MEDIUM GitHub
CVE-2026-54345
GoPacket's Diameter AVP decoder: uint32 underflow on vendor header size leads to unbounded ~4 GiB allocation (unauthenticated remote DoS)
## Summary
The Diameter AVP decoder in `github.com/gopacket/gopacket` computes `dataLength := avp.Length - uint32(headerSize)` without first ensuring `avp.Length >= headerSize`. When the Vendor flag is set, `headerSize` is 12, but the only length guard upstream rejects `avp.Length < 8`. An AVP with the Vendor flag set and a 24-bit Length field of 8, 9, 10, or 11 therefore underflows the `uint32` subtraction to ~4,294,967,292, which is passed straight to `make([]byte, dataLength)`. A single 32-b
Affected Products
- go/github.com/gopacket/gopacket <= 1.6.0
References
- https://github.com/advisories/GHSA-6r28-9ppf-4hj5
- https://github.com/gopacket/gopacket/security/advisories/GHSA-6r28-9ppf-4hj5
- https://github.com/gopacket/gopacket/commit/145859d0eaee1a6f5925ffb93851c976449c3311
- https://github.com/gopacket/gopacket/releases/tag/v1.6.1
This medium severity vulnerability was published on 2026-07-28 via GitHub. Affected: go/github.com/gopacket/gopacket <= 1.6.0.
vulnfeed aggregates 9166 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.