DEBIAN-CVE-2026-125405: High severity debian/ettercap vulnerability
Published Nov 10, 2026
·Updated
Ettercap through 0.8.4.1 contains an out-of-bounds read vulnerability in ParseNTLMAuth() in src/dissectors/echttp.c due to unvalidated NTLM message offsets. Attackers can send a crafted HTTP Authorization header observed by Ettercap to read beyond the buffer, disclosing memory or crashing the process.
Affected Software
2 affected components
debian/ettercap*
debian/ettercap*
Event History
Nov 10, 2026
CVE Published
via OSV·12:17 AM
Data Sourced
via OSV·12:17 AM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
Which deployments are exposed?
Deployments using Ettercap through version 0.8.4.1 are affected when they observe HTTP traffic containing NTLM Authorization headers.
2
What does an attacker need to provide to trigger the issue?
An attacker needs to send a crafted HTTP Authorization header with NTLM message offsets that are not valid, and that traffic must be observed by Ettercap.
3
What is the potential impact?
Successful exploitation can cause Ettercap to read beyond the intended buffer, potentially disclosing process memory or crashing the process.