Executive Summary

CVE-2026-8275 is a vulnerability in bettercap versions up to 2.41.5 affecting the ippReadChunkedBody function in the zerogod IPP Service component. The flaw arises when the function processes a maliciously crafted chunked HTTP request with an extremely large chunk size, causing an integer coercion error that leads to an out-of-bounds memory allocation.

Specifically, the vulnerability is triggered by sending a chunk size value of 0xFFFFFFFFFFFFFFFF (the maximum uint64 value). This value is parsed and converted improperly, resulting in an invalid slice length allocation that causes a panic and crashes the entire bettercap process.

The attack can be initiated remotely without authentication by sending a single crafted request to the IPP TCP port. The exploit causes a denial-of-service (DoS) condition by crashing the application.

The patch to fix this vulnerability introduces a maximum chunk size validation (10 MB) to reject oversized chunks before allocation and adds a recover() mechanism to handle panics gracefully, preventing the entire process from crashing.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing a remote attacker to cause a denial-of-service (DoS) on the bettercap application. By sending a specially crafted chunked HTTP request with an extremely large chunk size, the attacker can crash the bettercap process.

The crash occurs because the application attempts to allocate an invalid amount of memory, leading to a panic that is not recovered within the affected goroutine. This results in the entire bettercap service becoming unavailable.

Since the attack requires no authentication and can be executed remotely with a single request, it poses a significant risk to availability of services relying on bettercap's IPP functionality.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring network traffic for suspicious chunked HTTP requests sent to the bettercap IPP TCP port (default 63100) that contain unusually large chunk sizes, especially the maximum uint64 value (0xFFFFFFFFFFFFFFFF).

A practical detection method involves capturing and analyzing network packets targeting port 63100 for HTTP/1.1 requests with headers "Expect: 100-continue" and "Transfer-Encoding: chunked" followed by an abnormally large chunk size.

Example commands to detect such activity include:

• Using tcpdump to capture suspicious packets: tcpdump -i <interface> port 63100 -A | grep -E 'Expect: 100-continue|Transfer-Encoding: chunked|0xFFFFFFFFFFFFFFFF'
• Using Wireshark to filter traffic on port 63100 and inspect chunked HTTP requests for oversized chunk sizes.
• Monitoring bettercap process logs for crashes or panics related to the ippReadChunkedBody function, which may indicate exploitation attempts.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation step is to apply the official patch that fixes the vulnerability by adding a maximum chunk size validation (10 MB) and a recover() mechanism to handle panics gracefully.

If patching immediately is not possible, consider restricting or blocking incoming traffic to the bettercap IPP TCP port (default 63100) from untrusted or unauthenticated sources to prevent exploitation.

Additionally, monitor the bettercap service for unexpected crashes or denial-of-service symptoms and restart the service if necessary.

Long-term mitigation involves updating bettercap to a version that includes the patch identified by commit 3731d5576cffae9eefe3721cd46a40933304129f.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify any direct impact of CVE-2026-8275 on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0