bettercap EUVD-2026-29035

Remote, unauthenticated attackers can trigger this vulnerability by sending HTTP requests to the zerogod IPP service port (default configuration: typically port 631 or 5353 depending on IPP service setup) with malformed chunked transfer encoding. The specific condition is the presence of a chunk size declaration in the HTTP request header that, when parsed and coerced to an integer, overflows or exceeds reasonable bounds. The attack does NOT require authentication (PR:N per CVSS), does NOT require user interaction (UI:N), but DOES require high attack complexity (AC:H), indicating the attacker must craft the payload carefully or exploit race conditions. The vulnerability only manifests when the zerogod IPP service module is enabled and actively listening for incoming connections. Non-default deployments or installations without the zerogod module enabled are unaffected. Default configurations of bettercap that enable zerogod are vulnerable; however, the service is not universally enabled in all installations.

CVSS 4.0 vector indicates network attack vector (AV:N), high attack complexity (AC:H), no authentication required (PR:N), but only availability impact (VA:L) with no confidentiality or integrity impact despite tags mentioning information disclosure. This creates a notable contradiction: the tag 'Information Disclosure' and description mentioning 'memory access violations that leak data' conflict with CVSS showing VA:L and VC:N/VI:N. The E:P flag (Exploit PoC Published) confirms publicly available code. CVSS score of 2.9 is notably low, and the AC:H (high attack complexity) significantly limits real-world risk despite remote, unauthenticated access. The information disclosure potential requires specific crafting (high complexity) and the impact is limited to availability rather than data breach. This appears to be a low-priority vulnerability suitable for standard patch cycles rather than emergency response, though organizations running zerogod IPP services should monitor for exploitation attempts. The contradiction between tag and vector suggests either the CVSS was conservatively scored or the information disclosure claim is overstated.

An attacker sends a specially crafted HTTP request with chunked transfer encoding to a bettercap instance running the zerogod IPP service, specifying an extremely large chunk size value in the chunk header that causes integer coercion. The ippReadChunkedBody function attempts to allocate or access memory based on this overflowed integer value, triggering an out-of-bounds access. The resulting memory access failure causes service disruption or, in limited cases per the information disclosure tag, information leakage. Public exploit code (poc.py referenced in GitHub issue 1263) is available demonstrating the technique. Attack complexity is high, suggesting the payload requires careful construction or specific timing.