PT-2026-65535 · Gopacket · Gopacket

CVE-2026-54332 · Published 2026-07-28 · Updated 2026-07-28

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions gopacket versions prior to 1.6.1

Description The sFlow ExtendedGatewayFlow record decoder in layers/sflow.go contains a flaw where it reads attacker-controlled 32-bit community count and AS path member count values to size slice allocations without validating them against the remaining bytes in the datagram. An unauthenticated remote attacker can send a small UDP datagram (e.g., 104 bytes) that triggers a memory allocation of up to 16 GiB, leading to memory exhaustion and a denial of service (DoS) that crashes the parsing process. This occurs within the decodeExtendedGatewayFlowRecord() and decodePath() functions when processing the communitiesLength and ad.Count variables.

Recommendations Update to version 1.6.1. As a temporary mitigation, restrict network access to the sFlow collector to trusted sources to minimize the risk of receiving malicious UDP datagrams.

Exploit

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2026-54332

GHSA-G6V3-7XMC-W563

Affected Products

Gopacket

References · 6

• 🔥 https://github.com/gopacket/gopacket/security/advisories/GHSA-g6v3-7xmc-w563 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-54332 · Security Note
• https://osv.dev/vulnerability/GHSA-g6v3-7xmc-w563 · Vendor Advisory
• https://github.com/gopacket/gopacket/commit/76119086f5936aacd7088bdf97d565501bb6c4cc · Note
• https://github.com/gopacket/gopacket/releases/tag/v1.6.1 · Note
• https://github.com/gopacket/gopacket · Note