CVE-2026-54345

gopacket, a widely used Go packet-processing library, miscomputes the data length of Diameter Attribute-Value Pairs (AVPs): it subtracts the fixed 12-byte AVP header size from the attacker-controlled Length field without validation, so a vendor-flagged AVP whose Length is smaller than the header causes an unsigned 32-bit underflow that drives an unbounded allocation of roughly 4 GiB. An attacker who can send crafted Diameter messages to a service using the affected decoder needs no authentication or user interaction, and two such messages in succession exhaust memory and OOM-kill the collector, yielding unauthenticated remote denial of service. Affected users are operators of Go applications built with gopacket 1.6.0 or earlier that parse Diameter traffic, such as telecom/AAA network collectors; gopacket usage that never decodes Diameter is not exposed. The flaw is fixed in version 1.6.1, and exploitation has not been observed in the wild: EPSS is 0.5% (42nd percentile), it is not in CISA KEV, and a public PoC exists via the GHSA-6r28-9ppf-4hj5 advisory.

What to do: Upgrade gopacket to version 1.6.1 or later, and use govulncheck or go.mod inspection to confirm no remaining dependencies pull in versions at or below 1.6.0. For services that must parse untrusted Diameter traffic (typically TCP/SCTP port 3868), restrict and rate-limit access to those endpoints and set process/container memory limits to contain OOM impact until the patched library is deployed.