gopacket vulnerabilities
3 known CVE vulnerabilities in gopacket, translated and rated.
- CVE-2026-65819High
gopacket provides packet processing capabilities for Go. Through version 1.7.0, multiple layer decoders use attacker-controlled lengths, counts, or offsets before validating them against packet buffers, allowing a crafted packet decoded through DecodingLayerParser or DecodeFromBytes to trigger an unrecovered panic and remotely deny service. A patch commit is available at 210f25f.
- CVE-2026-54345High
The gopacket library for Go version 1.6.0 and earlier has a vulnerability in the Diameter AVP decoder. An attacker can control the Length field in an AVP, causing an unsigned 32-bit underflow and allocation of about 4 GiB memory. Two such messages can cause OOM and denial of service.
- CVE-2026-54332High
The gopacket library for Go version 1.6.0 and earlier has a vulnerability in the sFlow ExtendedGatewayFlow decoder. An attacker controls 32-bit community and AS path member counts, leading to allocation of up to 16 GiB memory from a 104-byte UDP datagram, causing denial of service.