gopacket CVE-2026-119299

Exploitation requires that the victim application process SCTP traffic (IP protocol 132) through gopacket AND run with panic recovery disabled - specifically gopacket.DecodeOptions.SkipDecodeRecovery=true, DecodingLayerParser with IgnorePanic=true, or direct use of registered SCTP decoders without recovery - on an affected version (<= 1.7.1, including master 18c5805). Under these conditions a single crafted SCTP segment (as small as a 54-byte Ethernet→IPv4→SCTP frame with an 8-byte INIT chunk) panics and crashes the process with no authentication or user interaction. The key LIMITING factor is configuration: gopacket's two default entry points - gopacket.NewPacket with default options and DecodingLayerParser.DecodeLayers with IgnorePanic=false - install per-packet recovery and convert the same input into a harmless per-packet decode error, so default deployments do not crash. The complete fix is upgrading to v1.7.2 (go get github.com/gopacket/gopacket@v1.7.2); the advisory's only pre-patch workaround is to keep panic recovery enabled.

This is a medium-severity, availability-only denial-of-service issue (CWE-125 out-of-bounds read / CWE-129 improper validation of array index) in the gopacket SCTP chunk sub-decoders, and the real-world risk is strongly gated by victim configuration rather than by attacker capability. The input CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H = 5.9) aligns with the advisory: a single crafted SCTP segment (IP protocol 132) crashes the process, but ONLY for consumers that disable gopacket's built-in panic recovery (DecodeOptions.SkipDecodeRecovery=true, DecodingLayerParser with IgnorePanic=true, or direct registered decoders); the default recovery-enabled APIs convert the panic into a per-packet decode error and do NOT crash. The AC:H therefore reflects a non-default deployment condition outside the attacker's control, not a race or timing trigger. Signals are consistent but modest: not listed in CISA KEV (no confirmed active exploitation), no EPSS score was supplied in the input, and the vuln.today priority label is 'this_month' (not act_now/emergency). The GHSA advisory publishes concrete crafted-byte reproductions and regression tests. No formal SSVC decision record was provided beyond the 'this_month' label. Net: this is a legitimate remote DoS for the specific high-throughput packet-analysis deployments that set SkipDecodeRecovery (the advisory notes those were scored ~7.5), but a low-urgency, no-crash decode error for everyone on the default APIs - a genuine but configuration-dependent priority, not a drop-everything emergency.

An attacker sends a single crafted SCTP segment (a 54-byte Ethernet→IPv4→SCTP frame with, e.g., an 8-byte INIT chunk suffices) to a network-monitoring, IDS, or packet-analysis service built on gopacket that runs with panic recovery disabled. A sub-decoder (decodeSCTPInit, decodeSCTPSack, decodeSCTPShutdown, decodeSCTPError, or decodeSCTPParameter) reads fixed fields, parameter TLVs, or count-driven loops past the chunk's real length, triggering an out-of-bounds or inverted-slice panic that terminates the process. The GHSA advisory includes exact crafted byte sequences and regression tests, so a public PoC reference exists, though it is not packaged as a standalone weaponized exploit.