Executive brief
gopacket is a library used by Go applications to process and analyze network traffic. A flaw in how it handles Diameter protocol messages allows a remote attacker to send a specially crafted packet that forces the application to attempt a massive 4GB memory allocation. This can quickly exhaust available system memory, causing the application to crash or be shut down by the operating system, resulting in a denial of service.
Technical details
An integer underflow exists in the `decodeDiameterAVP` function within `layers/diameter_avp_decoders.go`. The decoder calculates the data length of an Attribute-Value Pair (AVP) by subtracting a fixed header size (12 bytes for vendor-flagged AVPs) from an attacker-controlled 24-bit length field. If the provided length is between 8 and 11 bytes, the subtraction underflows a `uint32` value to approximately 4.29 GB. This value is passed directly to `make([]byte, dataLength)`, triggering a massive memory allocation request. While the subsequent data copy may panic due to bounds checks, the allocation request itself is sufficient to trigger Out-Of-Memory (OOM) conditions, especially if multiple malicious packets are processed in succession. The issue is fixed in version 1.6.1 by adding a length validation check after the header size is determined.
Affected products
- gopacket gopacket <= 1.6.0
Timeline
- 2026-06-04: patched: Version 1.6.1 released
- 2026-06-07: advisory: GitHub Security Advisory GHSA-6r28-9ppf-4hj5 published
- 2026-07-28: disclosed: CVE-2026-54345 published to NVD