CVE-2026-54345
Received Received - Intake

Memory Allocation Denial of Service in gopacket

Publication date: 2026-07-28

Last updated on: 2026-07-28

Assigner: GitHub, Inc.

Description
gopacket provides packet processing capabilities for Go. In version 1.6.0 and earlier, the Diameter AVP decoder computes an AVP data length by subtracting a fixed header size from an attacker-controlled AVP Length field, so a vendor-flagged AVP whose Length is smaller than the 12-byte header underflows the unsigned 32-bit value and drives an unbounded allocation of roughly 4 GiB, and two such messages in succession OOM-kill a collector, causing an unauthenticated remote denial of service. This issue is fixed in version 1.6.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-28
Last Modified
2026-07-28
Generated
2026-07-28
AI Q&A
2026-07-28
EPSS Evaluated
N/A
NVD
CVE-2026-54345
EUVD
EUVD-2026-49893

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
google gopacket to 1.6.1 (exc)
google gopacket 1.6.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-191 The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-54345 is a vulnerability in the gopacket library's Diameter AVP decoder affecting versions 1.6.0 and earlier. It allows an unauthenticated remote denial of service via memory exhaustion. The issue occurs when a vendor-flagged AVP has a Length field smaller than the 12-byte header, causing an integer underflow that results in a ~4 GiB allocation. This exhausts system memory and crashes the application.

Detection Guidance

Monitor for Diameter protocol traffic and inspect AVP Length fields for values between 8 and 11 bytes. Use packet capture tools like tcpdump or Wireshark to analyze network traffic for malformed Diameter messages. Check application logs for memory exhaustion errors or OOM-kill events in services using gopacket <= 1.6.0.

Impact Analysis

This vulnerability can cause unauthenticated remote denial of service by exhausting system memory. A single malicious 32-byte Diameter message can trigger a ~4 GiB allocation, and multiple messages can OOM-kill the process. It affects services parsing Diameter messages like packet collectors, signaling monitors, or IDS tools, especially in memory-constrained environments.

Compliance Impact

This vulnerability primarily causes resource exhaustion leading to denial of service, which may impact availability requirements in compliance standards like GDPR (Article 32) and HIPAA (Security Rule §164.312(a)(1)). However, the CVE does not directly affect data confidentiality or integrity, so core compliance obligations for protecting personal or health data remain unchanged.

Mitigation Strategies

Upgrade gopacket to version 1.6.1 or later. If immediate upgrade is not possible, implement network-level filtering to block malformed Diameter messages with AVP Lengths between 8 and 11 bytes. Disable or restrict Diameter protocol parsing in affected services if not required.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-54345. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart