CVE-2026-54332 gopacket CVE debrief

Who should care

Users of gopacket version 1.6.0 and earlier should upgrade to version 1.6.1 or later to prevent potential unauthenticated remote denial of service attacks. Operators of systems using gopacket should review their deployments for exposure and assign owners for follow-up. Security teams should track exceptions, retest remediated assets, and close the item only after evidence is documented. Vulnerability management teams should prioritize this issue due to the potential for denial of service attacks. Platform administrators should review and apply patches through normal change control where exposure is confirmed. Monitoring and detection teams should check relevant logs for exposed assets that need extra review. Asset inventory teams should verify that affected assets are identified and tracked. Rollback and change window management teams should plan for and implement changes as needed. Source tracking teams should monitor for suspicious network activity and verify the integrity of affected systems. Compensating controls should be reviewed and implemented for exposed systems while remediation is scheduled and verified. This affects operators, platform administrators, vulnerability management teams, security teams, monitoring and detection teams, asset inventory teams, rollback and change window management teams, and source tracking teams. The defensive priority is Medium due to the potential for unauthenticated remote denial of service attacks. The evidence notes provide additional context on the vulnerability and its potential impact. The recommended actions provide guidance on mitigating the vulnerability and reducing the risk of exploitation. The CVE record and NVD detail provide additional information on the vulnerability and its severity. The official CVE record and NVD detail should be reviewed to validate affected scope, severity, and vendor guidance. Compensating controls should be implemented for exposed systems while remediation is scheduled and verified. Monitoring and detection teams should check relevant logs for exposed assets that need extra review. Asset inventory teams should verify that affected assets are identified and tracked. Rollback and The

Technical summary

The sFlow ExtendedGatewayFlow decoder in layers/sflow.go reads an attacker-controlled 32-bit community count and AS path member count and sizes a slice allocation from those counts without bounding them against the bytes remaining in the datagram. A 104-byte UDP datagram can drive an allocation of up to 16 GiB and cause an unauthenticated remote denial of service. This issue is fixed in version 1.6.1. Affected product deployments should be reviewed for exposure, and compensating controls such as monitoring and detection should be implemented to identify potential attacks.

Defensive priority

Medium priority due to potential for unauthenticated remote denial of service.

Recommended defensive actions

• Upgrade to version 1.6.1 or later
• Review and apply patch from https://github.com/gopacket/gopacket/commit/76119086f5936aacd7088bdf97d565501bb6c4cc
• Monitor for suspicious network activity
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The sFlow ExtendedGatewayFlow decoder in layers/sflow.go reads an attacker-controlled 32-bit community count and AS path member count and sizes a slice allocation from those counts without bounding them against the bytes remaining in the datagram. A 104-byte UDP datagram can drive an allocation of up to 16 GiB and cause an unauthenticated remote denial of service.

Official resources