CVE-2026-119299

gopacket provides packet processing capabilities for Go. Prior to 1.7.2, the SCTP chunk chain in layers/sctp.go passes attacker-controlled declared lengths and counts to decodeSCTPInit, decodeSCTPShutdown, decodeSCTPError, decodeSCTPSack, and decodeSCTPParameter without checking that each chunk contains the fixed fields, parameter TLVs, gap acknowledgements, or duplicate TSNs those sub-decoders read. A crafted SCTP segment can therefore cause out-of-bounds or inverted slice panics; the panic can terminate applications that use gopacket.DecodeOptions.SkipDecodeRecovery, direct registered decoders, or DecodingLayerParser with IgnorePanic enabled, while the default recovery-enabled APIs convert it to a per-packet decode error. This is the SCTP sub-decoder residual named but not remediated by CVE-2026-65819, whose version 1.7.1 changes bounded the generic dispatcher but left these per-type reads and loops unchecked. The impact is availability only, with no data disclosure, modification, or allocation amplification. This issue is fixed in version 1.7.2.

• CWE-125
• CWE-129

• https://github.com/gopacket/gopacket/commit/508044327cc2c065b3db753c010a027e7d1ca621
• https://github.com/gopacket/gopacket/releases/tag/v1.7.2
• https://github.com/gopacket/gopacket/security/advisories/GHSA-358w-w75h-x6rx
• https://github.com/gopacket/gopacket/security/advisories/GHSA-358w-w75h-x6rx

Published

Oct 30, 2026

Last Modified

Oct 30, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-119288Zuke is a code-first, strongly typed build automation system…7
• CVE-2026-119289Zuke is a code-first, strongly typed build automation system…7.1
• CVE-2026-11929IBM Security Verify Identity Access Reverse Proxy in certain…7.5
• CVE-2026-119290Zuke is a code-first, strongly typed build automation system…7.5
• CVE-2026-119291Zuke is a code-first, strongly typed build automation system…5.5
• CVE-2026-119298croc is a tool that allows any two computers to simply and s…4.2
• CVE-2026-1193A vulnerability was identified in MineAdmin 1.x/2.x. The imp…8.8
• CVE-2026-11930IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Ver…7.5
• CVE-2026-119300Wekan is open source kanban built with Meteor. Prior to 11.1…6.5
• CVE-2026-11931Incorrect default permissions in Kiro IDE on macOS and Linux…5.5
• CVE-2026-119317On Linux, an authenticated, low-privileged Nessus user with …6.5
• CVE-2026-11932IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Ver…7.5