CVE-2026-54345

Name of the Vulnerable Software and Affected Versions gopacket versions prior to 1.6.1

Description The Diameter AVP decoder in the decodeDiameterAVP() function contains an integer underflow. When the Vendor flag is set, the decoder uses a 12-byte header size but only validates that the avp.Length variable is not smaller than 8. If an attacker provides a avp.Length between 8 and 11, the subtraction of the header size results in a uint32 underflow, leading to an unbounded memory allocation of approximately 4 GiB. This can be exploited by sending a small number of malicious Diameter messages to cause memory exhaustion and trigger an OOM-kill of the process, resulting in an unauthenticated remote denial of service. This affects services parsing Diameter protocol traffic, such as packet collectors, signaling monitors, and IDS tooling.

Recommendations Update to version 1.6.1. As a temporary workaround, restrict access to the Diameter decoding module to trusted sources to minimize the risk of exploitation.