SCTP Vulnerability in Go Packet Processing Tool Affecting gopacket
CVE-2026-119299

5.9MEDIUM

Key Information:

Vendor

Gopacket

Status
Gopacket
Vendor
CVE Published:
30 October 2026

What is CVE-2026-119299?

The gopacket library, used for packet processing in Go, contains an out-of-bounds access vulnerability in its handling of SCTP chunk chains. Prior to version 1.7.2, specific functions such as decodeSCTPInit and others process attacker-controlled input without proper validation, leading to potential application crashes. This vulnerability poses a risk to the availability of applications utilizing gopacket, especially those configured with bypass mechanisms that could exploit this weakness. The issue has been addressed in version 1.7.2, which mitigates the risk and ensures robust processing of SCTP segments.

Affected Version(s)

gopacket < 1.7.2

References

https://github.com/gopacket/gopacket/security/advisories/...
x_refsource_CONFIRM
https://github.com/gopacket/gopacket/commit/508044327cc2c...
x_refsource_MISC
https://github.com/gopacket/gopacket/releases/tag/v1.7.2
x_refsource_MISC

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.