CVE-2026-54332

Katalog CVE

CVSS 7.5 · High EPSS 0,79%

Kerentanan Allocation of Resources Without Limits or Throttling pada gopacket. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

gopacket provides packet processing capabilities for Go. In version 1.6.0 and earlier, the sFlow ExtendedGatewayFlow decoder in layers/sflow.go reads an attacker-controlled 32-bit community count and AS path member count and sizes a slice allocation from those counts without bounding them against the bytes remaining in the datagram, so a 104-byte UDP datagram can drive an allocation of up to 16 GiB and cause an unauthenticated remote denial of service. This issue is fixed in version 1.6.1.

Rincian

Terbit di NVD

28 Juli 2026

Terakhir diubah

5 Agustus 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-770: Allocation of Resources Without Limits or Throttling

EPSS (30 hari)

0,79% peluang dieksploitasi; lebih tinggi dari 55,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/gopacket/gopacket/commit/76119086f5936aacd7088bdf97d565501bb6c4cc patch
• https://github.com/gopacket/gopacket/security/advisories/GHSA-g6v3-7xmc-w563 exploit · advisory pihak ketiga
• https://github.com/gopacket/gopacket/releases/tag/v1.6.1 release notes