CVE-2026-54332

GoPacket's sFlow ExtendedGatewayFlow decoder: unbounded attacker-controlled allocation (104-byte UDP datagram -> up to 16 GiB make) -> unauthenticated remote DoS

Unauthenticated remote denial of service via memory exhaustion. A single 104-byte datagram drives an allocation of up to 16 GiB, OOM-killing the parsing process. There is no memory corruption and no code execution, the impact is process termination / resource exhaustion. Severity assessed as Medium (unauthenticated remote DoS, no memory-safety violation).

The application allocates resources such as memory, threads, or file descriptors based on untrusted input without enforcing a cap. Typical impact: resource exhaustion leading to denial of service.

Kodem intelligence

Already deployed Kodem?

Before each make([]uint32, n), validate n against the number of bytes actually remaining in the datagram. Each element consumes 4 bytes on the wire, so a correct upper bound is remaining_bytes / 4; any count larger than that cannot be backed by real packet data and should be rejected with a decode error (matching the existing errors.New / fmt.Errorf error style in this file), rather than pre-allocating. This caps the allocation at roughly the datagram size and eliminates the amplification:

• decodeExtendedGatewayFlowRecord: reject when communitiesLength > uint32(len(*data)/4) before make([]uint32, communitiesLength).
• decodePath: reject when ad.Count > uint32(len(*data)/4) before make([]uint32, ad.Count), and propagate the error to the caller.

I will follow up with a fix PR via the advisory's private fork.

1. What is CVE-2026-54332? CVE-2026-54332 is a medium-severity allocation of resources without limits or throttling vulnerability in github.com/gopacket/gopacket (go), affecting versions <= 1.6.0. It is fixed in 1.6.1. The application allocates resources such as memory, threads, or file descriptors based on untrusted input without enforcing a cap.
2. Which versions of github.com/gopacket/gopacket are affected by CVE-2026-54332? github.com/gopacket/gopacket (go) versions <= 1.6.0 is affected.
3. Is there a fix for CVE-2026-54332? Yes. CVE-2026-54332 is fixed in 1.6.1. Upgrade to this version or later.
4. Is CVE-2026-54332 exploitable, and should I be worried? Whether CVE-2026-54332 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
5. What actually determines whether CVE-2026-54332 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
6. How do I fix CVE-2026-54332? Upgrade github.com/gopacket/gopacket to 1.6.1 or later.

Other vulnerabilities in github.com/gopacket/gopacket