CVE-2026-54332 Details
Description
gopacket provides packet processing capabilities for Go. In version 1.6.0 and earlier, the sFlow ExtendedGatewayFlow decoder in layers/sflow.go reads an attacker-controlled 32-bit community count and AS path member count and sizes a slice allocation from those counts without bounding them against the bytes remaining in the datagram, so a 104-byte UDP datagram can drive an allocation of up to 16 GiB and cause an unauthenticated remote denial of service. This issue is fixed in version 1.6.1.
A denial-of-service vulnerability has been identified in the Gopacket library, specifically in versions through 1.6.0. The issue arises in the SFlow ExtendedGatewayFlow decoder, where the allocation of slices is based on attacker-controlled 32-bit fields, without proper validation against the actual size of the remaining data in the UDP datagram. This flaw allows a small datagram to trigger allocations of up to 16 GiB, leading to memory exhaustion and process termination. The vulnerability is unauthenticated and can be exploited remotely.
Users can upgrade to Gopacket version 1.6.1 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/gopacket/gopacket/security/advisories/GHSA-g6v3-7xmc-w563 | CISA-ADP | ExploitThird Party Advisory |
| https://github.com/gopacket/gopacket/commit/76119086f5936aacd7088bdf97d565501bb6c4cc | [email protected] | Patch |
| https://github.com/gopacket/gopacket/releases/tag/v1.6.1 | [email protected] | Release Notes |
| https://github.com/gopacket/gopacket/security/advisories/GHSA-g6v3-7xmc-w563 | [email protected] | ExploitThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-770 | Allocation of Resources Without Limits or Throttling | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| gopacket gopacket | < 1.6.1 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 5, 2026 | Initial Analysis | [email protected] |
| Jul 28, 2026 | CVE Modified | CISA-ADP |
| Jul 28, 2026 | New CVE Received | [email protected] |