VYPR
← All advisories
High severity7.5NVD Advisory· Published Jul 28, 2026· Updated Aug 5, 2026

CVE-2026-54332

CVE-2026-54332

Description

gopacket provides packet processing capabilities for Go. In version 1.6.0 and earlier, the sFlow ExtendedGatewayFlow decoder in layers/sflow.go reads an attacker-controlled 32-bit community count and AS path member count and sizes a slice allocation from those counts without bounding them against the bytes remaining in the datagram, so a 104-byte UDP datagram can drive an allocation of up to 16 GiB and cause an unauthenticated remote denial of service. This issue is fixed in version 1.6.1.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
github.com/gopacket/gopacketGo
< 1.6.11.6.1

Affected products

53

Patches

Vulnerability mechanics

References

4

News mentions

0

No linked articles in our index yet.