Memory Allocation Vulnerability in Go Packet Processing Tool by gopacket

CVE-2026-54332

What is CVE-2026-54332?

The gopacket library, widely used for packet processing in Go applications, is vulnerable due to a memory allocation flaw in the sFlow ExtendedGatewayFlow decoder. This issue permits attackers to manipulate a 32-bit community count and AS path member count, leading to unbounded slice allocations based on these values. As a result, it is possible for a malicious UDP datagram of just 104 bytes to cause the allocation of excessive memory (up to 16 GiB), potentially resulting in an unauthenticated remote denial of service. This critical issue has been addressed in version 1.6.1 of the gopacket library.

References