UBUNTU-CVE-2026-125402: High severity ubuntu/ettercap vulnerability

Published Nov 10, 2026

Updated

Ettercap through 0.8.4.1 contains a heap out-of-bounds read vulnerability in sslwgetclienthellosni() in src/ecsslwrap.c that trusts the unchecked 16-bit SNI length field. Network-adjacent attackers can send crafted TLS ClientHello messages during SSL interception to leak up to 64 KB of heap memory upstream or crash Ettercap.

Affected Software

7 affected components

ubuntu/ettercap*

Event History

Nov 10, 2026

CVE Published

via OSV·12:00 AM

Data Sourced

via OSV·12:00 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are exposed?

Ettercap deployments performing SSL interception are exposed, because exploitation occurs when processing crafted TLS ClientHello messages during interception. Systems not using this SSL interception path are not identified as affected by the provided data.

What does an attacker need to exploit this issue?

A network-adjacent attacker can exploit the issue without privileges or user interaction by sending a crafted TLS ClientHello message to the SSL interception component.

What is the likely impact of successful exploitation?

An attacker may leak up to 64 KB of heap memory upstream or crash Ettercap. The supplied severity vector indicates high confidentiality and availability impact, with no integrity impact.

How can I determine whether my environment is affected?

Check whether Ettercap is deployed at version 0.8.4.1 or earlier and is configured to perform SSL interception. Review whether it processes TLS ClientHello traffic from network-adjacent clients.

UBUNTU-CVE-2026-125402: High severity ubuntu/ettercap vulnerability

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this issue?

What is the likely impact of successful exploitation?

How can I determine whether my environment is affected?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this issue?

What is the likely impact of successful exploitation?

How can I determine whether my environment is affected?