CVE-2026-54332
Description
A flaw was found in gopacket, a Go language library for packet processing. An unauthenticated remote attacker could exploit this vulnerability by sending a specially crafted UDP datagram to the sFlow ExtendedGatewayFlow decoder. This could lead to an unbounded memory allocation, potentially consuming up to 16 GiB of memory. The primary consequence is a denial of service, making the affected system unavailable.
Statement
This vulnerability is rated as an Important severity impact because unauthenticated network actors can trigger a denial of service through out-of-memory process crashes without requiring special privileges or user interaction. The flaw specifically affects services and applications utilizing gopacket that parse untrusted sFlow telemetry datagrams, allowing a single malformed packet with oversized field counts to exhaust host memory. Applications that do not decode sFlow extended gateway flow records or those operating solely on verified network interfaces are not susceptible to this exhaustion condition.
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory); DoS: Resource Consumption (Other)
When allocating resources without limits, an attacker could prevent other systems, applications, or processes from accessing the same type of resource. It can be easy for an attacker to consume many resources by rapidly making many requests or causing larger resources to be used than is needed.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
