# CVE-2026-54345: gopacket integer underflow and denial of service in Diameter decoder

Source: https://junglewise.ai/threats/cve-2026-54345-gopacket-integer-underflow-and-denial-of-service-in-diameter  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-28. Updated: 2026-07-28  
License: CC BY 4.0 with a link back

CVE-2026-54345 · Severity: medium · CVSS 4 · Published 2026-07-28

gopacket is a library used by Go applications to process and analyze network traffic. A flaw in how it handles Diameter protocol messages allows a remote attacker to send a specially crafted packet that forces the application to attempt a massive 4GB memory allocation. This can quickly exhaust available system memory, causing the application to crash or be shut down by the operating system, resulting in a denial of service.

Technologies: [github.com/gopacket/gopacket (Go)](https://junglewise.ai/threats/technologies/github-com-gopacket-gopacket). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Google](https://junglewise.ai/threats/vendors/google).

## Quick answers

**Is CVE-2026-54345 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54345 being exploited in the wild.

**How severe is CVE-2026-54345?** Medium severity, with a CVSS score of 4, published 28 July 2026.

**Which products and versions are affected?** github.com/gopacket/gopacket (Go) <= 1.6.0, SEMVER:introduced=0,fixed=1.6.1; Google Gopacket <= 1.6.0.

**Is there a fix for CVE-2026-54345?** Yes. github.com/gopacket/gopacket (Go): upgrade to 1.6.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-54345 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-54345?** Check whether you run github.com/gopacket/gopacket (Go) or Google Gopacket at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/gopacket/gopacket (Go): upgrade to 1.6.1 or later

  ```sh
  go get github.com/gopacket/gopacket@v1.6.1
  ```


## Technical details

An integer underflow exists in the `decodeDiameterAVP` function within `layers/diameter_avp_decoders.go`. The decoder calculates the data length of an Attribute-Value Pair (AVP) by subtracting a fixed header size (12 bytes for vendor-flagged AVPs) from an attacker-controlled 24-bit length field. If the provided length is between 8 and 11 bytes, the subtraction underflows a `uint32` value to approximately 4.29 GB. This value is passed directly to `make([]byte, dataLength)`, triggering a massive memory allocation request. While the subsequent data copy may panic due to bounds checks, the allocation request itself is sufficient to trigger Out-Of-Memory (OOM) conditions, especially if multiple malicious packets are processed in succession. The issue is fixed in version 1.6.1 by adding a length validation check after the header size is determined.

## Affected products

- gopacket gopacket <= 1.6.0

## Identifiers

- CVE-2026-54345
- GHSA-6r28-9ppf-4hj5
- GO-2026-6121

## Timeline

- 2026-06-04: patched: Version 1.6.1 released
- 2026-06-07: advisory: GitHub Security Advisory GHSA-6r28-9ppf-4hj5 published
- 2026-07-28: disclosed: CVE-2026-54345 published to NVD

## References

- [https://github.com/gopacket/gopacket/commit/145859d0eaee1a6f5925ffb93851c976449c3311](https://github.com/gopacket/gopacket/commit/145859d0eaee1a6f5925ffb93851c976449c3311)
- [https://github.com/gopacket/gopacket/releases/tag/v1.6.1](https://github.com/gopacket/gopacket/releases/tag/v1.6.1)
- [https://github.com/gopacket/gopacket/security/advisories/GHSA-6r28-9ppf-4hj5](https://github.com/gopacket/gopacket/security/advisories/GHSA-6r28-9ppf-4hj5)

## Related threats

- [gopacket SCTP chunk decoder out-of-bounds panic](https://junglewise.ai/threats/cve-2026-119299-gopacket-provides-packet-processing-capabilities-for-go-prior-to)
- [gopacket denial of service in sFlow ExtendedGatewayFlow decoder](https://junglewise.ai/threats/cve-2026-54332-gopacket-denial-of-service-in-sflow-extendedgatewayflow-decoder)