CVE-2026-54345

HighCVSS 7.5/10Last modified Aug 5, 2026

Description

gopacket provides packet processing capabilities for Go. In version 1.6.0 and earlier, the Diameter AVP decoder computes an AVP data length by subtracting a fixed header size from an attacker-controlled AVP Length field, so a vendor-flagged AVP whose Length is smaller than the 12-byte header underflows the unsigned 32-bit value and drives an unbounded allocation of roughly 4 GiB, and two such messages in succession OOM-kill a collector, causing an unauthenticated remote denial of service. This issue is fixed in version 1.6.1.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-191 CWE-770

Affected software

Vendor	Product	Versions
gopacket	gopacket	< 1.6.1

References

https://github.com/gopacket/gopacket/commit/145859d0eaee1a6f5925ffb93851c976449c3311Patch
https://github.com/gopacket/gopacket/releases/tag/v1.6.1Release Notes
https://github.com/gopacket/gopacket/security/advisories/GHSA-6r28-9ppf-4hj5Exploit, Third Party Advisory
https://github.com/gopacket/gopacket/security/advisories/GHSA-6r28-9ppf-4hj5Exploit, Third Party Advisory

Timeline

Published: Jul 28, 2026
Last modified: Aug 5, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-543478.7Froxlor is open source server administration software. Prior to 2.3.8, DNS TXT record content accepted by lib/Froxlor/Api/Commands/DomainZon CVE-2026-543487.2Froxlor is open source server administration software. Prior to 2.3.8, the Admins.add and Admins.update endpoints in lib/Froxlor/Api/Command CVE-2026-543499.8Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.CVE-2026-54357.3The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.2 and newer fail to enforce the caller-supplie CVE-2026-543509.8Budibase is an open-source low-code platform. Prior to 3.39.12, an unauthenticated visitor of any published Budibase app reads every docume CVE-2026-543519.6Budibase is an open-source low-code platform. Prior to 3.39.9, the webhook trigger endpoint in Budibase is publicly accessible and passes th CVE-2026-543529.6Budibase is an open-source low-code platform. Prior to 3.39.9, `POST /api/pwa/process-zip` at packages/server/src/api/routes/static.ts:24 ac CVE-2026-543537.1Budibase is an open-source low-code platform. Prior to 3.39.9, authenticated users with automation permissions can bypass Budibase's SSRF bl CVE-2026-543548.2MapServer is a system for developing web-based GIS applications. Prior to 8.6.4, MapServer's PostGIS runtime filter translation in src/mappo CVE-2026-543555.3MapServer is a system for developing web-based GIS applications. From 6.0 until 8.6.4, MapServer's OpenLayers HTML output for SERVICE=WMS&RE CVE-2026-543567.1Budibase is an open-source low-code platform. Prior to 3.41.3, POST /api/attachments/:datasourceId/url in packages/server/src/api/routes/sta CVE-2026-543575.1An improper authorization vulnerability in MISP allowed an authenticated organization administrator to access or modify user settings belong