CVE-2026-119299: 
Analyse et atténuation de la vulnérabilité

CVE-2026-119299 is an SCTP chunk sub-decoder out-of-bounds panic vulnerability in the gopacket Go packet processing library. Prior to version 1.7.2, the SCTP chunk chain decoder in layers/sctp.go passes attacker-controlled declared lengths and counts to decodeSCTPInit, decodeSCTPShutdown, decodeSCTPError, decodeSCTPSack, and decodeSCTPParameter without validating that each chunk contains the required fixed fields, parameter TLVs, gap acknowledgements, or duplicate TSNs. All versions through v1.7.1 are affected; the fix was released in v1.7.2. It carries a CVSS v3.1 base score of 5.9 (Medium) (GitHub Advisory, GitHub Release).

The root cause is improper validation of array indices and out-of-bounds reads (CWE-125, CWE-129) in layers/sctp.go. Four independent panic paths exist: (1) decodeSCTPInit reads data[4:8], data[8:12], and data[16:20] without verifying the chunk is at least 20 bytes; (2) decodeSCTPShutdown reads data[4:8] on chunks validated only to be ≥ 4 bytes; (3) decodeSCTPParameter slices data[4:length] without checking length >= 4 or length <= len(data), producing inverted or out-of-bounds slices; (4) decodeSCTPSack iterates attacker-controlled NumGapACKs and NumDuplicateTSNs counts without bounding them against available bytes. This vulnerability is the residual SCTP component named but not remediated by CVE-2026-65819, whose v1.7.1 fix (commit b772f56) hardened the generic chunk dispatcher but left all per-type sub-decoders unchecked. A public PoC (repro_sctp.go) demonstrates the panic using a 54-byte crafted Ethernet frame containing an SCTP INIT chunk with a declared length of 8 bytes (GitHub Advisory, Fix Commit).

The impact is limited to availability — there is no data disclosure, integrity violation, or allocation amplification. An unauthenticated remote attacker can crash any application using gopacket to decode untrusted SCTP packets if the application has disabled panic recovery via DecodeOptions.SkipDecodeRecovery: true, uses direct registered decoders, or uses DecodingLayerParser with IgnorePanic: true. Applications using the default gopacket.NewPacket API or DecodingLayerParser with IgnorePanic: false are not crash surfaces — the panic is converted to a per-packet decode error — but they will fail to decode the malformed packet. Primary targets include network packet analysis engines, IDS/NDR pipelines, and capture-processing tools that disable recovery for performance reasons (GitHub Advisory).

A proof-of-concept exploit (repro_sctp.go) is publicly available in the GitHub Security Advisory, demonstrating the crash with a single 54-byte crafted SCTP frame. The exploit is classified as a crash reproducer (denial-of-service), not a weaponized exploit, and requires the target application to have disabled gopacket's panic recovery — a condition outside the attacker's direct control, which is why Attack Complexity is rated High. There is no evidence of in-the-wild exploitation at this time, no known threat actor attribution, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is 0.0, and NVD SSVC classifies exploitation status as "poc" (GitHub Advisory).

1. Reconnaissance: Identify applications that use github.com/gopacket/gopacket at version ≤ 1.7.1 and process untrusted or live network SCTP traffic (IP protocol 132), particularly those configured with SkipDecodeRecovery: true or IgnorePanic: true.
2. Craft malicious SCTP segment: Construct a minimal crafted frame — for example, a 54-byte Ethernet → IPv4 (protocol 0x84) → SCTP common header → INIT chunk with type 0x01, flags 0x00, and declared length 0x0008 (8 bytes) followed by a 4-byte body. This understates the minimum required 20 bytes for decodeSCTPInit.
3. Deliver the packet: Inject the crafted raw IP protocol 132 packet onto the network segment being captured or processed by the target application (e.g., via a live capture interface, a PCAP replay, or a network tap).
4. Trigger the panic: When the gopacket decoder processes the packet, decodeSCTPInit attempts to read data[8:12] on an 8-byte chunk, triggering panic: runtime error: slice bounds out of range [:12] with capacity 8.
5. Achieve denial of service: If the application uses SkipDecodeRecovery: true or direct registered decoders without recovery, the panic propagates uncaught and terminates the process. With default options, the panic is caught and converted to a per-packet decode error, leaving the process running (GitHub Advisory).

• Network: Unexpected raw SCTP packets (IP protocol 132) with malformed or undersized chunk lengths (e.g., INIT chunks with declared length < 20, SHUTDOWN chunks with declared length < 8, SACK chunks with NumGapACKs/NumDuplicateTSNs counts exceeding available bytes) arriving at hosts running gopacket-based applications.
• Logs: Application crash logs or Go runtime panic output containing messages such as panic: runtime error: slice bounds out of range [:12] with capacity 8 or similar, with stack traces referencing layers.decodeSCTPInit, layers.decodeSCTPShutdown, layers.decodeSCTPSack, layers.decodeSCTPError, or layers.decodeSCTPParameter in layers/sctp.go.
• Process: Unexpected termination of gopacket-based network analysis processes (IDS sensors, NDR agents, packet capture tools) without a clear operational cause, particularly when SCTP traffic is present on the monitored network segment (GitHub Advisory).

Upgrade github.com/gopacket/gopacket to version 1.7.2 or later using go get github.com/gopacket/gopacket@v1.7.2. The fix (commit 5080443) adds minimum-length checks to decodeSCTPInit (≥ 20 bytes), decodeSCTPShutdown (≥ 8 bytes), decodeSCTPSack (≥ 16 bytes, with count validation), and decodeSCTPParameter (≥ 4 bytes, ≤ buffer length), returning decode errors instead of panicking. For applications unable to upgrade immediately, ensure panic recovery is enabled: do not set DecodeOptions.SkipDecodeRecovery: true, and use DecodingLayerParser with IgnorePanic: false (the default). Avoid calling registered SCTP decoders directly without wrapping them in a recover() handler (GitHub Advisory, GitHub Release, Fix Commit).

The advisory was published by gopacket maintainer mosajjal on September 15, 2026, and credited reporter Reload3d and analyst FoxhoundAI. The maintainers acknowledged this as an incomplete remediation of the previously published CVE-2026-65819 advisory, noting that the v1.7.1 fix explicitly listed SCTP chunk/parameter decoders as "being confirmed" but failed to actually remediate them. The v1.7.2 release was explicitly labeled a security release with a recommendation to upgrade for all users decoding untrusted packets or capture files (GitHub Advisory, GitHub Release).