Executive brief
Bettercap, a popular network security tool, is vulnerable to a remote denial-of-service attack. An attacker can send a specially crafted network request that causes the software to crash. This disrupts security testing operations and requires a manual restart of the service.
Technical details
An integer coercion error (CWE-192) exists in the ippReadChunkedBody function within modules/zerogod/zerogod_ipp_primitives.go. The vulnerability is triggered when the IPP service attempts to allocate memory for a chunked body using an unvalidated uint64 value provided in a remote request. By sending a maliciously large chunk size (e.g., 0xFFFFFFFFFFFFFFFF), an attacker can trigger a 'makeslice: len out of range' panic in Go, crashing the entire bettercap process. The fix, introduced in version 2.41.7, implements a 10MB maximum chunk size validation and adds panic recovery to the TCP acceptor goroutine.
Affected products
- bettercap bettercap < 2.41.7
Timeline
- 2026-04-18: patched: Fix merged into master branch via pull request 1264
- 2026-05-11: advisory: GHSA and NVD advisory published