Is CVE-2026-54332 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-54332 being exploited in the wild.

How severe is CVE-2026-54332?

Medium severity, with a CVSS score of 4, published 28 July 2026.

Which products and versions are affected?

github.com/gopacket/gopacket (Go) <= 1.6.0, SEMVER:introduced=0,fixed=1.6.1; Google Gopacket <= 1.6.0.

Is there a fix for CVE-2026-54332?

Yes. github.com/gopacket/gopacket (Go): upgrade to 1.6.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-54332 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-54332?

Check whether you run github.com/gopacket/gopacket (Go) or Google Gopacket at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54332: gopacket denial of service in sFlow ExtendedGatewayFlow decoder

Q: Is there a fix for CVE-2026-54332?

Yes. github.com/gopacket/gopacket (Go): upgrade to 1.6.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-54332 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-54332?

Check whether you run github.com/gopacket/gopacket (Go) or Google Gopacket at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54332 · Severity: medium · CVSS 4 · Published 2026-07-28

gopacket is a Go library used for processing and analyzing network traffic. A vulnerability in its sFlow protocol decoder allows a remote, unauthenticated attacker to crash any application using the library by sending a specially crafted, small network packet. This results in a denial of service by forcing the application to exhaust all available system memory, potentially impacting network monitoring and security operations.

Technologies: github.com/gopacket/gopacket (Go). Vendors: Go, Google.

Quick answers

Is CVE-2026-54332 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-54332 being exploited in the wild.
How severe is CVE-2026-54332?: Medium severity, with a CVSS score of 4, published 28 July 2026.
Which products and versions are affected?: github.com/gopacket/gopacket (Go) <= 1.6.0, SEMVER:introduced=0,fixed=1.6.1; Google Gopacket <= 1.6.0.
Is there a fix for CVE-2026-54332?: Yes. github.com/gopacket/gopacket (Go): upgrade to 1.6.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54332 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-54332?: Check whether you run github.com/gopacket/gopacket (Go) or Google Gopacket at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/gopacket/gopacket (Go): upgrade to 1.6.1 or later
```
go get github.com/gopacket/gopacket@v1.6.1
```

Technical details

The sFlow ExtendedGatewayFlow decoder in `layers/sflow.go` (specifically `decodeExtendedGatewayFlowRecord` and `decodePath`) reads 32-bit 'community count' and 'AS path member count' fields directly from the network wire. These values are used to initialize slices via `make()` without being validated against the actual remaining length of the packet datagram. Consequently, a single 104-byte UDP datagram can specify a count that triggers an allocation of up to 16 GiB of memory. This leads to an Out-of-Memory (OOM) condition and process termination. The vulnerability is reachable via any application using `gopacket.NewPacket` or `SFlowDatagram.DecodeFromBytes` on untrusted sFlow traffic. The issue is fixed in version 1.6.1.

Affected products

gopacket gopacket <= 1.6.0

Identifiers

CVE-2026-54332
GHSA-g6v3-7xmc-w563
GO-2026-6122

Timeline

2026-06-04: patched: Version 1.6.1 released
2026-06-07: advisory: GitHub Security Advisory published
2026-07-28: disclosed: CVE-2026-54332 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.