Executive brief
Bettercap is a popular network security tool used for monitoring and testing network traffic. A vulnerability in its built-in MySQL server module allows a remote attacker to crash the entire application by sending a specially crafted network packet. This results in a denial-of-service, stopping all active network monitoring or security testing tasks until the tool is manually restarted.
Technical details
An integer coercion error (CWE-192) exists in `modules/mysql_server/mysql_server.go` within bettercap. The vulnerability occurs during the processing of a MySQL client handshake response. Specifically, the code uses `fmt.Sprintf("%08b", ...)` to format capability flags into a binary string and then attempts to access the character at index 8. If the high byte of the capability flags is 0x00, the resulting string length is exactly 8, causing an 'index out of range' panic. Because the connection handler lacks a recovery mechanism, this panic terminates the entire bettercap process. This can be triggered by an unauthenticated remote attacker with a single ~50-byte packet. The issue is fixed in version 2.41.7.
Affected products
- bettercap bettercap < 2.41.7
Timeline
- 2026-04-18: disclosed: Issue reported on GitHub by user dapickle
- 2026-05-11: advisory: CVE-2026-8276 published
- 2026-05-11: patched: Version 2.41.7 released with fix commit 0eaa375