Executive brief
gopacket is a Go library used for processing and analyzing network traffic. A vulnerability in its sFlow protocol decoder allows a remote, unauthenticated attacker to crash any application using the library by sending a specially crafted, small network packet. This results in a denial of service by forcing the application to exhaust all available system memory, potentially impacting network monitoring and security operations.
Technical details
The sFlow ExtendedGatewayFlow decoder in `layers/sflow.go` (specifically `decodeExtendedGatewayFlowRecord` and `decodePath`) reads 32-bit 'community count' and 'AS path member count' fields directly from the network wire. These values are used to initialize slices via `make()` without being validated against the actual remaining length of the packet datagram. Consequently, a single 104-byte UDP datagram can specify a count that triggers an allocation of up to 16 GiB of memory. This leads to an Out-of-Memory (OOM) condition and process termination. The vulnerability is reachable via any application using `gopacket.NewPacket` or `SFlowDatagram.DecodeFromBytes` on untrusted sFlow traffic. The issue is fixed in version 1.6.1.
Affected products
- gopacket gopacket <= 1.6.0
Timeline
- 2026-06-04: patched: Version 1.6.1 released
- 2026-06-07: advisory: GitHub Security Advisory published
- 2026-07-28: disclosed: CVE-2026-54332 published to NVD