Vulnerability Description
gopacket provides packet processing capabilities for Go. In version 1.6.0 and earlier, the sFlow ExtendedGatewayFlow decoder in layers/sflow.go reads an attacker-controlled 32-bit community count and AS path member count and sizes a slice allocation from those counts without bounding them against the bytes remaining in the datagram, so a 104-byte UDP datagram can drive an allocation of up to 16 GiB and cause an unauthenticated remote denial of service. This issue is fixed in version 1.6.1.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Gopacket | Gopacket | < 1.6.1 |
Related Weaknesses (CWE)
References
- https://github.com/gopacket/gopacket/commit/76119086f5936aacd7088bdf97d565501bb6Patch
- https://github.com/gopacket/gopacket/releases/tag/v1.6.1Release Notes
- https://github.com/gopacket/gopacket/security/advisories/GHSA-g6v3-7xmc-w563ExploitThird Party Advisory
- https://github.com/gopacket/gopacket/security/advisories/GHSA-g6v3-7xmc-w563ExploitThird Party Advisory
FAQ
What is CVE-2026-54332?
CVE-2026-54332 is a vulnerability with a CVSS score of 7.5 (HIGH). gopacket provides packet processing capabilities for Go. In version 1.6.0 and earlier, the sFlow ExtendedGatewayFlow decoder in layers/sflow.go reads an attacker-controlled 32-bit community count and ...
How severe is CVE-2026-54332?
CVE-2026-54332 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-54332?
Check the references section above for vendor advisories and patch information. Affected products include: Gopacket Gopacket.