CVE-2026-54332: gopacket sFlow Decoder DoS Vulnerability

CVE-2026-54332 Overview

CVE-2026-54332 affects gopacket, a widely used Go library for packet processing. The sFlow ExtendedGatewayFlow decoder in layers/sflow.go reads an attacker-controlled 32-bit community count and AS path member count. It then sizes a slice allocation from those counts without bounding them against the bytes remaining in the datagram. A single 104-byte UDP datagram can drive an allocation of up to 16 GiB. This unauthenticated remote condition triggers a denial of service in any process that decodes untrusted sFlow traffic. The issue affects versions 1.6.0 and earlier and is fixed in version 1.6.1.

Critical Impact
An unauthenticated remote attacker can exhaust memory on any service consuming untrusted sFlow packets through gopacket, causing process termination or host-wide resource starvation.

Affected Products

gopacket versions 1.6.0 and earlier
Go applications importing github.com/gopacket/gopacket/layers for sFlow decoding
Network telemetry collectors, flow analyzers, and observability agents built on gopacket

Discovery Timeline

2026-07-28 - CVE-2026-54332 published to NVD
2026-07-28 - Last updated in NVD database
v1.6.1 - Fix released via GitHub Release v1.6.1

Technical Details for CVE-2026-54332

Vulnerability Analysis

The defect is an unbounded memory allocation classified as [CWE-770]. The decodeExtendedGatewayFlowRecord path in layers/sflow.go parses sFlow datagrams that describe BGP-style gateway information. Two attacker-controlled 32-bit fields, the community count and the AS path member count, are read directly from the wire. Each value is passed to make([]uint32, count) without validation against the number of bytes actually remaining in the buffer.

Because a 32-bit count can request up to roughly four billion uint32 entries, the Go runtime attempts to allocate up to 16 GiB per malformed record. The datagram itself can be as small as 104 bytes, giving attackers an amplification factor of more than 150 million to one. Multiple concurrent packets amplify the impact further.

Root Cause

The decoder trusts length prefixes without cross-checking them against the remaining datagram length. Go's make will allocate the requested capacity even when the input cannot possibly contain that many elements, so a bounds check is required before allocation.

Attack Vector

sFlow is delivered over UDP, typically on port 6343. An attacker who can reach the collector address sends a crafted datagram containing an inflated AS path count. No authentication is required. The process either aborts with an out-of-memory error or degrades the host until the operating system kills it.

// Patch excerpt from layers/sflow.go
func (ad *SFlowASDestination) decodePath(data *[]byte) error {
    *data, ad.Type = (*data)[4:], SFlowASPathType(binary.BigEndian.Uint32((*data)[:4]))
    *data, ad.Count = (*data)[4:], binary.BigEndian.Uint32((*data)[:4])
    // ad.Count is an attacker-controlled 32-bit field and each member that
    // follows is 4 bytes on the wire. Reject any count that cannot be backed
    // by the bytes actually remaining, otherwise make([]uint32, ad.Count) lets
    // a tiny datagram drive an arbitrarily large allocation (CWE-770).
    if ad.Count > uint32(len(*data)/4) {
        return fmt.Errorf("SFlow AS path member count %d exceeds remaining buffer", ad.Count)
    }
    ad.Members = make([]uint32, ad.Count)
    for i := uint32(0); i < ad.Count; i++ {
        var member uint32
        *data, member = (*data)[4:], binary.BigEndian.Uint32((*data)[:4])
        ad.Members[i] = member
    }
    return nil
}

Source: GitHub Commit 7611908

Detection Methods for CVE-2026-54332

Indicators of Compromise

Sudden process termination of collectors or agents linked against gopacket with runtime: out of memory or fatal error: runtime: cannot allocate memory in stderr
UDP datagrams on port 6343 or configured sFlow ports with anomalously small payloads carrying large AS path or community count fields
Sustained resident set size (RSS) spikes into the multi-gigabyte range on hosts running flow-analysis workloads

Detection Strategies

Inspect sFlow traffic with a parser that enforces bounds checks and alert on records where declared AS path or community counts exceed the datagram length divided by four
Correlate UDP flow logs with process restart events on collectors to surface repeated crashes triggered by external sources
Track dependency manifests (go.mod, go.sum) across build pipelines to identify services still pinned to gopacket v1.6.0 or earlier

Monitoring Recommendations

Alert on Go process memory growth that exceeds a defined baseline within seconds, which indicates single-packet allocation abuse
Monitor ingress UDP rates on sFlow ports from unexpected source addresses outside the network device inventory
Log and retain full sFlow packet captures during incident windows to support root-cause analysis

How to Mitigate CVE-2026-54332

Immediate Actions Required

Upgrade all Go builds that import gopacket to version 1.6.1 or later and redeploy affected collectors
Restrict sFlow ingress at the network edge so only known switch and router source addresses can reach collector ports
Audit downstream services and container images for transitive dependencies on gopacket v1.6.0 or earlier

Patch Information

The fix is available in gopacket v1.6.1. Details are documented in GHSA-g6v3-7xmc-w563. The patch adds a bounds check that rejects any AS path member count exceeding the remaining buffer length, preventing the unbounded make([]uint32, ad.Count) allocation.

Workarounds

Place sFlow collectors behind an access control list that only permits traffic from authorized network devices
Apply per-process memory limits using cgroups, systemd MemoryMax, or container resource limits to contain crashes
Disable the ExtendedGatewayFlow code path in forks or wrappers where sFlow gateway records are not required

bash

# Update gopacket to the patched release
go get github.com/gopacket/gopacket@v1.6.1
go mod tidy
go build ./...

# Verify the resolved version
go list -m github.com/gopacket/gopacket