CVE catalog

CVE-2026-54332

gopacket provides packet processing capabilities for Go. In version 1.6.0 and earlier, the sFlow ExtendedGatewayFlow decoder in layers/sflow.go reads an attacker-controlled 32-bit community count and

[CVE catalog]

Severity
Medium · CVSS 6.9
Published
Source
[NVD] · [CVE record]
EPSS
0.79% · Oct 25, 2026

gopacket provides packet processing capabilities for Go. In version 1.6.0 and earlier, the sFlow ExtendedGatewayFlow decoder in layers/sflow.go reads an attacker-controlled 32-bit community count and AS path member count and sizes a slice allocation from those counts without bounding them against the bytes remaining in the datagram, so a 104-byte UDP datagram can drive an allocation of up to 16 GiB and cause an unauthenticated remote denial of service. This issue is fixed in version 1.6.1.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiangopacketsid1.1.19-6.2vulnerable
Debiangopacketforky1.1.19-6.2vulnerable
Debiangopackettrixie1.1.19-6.2vulnerable
Debiangopacketbookworm1.1.19-3vulnerable
Debiangolang-github-gopacket-gopacketsid1.3.0-2vulnerable
Debiangolang-github-gopacket-gopacketforky1.3.0-2vulnerable
Debiangolang-github-gopacket-gopackettrixie1.3.0-2vulnerable
Debiangolang-github-gopacket-gopacketbookworm1.0.0-1vulnerable
Gogithub.com/gopacket/gopacketNot reported1.6.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiangopacketsourcesid(unfixed)not yet assignedNot reported[1143055]
Debiangopacketsourceforky(unfixed)not yet assignedNot reported[1143055]
Debiangopacketsourcetrixie(unfixed)not yet assignedNot reported[1143055]
Debiangopacketsourcebookworm(unfixed)not yet assignedNot reported[1143055]
Debiangolang-github-gopacket-gopacketsourcesid(unfixed)not yet assignedNot reported[1143056]
Debiangolang-github-gopacket-gopacketsourceforky(unfixed)not yet assignedNot reported[1143056]
Debiangolang-github-gopacket-gopacketsourcetrixie(unfixed)not yet assignedNot reported[1143056]
Debiangolang-github-gopacket-gopacketsourcebookworm(unfixed)not yet assignedNot reported[1143056]
Gogithub.com/gopacket/gopacketgoNot reported1.6.1Not reportedNot reportedNot reported

[Debian bug #1143055][Debian bug #1143056]

Notes

[trixie] gopacket: Minor issue [bookworm] gopacket: minor issue; DoS; limited go language support [trixie] golang-github-gopacket-gopacket: Minor issue [bookworm] golang-github-gopacket-gopacket: minor issue; DoS; limited go language support

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [golang-github-google-gopacket-dev]Affected

    Source package: [gopacket]

    Details (2)

    • 1.1.19-3 · all · bookworm

      Affected

      nvd · gopacket · debian · bookworm; nvd · gopacket · debian · 12

    • 1.1.19-3 · all · bookworm

      Affected

      nvd · gopacket · debian · bookworm; nvd · gopacket · debian · 12

  • [golang-github-gopacket-gopacket-dev]Affected

    Source package: [golang-github-gopacket-gopacket]

    Details (2)

    • 1.0.0-1 · all · bookworm

      Affected

      nvd · golang-github-gopacket-gopacket · debian · bookworm; nvd · golang-github-gopacket-gopacket · debian · 12

    • 1.0.0-1 · all · bookworm

      Affected

      nvd · golang-github-gopacket-gopacket · debian · bookworm; nvd · golang-github-gopacket-gopacket · debian · 12

[Debian 13 (Trixie)]

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [GitHub Advisory Database] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database]