MEDIUM GitHub
CVE-2026-54332
GoPacket's sFlow ExtendedGatewayFlow decoder: unbounded attacker-controlled allocation (104-byte UDP datagram -> up to 16 GiB make) -> unauthenticated remote Do
## Summary
The sFlow `ExtendedGatewayFlow` record decoder in `github.com/gopacket/gopacket` allocates a slice with `make([]uint32, n)` where `n` is an attacker-controlled 32-bit wire field that has no upper bound. Because the allocation happens *before* the read loop that would consume the corresponding bytes, a single small UDP datagram can force a multi-gigabyte allocation. A 104-byte sFlow datagram can request up to 16 GiB and OOM-kill any service that parses sFlow with gopacket. This is an
Affected Products
- go/github.com/gopacket/gopacket <= 1.6.0
References
- https://github.com/advisories/GHSA-g6v3-7xmc-w563
- https://github.com/gopacket/gopacket/security/advisories/GHSA-g6v3-7xmc-w563
- https://github.com/gopacket/gopacket/commit/76119086f5936aacd7088bdf97d565501bb6c4cc
- https://github.com/gopacket/gopacket/releases/tag/v1.6.1
This medium severity vulnerability was published on 2026-07-28 via GitHub. Affected: go/github.com/gopacket/gopacket <= 1.6.0.
vulnfeed aggregates 9166 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.