PT-2026-65536 · Gopacket · Gopacket

CVE-2026-54345 · Published 2026-07-28 · Updated 2026-07-28

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions gopacket versions prior to 1.6.1

Description The Diameter AVP decoder in the decodeDiameterAVP() function contains an integer underflow. When the Vendor flag is set, the decoder uses a 12-byte header size but only validates that the avp.Length variable is not smaller than 8. If an attacker provides a avp.Length between 8 and 11, the subtraction of the header size results in a uint32 underflow, leading to an unbounded memory allocation of approximately 4 GiB. This can be exploited by sending a small number of malicious Diameter messages to cause memory exhaustion and trigger an OOM-kill of the process, resulting in an unauthenticated remote denial of service. This affects services parsing Diameter protocol traffic, such as packet collectors, signaling monitors, and IDS tooling.

Recommendations Update to version 1.6.1. As a temporary workaround, restrict access to the Diameter decoding module to trusted sources to minimize the risk of exploitation.

Exploit

Fix

Allocation of Resources Without Limits

Integer Underflow

Weakness Enumeration

CWE-770

CWE-191

Related Identifiers

CVE-2026-54345

GHSA-6R28-9PPF-4HJ5

Affected Products

Gopacket

References · 6

• 🔥 https://github.com/gopacket/gopacket/security/advisories/GHSA-6r28-9ppf-4hj5 · Exploit
• https://osv.dev/vulnerability/GHSA-6r28-9ppf-4hj5 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-54345 · Security Note
• https://github.com/gopacket/gopacket/commit/145859d0eaee1a6f5925ffb93851c976449c3311 · Note
• https://github.com/gopacket/gopacket/releases/tag/v1.6.1 · Note
• https://github.com/gopacket/gopacket · Note