CVE-2026-54345

Katalog CVE

CVSS 7.5 · High EPSS 0,79%

Kerentanan Integer Underflow (Wrap or Wraparound) pada gopacket. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

gopacket provides packet processing capabilities for Go. In version 1.6.0 and earlier, the Diameter AVP decoder computes an AVP data length by subtracting a fixed header size from an attacker-controlled AVP Length field, so a vendor-flagged AVP whose Length is smaller than the 12-byte header underflows the unsigned 32-bit value and drives an unbounded allocation of roughly 4 GiB, and two such messages in succession OOM-kill a collector, causing an unauthenticated remote denial of service. This issue is fixed in version 1.6.1.

Rincian

Terbit di NVD

28 Juli 2026

Terakhir diubah

5 Agustus 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-191: Integer Underflow (Wrap or Wraparound)
CWE-770: Allocation of Resources Without Limits or Throttling

EPSS (30 hari)

0,79% peluang dieksploitasi; lebih tinggi dari 55,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/gopacket/gopacket/commit/145859d0eaee1a6f5925ffb93851c976449c3311 patch
• https://github.com/gopacket/gopacket/security/advisories/GHSA-6r28-9ppf-4hj5 exploit · advisory pihak ketiga
• https://github.com/gopacket/gopacket/releases/tag/v1.6.1 release notes