Log in Start free

Vulnerability · Published Jul 28, 2026 · Assigned by GitHub_M

CVE-2026-54332GoPacket's sFlow ExtendedGatewayFlow decoder: unbounded attacker-controlled allocation (104-byte UDP datagram -> up to 16 GiB make) -> unauthenticated remote DoS

Medium 6.9

In plain English

A medium-severity resource allocation without limits in gopacket from gopacket. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)6.9Medium
Exploit odds (30 days)0.8%top 43.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

gopacket provides packet processing capabilities for Go. In version 1.6.0 and earlier, the sFlow ExtendedGatewayFlow decoder in layers/sflow.go reads an attacker-controlled 32-bit community count and AS path member count and sizes a slice allocation from those counts without bounding them against the bytes remaining in the datagram, so a 104-byte UDP datagram can drive an allocation of up to 16 GiB and cause an unauthenticated remote denial of service. This issue is fixed in version 1.6.1.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12golang-github-gopacket-gopacketno fix listedDEBIAN-CVE-2026-54332
Debian:13golang-github-gopacket-gopacketno fix listedDEBIAN-CVE-2026-54332
Debian:14golang-github-gopacket-gopacketno fix listedDEBIAN-CVE-2026-54332
Debian:12gopacketno fix listedDEBIAN-CVE-2026-54332
Debian:13gopacketno fix listedDEBIAN-CVE-2026-54332
Debian:14gopacketno fix listedDEBIAN-CVE-2026-54332
Gogithub.com/gopacket/gopacket1.6.1GHSA-g6v3-7xmc-w563
Gogithub.com/gopacket/gopacket1.6.1GO-2026-6122
Ubuntu:24.04:LTSgolang-github-gopacket-gopacketno fix listedUBUNTU-CVE-2026-54332
Ubuntu:26.04:LTSgolang-github-gopacket-gopacketno fix listedUBUNTU-CVE-2026-54332
Ubuntu:26.10golang-github-gopacket-gopacketno fix listedUBUNTU-CVE-2026-54332
Ubuntu:22.04:LTSgopacketno fix listedUBUNTU-CVE-2026-54332
Ubuntu:24.04:LTSgopacketno fix listedUBUNTU-CVE-2026-54332
Ubuntu:26.04:LTSgopacketno fix listedUBUNTU-CVE-2026-54332
Ubuntu:26.10gopacketno fix listedUBUNTU-CVE-2026-54332

Affected products (as reported)

VendorProductVersions
gopacket gopacket < 1.6.1

Weakness: CWE-770 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References