CVE-2026-54332

CVE-2026-54332 is an unauthenticated remote denial-of-service flaw in gopacket, a Go packet-processing library: the sFlow ExtendedGatewayFlow decoder in layers/sflow.go reads attacker-controlled 32-bit community-count and AS-path member-count fields and sizes slice allocations from them without bounding the values against the bytes actually present in the datagram (CWE-770). A single crafted sFlow UDP datagram as small as 104 bytes can trigger an allocation of up to 16 GiB, exhausting memory on the receiving process. An attacker who can send UDP datagrams to a service that decodes sFlow with gopacket gains unauthenticated remote denial of service; CVSS 4.0 scores the impact as availability-only. Any Go application built with gopacket 1.6.0 or earlier that parses untrusted sFlow traffic — typically network flow collectors, telemetry agents, and monitoring services — is affected. Exploitation has not been observed in the wild (not in CISA KEV, EPSS 0.5% over 30 days), but a public advisory/PoC reference (GHSA-g6v3-7xmc-w563) exists, so prompt patching is prudent.

What to do: Upgrade to gopacket v1.6.1 and rebuild and redeploy any Go services that parse sFlow datagrams. As an interim mitigation, restrict or rate-limit inbound sFlow UDP traffic (typically UDP 6343) to trusted exporter addresses, since no authentication is required to trigger the oversized allocations. Audit Go module dependencies for gopacket versions 1.6.0 or earlier to identify affected builds.