# CVE-2026-54332: gopacket denial of service in sFlow ExtendedGatewayFlow decoder

Source: https://junglewise.ai/threats/cve-2026-54332-gopacket-denial-of-service-in-sflow-extendedgatewayflow-decoder  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-28. Updated: 2026-07-28  
License: CC BY 4.0 with a link back

CVE-2026-54332 · Severity: medium · CVSS 4 · Published 2026-07-28

gopacket is a Go library used for processing and analyzing network traffic. A vulnerability in its sFlow protocol decoder allows a remote, unauthenticated attacker to crash any application using the library by sending a specially crafted, small network packet. This results in a denial of service by forcing the application to exhaust all available system memory, potentially impacting network monitoring and security operations.

Technologies: [github.com/gopacket/gopacket (Go)](https://junglewise.ai/threats/technologies/github-com-gopacket-gopacket). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Google](https://junglewise.ai/threats/vendors/google).

## Quick answers

**Is CVE-2026-54332 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54332 being exploited in the wild.

**How severe is CVE-2026-54332?** Medium severity, with a CVSS score of 4, published 28 July 2026.

**Which products and versions are affected?** github.com/gopacket/gopacket (Go) <= 1.6.0, SEMVER:introduced=0,fixed=1.6.1; Google Gopacket <= 1.6.0.

**Is there a fix for CVE-2026-54332?** Yes. github.com/gopacket/gopacket (Go): upgrade to 1.6.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-54332 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-54332?** Check whether you run github.com/gopacket/gopacket (Go) or Google Gopacket at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/gopacket/gopacket (Go): upgrade to 1.6.1 or later

  ```sh
  go get github.com/gopacket/gopacket@v1.6.1
  ```


## Technical details

The sFlow ExtendedGatewayFlow decoder in `layers/sflow.go` (specifically `decodeExtendedGatewayFlowRecord` and `decodePath`) reads 32-bit 'community count' and 'AS path member count' fields directly from the network wire. These values are used to initialize slices via `make()` without being validated against the actual remaining length of the packet datagram. Consequently, a single 104-byte UDP datagram can specify a count that triggers an allocation of up to 16 GiB of memory. This leads to an Out-of-Memory (OOM) condition and process termination. The vulnerability is reachable via any application using `gopacket.NewPacket` or `SFlowDatagram.DecodeFromBytes` on untrusted sFlow traffic. The issue is fixed in version 1.6.1.

## Affected products

- gopacket gopacket <= 1.6.0

## Identifiers

- CVE-2026-54332
- GHSA-g6v3-7xmc-w563
- GO-2026-6122

## Timeline

- 2026-06-04: patched: Version 1.6.1 released
- 2026-06-07: advisory: GitHub Security Advisory published
- 2026-07-28: disclosed: CVE-2026-54332 published to NVD

## References

- [https://github.com/gopacket/gopacket/commit/76119086f5936aacd7088bdf97d565501bb6c4cc](https://github.com/gopacket/gopacket/commit/76119086f5936aacd7088bdf97d565501bb6c4cc)
- [https://github.com/gopacket/gopacket/releases/tag/v1.6.1](https://github.com/gopacket/gopacket/releases/tag/v1.6.1)
- [https://github.com/gopacket/gopacket/security/advisories/GHSA-g6v3-7xmc-w563](https://github.com/gopacket/gopacket/security/advisories/GHSA-g6v3-7xmc-w563)

## Related threats

- [gopacket SCTP chunk decoder out-of-bounds panic](https://junglewise.ai/threats/cve-2026-119299-gopacket-provides-packet-processing-capabilities-for-go-prior-to)
- [gopacket integer underflow and denial of service in Diameter decoder](https://junglewise.ai/threats/cve-2026-54345-gopacket-integer-underflow-and-denial-of-service-in-diameter)