CVE-2026-119299

Name of the Vulnerable Software and Affected Versions gopacket versions prior to 1.7.2

Description The SCTP chunk chain in layers/sctp.go fails to validate attacker-controlled declared lengths and counts before passing them to the functions decodeSCTPInit(), decodeSCTPShutdown(), decodeSCTPError(), decodeSCTPSack(), and decodeSCTPParameter(). This lack of verification ensures that chunks may not contain the required fixed fields, parameter TLVs (Type-Length-Value), gap acknowledgements, or duplicate TSNs (Transmission Sequence Numbers). Consequently, a specially crafted SCTP segment can trigger out-of-bounds or inverted slice panics. This can lead to the termination of applications utilizing gopacket.DecodeOptions.SkipDecodeRecovery, direct registered decoders, or DecodingLayerParser with IgnorePanic enabled. The impact is limited to system availability.

Recommendations Update to version 1.7.2.