VYPR
← All advisories
Low severity3.7NVD Advisory· Published May 11, 2026· Updated May 13, 2026

CVE-2026-8276

CVE-2026-8276

Description

A flaw has been found in bettercap up to 2.41.5. Affected by this issue is some unknown functionality of the file modules/mysql_server/mysql_server.go of the component MySQL Server. Executing a manipulation can lead to integer coercion error. The attack can be launched remotely. The attack requires a high level of complexity. The exploitation is known to be difficult. The exploit has been published and may be used. This patch is called 0eaa375c5e5446bfba94a290eff92967a5deac9e. It is advisable to implement a patch to correct this issue.

Affected products

1

Patches

1
0eaa375c5e54

Merge pull request #1266 from bettercap/copilot/fix-mysql-server-crash

https://github.com/bettercap/bettercapSimone MargaritelliApr 18, 2026via ghsa
commit
1 file changed · +7 −2
  • modules/mysql_server/mysql_server.go+7 −2 modified
    @@ -121,15 +121,20 @@ func (mod *MySQLServer) Start() error {
 				if _, err := conn.Write(packets.MySQLGreeting); err != nil {
 					mod.Warning("error while writing server greeting: %s", err)
 					continue
-				} else if _, err = reader.Read(readBuffer); err != nil {
+				} else if read, err = reader.Read(readBuffer); err != nil {
 					mod.Warning("error while reading client message: %s", err)
 					continue
 				}
 
+				if read < 37 {
+					mod.Warning("client handshake too short (%d bytes)", read)
+					continue
+				}
+
 				// parse client capabilities and validate connection
 				// TODO: parse mysql connections properly and
 				//       display additional connection attributes
-				capabilities := fmt.Sprintf("%08b", (int(uint32(readBuffer[4]) | uint32(readBuffer[5])<<8)))
+				capabilities := fmt.Sprintf("%016b", (int(uint32(readBuffer[4]) | uint32(readBuffer[5])<<8)))
 				loadData := string(capabilities[8])
 				username := string(bytes.Split(readBuffer[36:], []byte{0})[0])

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

10

News mentions

0

No linked articles in our index yet.