CVE-2026-8275: Bettercap Zerogod IPP RCE Vulnerability

CVE-2026-8275 Overview

CVE-2026-8275 is an integer coercion vulnerability in bettercap versions up to 2.41.5. The flaw resides in the ippReadChunkedBody function within modules/zerogod/zerogod_ipp_primitives.go, part of the zerogod Internet Printing Protocol (IPP) Service component. A remote attacker can trigger an out-of-bounds uint64 allocation by sending crafted IPP chunked body data, causing a panic in the affected handler goroutine. The weakness is classified under [CWE-189] (Numeric Errors). A public proof-of-concept exists, and the project has issued a patch in commit 3731d5576cffae9eefe3721cd46a40933304129f.

Critical Impact
Remote attackers can crash the zerogod IPP service handler through a malformed chunked body, resulting in a limited availability impact on the bettercap process.

Affected Products

bettercap up to and including version 2.41.5
Component: zerogod IPP Service (modules/zerogod/zerogod_ipp_primitives.go)
Function: ippReadChunkedBody

Discovery Timeline

2026-05-11 - CVE-2026-8275 published to NVD
2026-05-13 - Last updated in NVD database
Patch commit - 3731d5576cffae9eefe3721cd46a40933304129f merged via Pull Request #1264

Technical Details for CVE-2026-8275

Vulnerability Analysis

The bettercap zerogod module emulates IPP printer services to capture and analyze print traffic. When parsing chunked transfer-encoded IPP request bodies, ippReadChunkedBody reads a hex chunk-size value from the wire and uses it to size a buffer allocation. The code did not bound this size before passing it to make([]byte, size). An attacker on the network can supply a chunk-size header that coerces into an extremely large uint64, triggering an out-of-bounds allocation that panics the handler goroutine. The exploit code is publicly available, but the attack carries high complexity per the assigned CVSS 4.0 vector.

Root Cause

The root cause is missing input validation on the parsed chunk length prior to allocation. No upper bound was enforced on attacker-controlled size values used to construct slices. Additionally, the accepting goroutine in zerogod_acceptor.go lacked a recover() guard, so any panic in the handler propagated and disrupted service.

Attack Vector

An unauthenticated remote attacker reaches the listening zerogod IPP port and submits an HTTP-style request with a Transfer-Encoding: chunked body. The first chunk-size token is set to a value that, when interpreted as uint64, exceeds reasonable bounds. When ippReadChunkedBody attempts the resulting allocation, the Go runtime panics, terminating the handler.

// Patch excerpt from modules/zerogod/zerogod_ipp_primitives.go
// Introduces an upper bound for IPP chunked body allocations
const IPP_CHUNK_MAX_LINE_SIZE = 1024
const IPP_CHUNK_MAX_SIZE = 10 * 1024 * 1024 // 10 MB

Source: GitHub Commit 3731d557

// Patch excerpt from modules/zerogod/zerogod_acceptor.go
// Wraps handler invocation with deferred recover() to contain panics
go func() {
    ctx := &HandlerContext{
        service:       a.service,
        mod:           a.mod,
        client:        conn,
        srvHost:       a.srvHost,
        srvPort:       int(a.port),
        srvTLS:        a.tlsConfig != nil,
        ippAttributes: a.ippAttributes,
        httpPaths:     a.httpPaths,
    }
    defer func() {
        if r := recover(); r != nil {
            a.mod.Error("panic in %s handler for %s: %v", a.service, conn.RemoteAddr(), r)
        }
    }()
    a.handler.Handle(ctx)
}()

Source: GitHub Commit 3731d557

Detection Methods for CVE-2026-8275

Indicators of Compromise

Unexpected panic messages in bettercap logs referencing the zerogod handler or ippReadChunkedBody.
Inbound TCP connections to IPP listener ports carrying chunked request bodies with chunk-size tokens larger than 10 MB.
Repeated short-lived TCP sessions from a single source to the zerogod IPP port that terminate without completing an IPP transaction.

Detection Strategies

Inspect HTTP/IPP traffic to bettercap-hosted printer services for Transfer-Encoding: chunked requests with abnormally large hex chunk-size values.
Alert on Go runtime panic stack traces in bettercap stdout or stderr containing zerogod frames.
Compare deployed bettercap binaries against version 2.41.5 and verify presence of commit 3731d5576cffae9eefe3721cd46a40933304129f.

Monitoring Recommendations

Forward bettercap process logs to a centralized log platform and create alerts for panic and recover events.
Monitor for service restarts or supervisor-managed relaunches of bettercap on engagement systems.
Capture full PCAPs on the zerogod IPP port during active engagements to support post-incident review.

How to Mitigate CVE-2026-8275

Immediate Actions Required

Update bettercap to a build that includes commit 3731d5576cffae9eefe3721cd46a40933304129f from Pull Request #1264.
Restrict network exposure of any host running bettercap with the zerogod module enabled to trusted assessment networks only.
Disable the zerogod IPP service when not actively required for an engagement.

Patch Information

The fix is delivered in commit 3731d5576cffae9eefe3721cd46a40933304129f in the bettercap repository. The patch introduces IPP_CHUNK_MAX_SIZE (10 MB) to bound chunked body allocations in modules/zerogod/zerogod_ipp_primitives.go and adds a recover() block around the handler invocation in modules/zerogod/zerogod_acceptor.go so a single malformed connection cannot crash the listener. See GitHub Issue #1263 for the original report.

Workarounds

Run bettercap on isolated lab networks with no untrusted clients able to reach the zerogod IPP port.
Use host firewall rules to limit which source addresses may connect to the IPP listener.
Avoid loading the zerogod module in scenarios where IPP emulation is not required.

bash

# Build bettercap from source at the patched commit
git clone https://github.com/bettercap/bettercap.git
cd bettercap
git checkout 3731d5576cffae9eefe3721cd46a40933304129f
make build

# Verify the patched constant is present
grep -n 'IPP_CHUNK_MAX_SIZE' modules/zerogod/zerogod_ipp_primitives.go