Description

SCTP protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-09-29T10:17:15.010Z",
  "pubdate": "2026-09-29T10:17:15.010Z",
  "executiveSummary": "A vulnerability exists in the SCTP protocol dissector, resulting in a denial-of-service condition due to application instability.\nThe issue affects versions 4.6.0 through 4.6.8 and 4.4.0 through 4.4.18 of the affected product.\nThe vulnerability type is a dissector-level crash, which can be triggered by a remote attacker providing malformed or specifically crafted SCTP packets.\nSuccessful exploitation leads to the termination of the affected process, effectively disrupting services that rely on the dissector for traffic analysis or protocol processing.\nThe vulnerability is primarily network-exposed, as the dissector processes incoming data streams from the wire.\nThis poses a significant risk to availability, as an attacker with network access can repeatedly trigger the crash to maintain a persistent denial-of-service state.\nNo specific authentication or high-level privileges are typically required to initiate the trigger sequence if the dissector is positioned to inspect incoming traffic.",
  "technicalDetails": "The root cause of this vulnerability lies in the SCTP dissector logic, specifically in how the protocol parser handles malformed or out-of-specification SCTP chunks. When the dissector encounters unexpected input fields or inconsistent header values during the parsing phase, it fails to perform adequate bounds checking or error handling, leading to an unhandled exception or illegal memory access.\nThe vulnerable component is the SCTP protocol dissection engine responsible for interpreting and decoding SCTP packets. Because the dissector is often a core component for traffic analysis and protocol state tracking, a fatal error in this module propagates to the main execution thread, causing the entire process to crash.\nThe attack flow initiates when an attacker transmits a crafted SCTP packet designed to violate the expected state machine or structural integrity of the SCTP protocol. As the dissector logic iterates through the packet structures, the flawed parsing routine attempts to access invalid memory or performs an illegal operation based on the malicious payload values.\nExploitation does not require prior authentication. As long as the target system is actively processing SCTP traffic, the attacker can transmit the malicious payload directly to the interface monitored by the dissector. The process crashes immediately upon the dissector's failure to handle the malformed packet, resulting in an immediate cessation of protocol dissection services.\nAffected versions include 4.6.0 through 4.6.8 and 4.4.0 through 4.4.18. The vulnerability is characterized as a denial of service because the crash typically results in the total termination of the service instance rather than a recoverable error state. There is no evidence of remote code execution; however, the impact to service availability is total for the duration of the process downtime. In production environments where the dissector is integrated into network security appliances or traffic analysis tools, this vulnerability enables an attacker to bypass inspection or cause widespread network visibility gaps by forcing the security software to cycle through failure states."
}