Is CVE-2026-54345 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-54345 being exploited in the wild.

How severe is CVE-2026-54345?

Medium severity, with a CVSS score of 4, published 28 July 2026.

Which products and versions are affected?

github.com/gopacket/gopacket (Go) <= 1.6.0, SEMVER:introduced=0,fixed=1.6.1; Google Gopacket <= 1.6.0.

Is there a fix for CVE-2026-54345?

Yes. github.com/gopacket/gopacket (Go): upgrade to 1.6.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-54345 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-54345?

Check whether you run github.com/gopacket/gopacket (Go) or Google Gopacket at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54345: gopacket integer underflow and denial of service in Diameter decoder

Q: Is there a fix for CVE-2026-54345?

Yes. github.com/gopacket/gopacket (Go): upgrade to 1.6.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-54345 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-54345?

Check whether you run github.com/gopacket/gopacket (Go) or Google Gopacket at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54345 · Severity: medium · CVSS 4 · Published 2026-07-28

gopacket is a library used by Go applications to process and analyze network traffic. A flaw in how it handles Diameter protocol messages allows a remote attacker to send a specially crafted packet that forces the application to attempt a massive 4GB memory allocation. This can quickly exhaust available system memory, causing the application to crash or be shut down by the operating system, resulting in a denial of service.

Technologies: github.com/gopacket/gopacket (Go). Vendors: Go, Google.

Quick answers

Is CVE-2026-54345 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-54345 being exploited in the wild.
How severe is CVE-2026-54345?: Medium severity, with a CVSS score of 4, published 28 July 2026.
Which products and versions are affected?: github.com/gopacket/gopacket (Go) <= 1.6.0, SEMVER:introduced=0,fixed=1.6.1; Google Gopacket <= 1.6.0.
Is there a fix for CVE-2026-54345?: Yes. github.com/gopacket/gopacket (Go): upgrade to 1.6.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54345 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-54345?: Check whether you run github.com/gopacket/gopacket (Go) or Google Gopacket at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/gopacket/gopacket (Go): upgrade to 1.6.1 or later
```
go get github.com/gopacket/gopacket@v1.6.1
```

Technical details

An integer underflow exists in the `decodeDiameterAVP` function within `layers/diameter_avp_decoders.go`. The decoder calculates the data length of an Attribute-Value Pair (AVP) by subtracting a fixed header size (12 bytes for vendor-flagged AVPs) from an attacker-controlled 24-bit length field. If the provided length is between 8 and 11 bytes, the subtraction underflows a `uint32` value to approximately 4.29 GB. This value is passed directly to `make([]byte, dataLength)`, triggering a massive memory allocation request. While the subsequent data copy may panic due to bounds checks, the allocation request itself is sufficient to trigger Out-Of-Memory (OOM) conditions, especially if multiple malicious packets are processed in succession. The issue is fixed in version 1.6.1 by adding a length validation check after the header size is determined.

Affected products

gopacket gopacket <= 1.6.0

Identifiers

CVE-2026-54345
GHSA-6r28-9ppf-4hj5
GO-2026-6121

Timeline

2026-06-04: patched: Version 1.6.1 released
2026-06-07: advisory: GitHub Security Advisory GHSA-6r28-9ppf-4hj5 published
2026-07-28: disclosed: CVE-2026-54345 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.