SZB-10d900b532
gopacket SCTP parsing flaw trusts attacker-controlled lengths (EUVD-2026-114192)
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- gopacket
- Product
- gopacket
- First seen
Summary
The EU Vulnerability Database lists a flaw in the gopacket Go packet-processing library, scored 5.9 (CVSS v3.1). The listing says that before version 1.7.2, the SCTP chunk parser in layers/sctp.go trusts attacker-supplied lengths and counts.
If you use gopacket
Upgrade gopacket to version 1.7.2 or later
Rebuild and redeploy Go services that depend on gopacket
Limit processing of untrusted SCTP traffic until patched
What the sources say 1
· Mastodon: “Prior to 1.7.2, the SCTP chunk chain in layers/sctp.go passes attacker-controlled declared lengths and counts to decodeSCTPInit, decodeSCTPShutdown, decodeSCTPError, decodeSCTPSack, and decodeSCTPP...” Source