CVE-2026-54332

Name of the Vulnerable Software and Affected Versions gopacket versions prior to 1.6.1

Description The sFlow ExtendedGatewayFlow record decoder in layers/sflow.go contains a flaw where it reads attacker-controlled 32-bit community count and AS path member count values to size slice allocations without validating them against the remaining bytes in the datagram. An unauthenticated remote attacker can send a small UDP datagram (e.g., 104 bytes) that triggers a memory allocation of up to 16 GiB, leading to memory exhaustion and a denial of service (DoS) that crashes the parsing process. This occurs within the decodeExtendedGatewayFlowRecord() and decodePath() functions when processing the communitiesLength and ad.Count variables.

Recommendations Update to version 1.6.1. As a temporary mitigation, restrict network access to the sFlow collector to trusted sources to minimize the risk of receiving malicious UDP datagrams.