CVE-2026-54332CWE-770denial-of-service

CVE-2026-54332

High · published July 28, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
55.8
In the wild
Unconfirmed
What it is

gopacket provides packet processing capabilities for Go. In version 1.6.0 and earlier, the sFlow ExtendedGatewayFlow decoder in layers/sflow.go reads an attacker-controlled 32-bit community count and AS path member count and sizes a slice allocation from those counts without bounding them against the bytes remaining in the datagram, so a 104-byte UDP datagram can drive an allocation of up to 16 GiB and cause an unauthenticated remote denial of service. This issue is fixed in version 1.6.1.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00790 · 55.8th percentile
Weakness
CWE-770 · Allocation of Resources Without Limits or Throttling
Published
2026-07-28T21:16Z
Affected products (1)
ProductVersionsFixed in
gopacket/gopacket< 1.6.11.6.1
References (4)
https://github.com/gopacket/gopacket/commit/76119086f5936aacd7088bdf97d565501bb6c4cc · [email protected]https://github.com/gopacket/gopacket/releases/tag/v1.6.1 · [email protected]https://github.com/gopacket/gopacket/security/advisories/GHSA-g6v3-7xmc-w563 · [email protected]https://github.com/gopacket/gopacket/security/advisories/GHSA-g6v3-7xmc-w563 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 28 JUL 16:17Z
    GoPacket's sFlow ExtendedGatewayFlow decoder: unbounded attacker-controlled allocation (104-byte UDP datagram -> up to 16 GiB make) -> unauthenticated remote DoS
    cvelistv5