VYPR
← All advisories
High severity7.5NVD Advisory· Published Jul 28, 2026· Updated Aug 5, 2026

CVE-2026-54345

CVE-2026-54345

Description

gopacket provides packet processing capabilities for Go. In version 1.6.0 and earlier, the Diameter AVP decoder computes an AVP data length by subtracting a fixed header size from an attacker-controlled AVP Length field, so a vendor-flagged AVP whose Length is smaller than the 12-byte header underflows the unsigned 32-bit value and drives an unbounded allocation of roughly 4 GiB, and two such messages in succession OOM-kill a collector, causing an unauthenticated remote denial of service. This issue is fixed in version 1.6.1.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
github.com/gopacket/gopacketGo
< 1.6.11.6.1

Affected products

53

Patches

Vulnerability mechanics

References

4

News mentions

0

No linked articles in our index yet.