CVE catalog
CVE-2026-54345
gopacket provides packet processing capabilities for Go. In version 1.6.0 and earlier, the Diameter AVP decoder computes an AVP data length by subtracting a fixed header size from an attacker-controll
- Severity
- Medium · CVSS 6.9
- Source
- [NVD] · [CVE record]
- EPSS
- 0.79% · Oct 25, 2026
gopacket provides packet processing capabilities for Go. In version 1.6.0 and earlier, the Diameter AVP decoder computes an AVP data length by subtracting a fixed header size from an attacker-controlled AVP Length field, so a vendor-flagged AVP whose Length is smaller than the 12-byte header underflows the unsigned 32-bit value and drives an unbounded allocation of roughly 4 GiB, and two such messages in succession OOM-kill a collector, causing an unauthenticated remote denial of service. This issue is fixed in version 1.6.1.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | gopacket | sid | 1.1.19-6.2 | not affected |
| Debian | gopacket | forky | 1.1.19-6.2 | not affected |
| Debian | gopacket | trixie | 1.1.19-6.2 | not affected |
| Debian | gopacket | bookworm | 1.1.19-3 | not affected |
| Debian | golang-github-gopacket-gopacket | sid | 1.3.0-2 | not affected |
| Debian | golang-github-gopacket-gopacket | forky | 1.3.0-2 | not affected |
| Debian | golang-github-gopacket-gopacket | trixie | 1.3.0-2 | not affected |
| Debian | golang-github-gopacket-gopacket | bookworm | 1.0.0-1 | not affected |
| Go | github.com/gopacket/gopacket | Not reported | 1.6.1 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | gopacket | source | sid | Not affected | unimportant | Not reported | Not reported |
| Debian | gopacket | source | forky | Not affected | unimportant | Not reported | Not reported |
| Debian | gopacket | source | trixie | Not affected | unimportant | Not reported | Not reported |
| Debian | gopacket | source | bookworm | Not affected | unimportant | Not reported | Not reported |
| Debian | golang-github-gopacket-gopacket | source | sid | Not affected | unimportant | Not reported | Not reported |
| Debian | golang-github-gopacket-gopacket | source | forky | Not affected | unimportant | Not reported | Not reported |
| Debian | golang-github-gopacket-gopacket | source | trixie | Not affected | unimportant | Not reported | Not reported |
| Debian | golang-github-gopacket-gopacket | source | bookworm | Not affected | unimportant | Not reported | Not reported |
| Go | github.com/gopacket/gopacket | go | Not reported | 1.6.1 | Not reported | Not reported | Not reported |
OpenFactory catalog packages
Matching against OpenFactory catalog package versions is in progress.