Is CVE-2026-119299 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-119299 being exploited in the wild.

How severe is CVE-2026-119299?

Medium severity, with a CVSS score of 5.9, published 30 October 2026.

Which products and versions are affected?

github.com/gopacket/gopacket (Go) <= 1.7.1, SEMVER:introduced=0,fixed=1.7.2; Gopacket prior to 1.7.2.

How is CVE-2026-119299 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-119299?

Check whether you run github.com/gopacket/gopacket (Go) or Gopacket at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-119299: gopacket SCTP chunk decoder out-of-bounds panic

Q: Is there a fix for CVE-2026-119299?

Yes. github.com/gopacket/gopacket (Go): upgrade to 1.7.2 or later. Until then: Disable SCTP packet decoding if untrusted packets or capture files are processed, or ensure applications use default recovery-enabled decode APIs rather than enabling SkipDecodeRecovery or IgnorePanic options. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-119299 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-119299?

Check whether you run github.com/gopacket/gopacket (Go) or Gopacket at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-119299 · Severity: medium · CVSS 5.9 · Published 2026-10-30

gopacket is a Go library for packet processing and network analysis. A flaw in its SCTP (Stream Control Transmission Protocol) decoder allows an attacker to craft malicious network packets that crash applications using the library, causing service outages. Applications with specific decode error handling configurations are at highest risk of termination.

Technologies: github.com/gopacket/gopacket (Go). Vendors: Go.

Quick answers

Is CVE-2026-119299 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-119299 being exploited in the wild.
How severe is CVE-2026-119299?: Medium severity, with a CVSS score of 5.9, published 30 October 2026.
Which products and versions are affected?: github.com/gopacket/gopacket (Go) <= 1.7.1, SEMVER:introduced=0,fixed=1.7.2; Gopacket prior to 1.7.2.
Is there a fix for CVE-2026-119299?: Yes. github.com/gopacket/gopacket (Go): upgrade to 1.7.2 or later. Until then: Disable SCTP packet decoding if untrusted packets or capture files are processed, or ensure applications use default recovery-enabled decode APIs rather than enabling SkipDecodeRecovery or IgnorePanic options. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-119299 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-119299?: Check whether you run github.com/gopacket/gopacket (Go) or Gopacket at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/gopacket/gopacket (Go): upgrade to 1.7.2 or later
```
go get github.com/gopacket/gopacket@v1.7.2
```

Disable SCTP packet decoding if untrusted packets or capture files are processed, or ensure applications use default recovery-enabled decode APIs rather than enabling SkipDecodeRecovery or IgnorePanic options.

Technical details

The SCTP sub-decoders in layers/sctp.go fail to validate that chunks contain the fixed fields required by functions such as decodeSCTPInit, decodeSCTPShutdown, decodeSCTPError, decodeSCTPSack, and decodeSCTPParameter before reading from them. A crafted SCTP segment with attacker-controlled declared lengths and counts causes out-of-bounds or inverted slice panics. The vulnerability only affects availability; applications using default recovery-enabled APIs convert panics to decode errors, while those with SkipDecodeRecovery or IgnorePanic enabled will crash.

Affected products

gopacket gopacket prior to 1.7.2

Identifiers

CVE-2026-119299
GHSA-358w-w75h-x6rx

Timeline

2026-10-30: disclosed
2026-09-15: patched: version 1.7.2 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.