---
id: CVE-2026-119299
title: 'gopacket: SCTP chunk sub-decoder out-of-bounds panics on crafted segments'
summary: >-
  gopacket provides packet processing capabilities for Go. Prior to 1.7.2, the
  SCTP chunk chain in layers/sctp.go passes attacker-controlled declared lengths
  and counts to decodeSCTPInit, decodeSCTPShutdown, decodeSCTPError,
  decodeSCTPSack…
severity: medium
cvss: 5.9
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'
cvssSource: cna
cwe:
  - CWE-125
  - CWE-129
vendor: gopacket
product: gopacket
affected:
  - gopacket < 1.7.2
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-30T16:53:41.650451Z'
exploitAvailable: true
published: '2026-10-30'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T16:54:01.623Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-119299'
references:
  - url: >-
      https://github.com/gopacket/gopacket/security/advisories/GHSA-358w-w75h-x6rx
    label: >-
      https://github.com/gopacket/gopacket/security/advisories/GHSA-358w-w75h-x6rx
  - url: >-
      https://github.com/gopacket/gopacket/commit/508044327cc2c065b3db753c010a027e7d1ca621
    label: >-
      https://github.com/gopacket/gopacket/commit/508044327cc2c065b3db753c010a027e7d1ca621
  - url: 'https://github.com/gopacket/gopacket/releases/tag/v1.7.2'
    label: 'https://github.com/gopacket/gopacket/releases/tag/v1.7.2'
tags:
  - cve.org
  - exploit-available
epss: 0.0047
epssPercentile: 0.40928
ingestedAt: '2026-11-05T16:24:31.097Z'
---

## Overview

gopacket provides packet processing capabilities for Go. Prior to 1.7.2, the SCTP chunk chain in layers/sctp.go passes attacker-controlled declared lengths and counts to decodeSCTPInit, decodeSCTPShutdown, decodeSCTPError, decodeSCTPSack, and decodeSCTPParameter without checking that each chunk contains the fixed fields, parameter TLVs, gap acknowledgements, or duplicate TSNs those sub-decoders read. A crafted SCTP segment can therefore cause out-of-bounds or inverted slice panics; the panic can terminate applications that use gopacket.DecodeOptions.SkipDecodeRecovery, direct registered decoders, or DecodingLayerParser with IgnorePanic enabled, while the default recovery-enabled APIs convert it to a per-packet decode error. This is the SCTP sub-decoder residual named but not remediated by CVE-2026-65819, whose version 1.7.1 changes bounded the generic dispatcher but left these per-type reads and loops unchecked. The impact is availability only, with no data disclosure, modification, or allocation amplification. This issue is fixed in version 1.7.2.

## Affected

- `gopacket < 1.7.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.