CVE-2026-119299— gopacket: SCTP chunk sub-decoder out-of-bounds panics on crafted segments

Quick assessment

Affected

gopacket gopacket

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

gopacket 为 Go 语言提供了数据包处理能力。在 1.7.2 版本之前，中的 SCTP 分片链会将攻击者控制的声明长度和计数传递给、、、以及，却未验证每个分片是否包含这些子解码器所需的固定字段、参数 TLV（类型 - 长度 - 值）、间隙确认（gap acknowledgements）或重复的 TSN（传输序列号）。因此，精心构造的 SCTP 分段可能导致越界访问或切片反转引发的 panic。若应用程序使用了、直接注册了解码器，或启用了的，该 panic 将导致应用终止；而默认启用恢复机制

CVSS 5.9 · Medium Updated Oct 31, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

Vendor	Product	Version Range	Status
gopacket	gopacket	`< 1.7.2`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

gopacket: SCTP chunk sub-decoder out-of-bounds panics on crafted segments

Source: CVE Program / CVE List V5

Vulnerability Description

gopacket provides packet processing capabilities for Go. Prior to 1.7.2, the SCTP chunk chain in layers/sctp.go passes attacker-controlled declared lengths and counts to decodeSCTPInit, decodeSCTPShutdown, decodeSCTPError, decodeSCTPSack, and decodeSCTPParameter without checking that each chunk contains the fixed fields, parameter TLVs, gap acknowledgements, or duplicate TSNs those sub-decoders read. A crafted SCTP segment can therefore cause out-of-bounds or inverted slice panics; the panic can terminate applications that use gopacket.DecodeOptions.SkipDecodeRecovery, direct registered decoders, or DecodingLayerParser with IgnorePanic enabled, while the default recovery-enabled APIs convert it to a per-packet decode error. This is the SCTP sub-decoder residual named but not remediated by CVE-2026-65819, whose version 1.7.1 changes bounded the generic dispatcher but left these per-type reads and loops unchecked. The impact is availability only, with no data disclosure, modification, or allocation amplification. This issue is fixed in version 1.7.2.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

跨界内存读

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
gopacket	gopacket	< 1.7.2	-

II. Public POCs for CVE-2026-119299

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-119299

请登录查看更多情报信息。

Other References for CVE-2026-119299 (3)

https://github.com/gopacket/gopacket/releases/tag/v1.7.2 x_refsource_MISC
https://github.com/gopacket/gopacket/security/advisories/GHSA-358w-w75h-x6rx x_refsource_CONFIRM
https://github.com/gopacket/gopacket/commit/508044327cc2c065b3db753c010a027e7d1ca621 x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-119299

IV. Related Vulnerabilities

Same product: gopacket

Same vendor: gopacket

Same weakness: CWE-125