Vulnerability Details CVE-2026-54332
gopacket provides packet processing capabilities for Go. In version 1.6.0 and earlier, the sFlow ExtendedGatewayFlow decoder in layers/sflow.go reads an attacker-controlled 32-bit community count and AS path member count and sizes a slice allocation from those counts without bounding them against the bytes remaining in the datagram, so a 104-byte UDP datagram can drive an allocation of up to 16 GiB and cause an unauthenticated remote denial of service. This issue is fixed in version 1.6.1.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.004
EPSS Ranking 29.4%
CVSS Severity
CVSS v3 Score 7.5
References
Products affected by CVE-2026-54332
-
cpe:2.3:a:gopacket:gopacket:0.1.0
-
cpe:2.3:a:gopacket:gopacket:1.0.0
-
cpe:2.3:a:gopacket:gopacket:1.1.1
-
cpe:2.3:a:gopacket:gopacket:1.2.0
-
cpe:2.3:a:gopacket:gopacket:1.3.0
-
cpe:2.3:a:gopacket:gopacket:1.3.1
-
cpe:2.3:a:gopacket:gopacket:1.4.0
-
cpe:2.3:a:gopacket:gopacket:1.5.0
-
cpe:2.3:a:gopacket:gopacket:1.6.0