malformed network traffic. The absence of data disclosure, modification capabilities, or allocation amplification limits the scope to availability impacts, yet it remains significant for any production environment processing untrusted SCTP streams such as those found in telecommunication signaling systems or high-throughput web services utilizing Stream Control Transmission Protocol.
Mitigation strategies focus on immediate software updates and defensive programming practices. The primary remediation is upgrading gopacket to version 1.7.2 or later, where the developers have addressed these unchecked reads and loops by implementing proper validation for chunk fields before invoking sub-decoders. For environments unable to upgrade immediately, developers should ensure that all packet decoding operations are wrapped in panic recovery mechanisms using defer statements with recover functions, particularly when processing untrusted network traffic. Additionally, configuring DecodingLayerParser or DecodeOptions to utilize default error handling rather than ignoring panics provides a critical layer of defense against application termination. Long-term resilience can be enhanced by implementing strict input validation at the network boundary and employing fuzzing techniques during development to identify similar structural parsing flaws in other protocol layers within the library.