CVE-2026-54345: gopacket Diameter AVP DoS Vulnerability

CVE-2026-54345 Overview

CVE-2026-54345 is an integer underflow vulnerability [CWE-191] in the gopacket library, a Go package that provides packet processing capabilities. The flaw resides in the Diameter Attribute-Value Pair (AVP) decoder, where the code subtracts a fixed header size from an attacker-controlled AVP Length field. A vendor-flagged AVP whose declared length is smaller than the 12-byte header causes the unsigned 32-bit value to underflow, triggering an unbounded allocation of roughly 4 GiB. Two crafted messages in succession exhaust memory and cause an out-of-memory (OOM) kill of the collector process. The issue affects gopacket versions 1.6.0 and earlier and is fixed in version 1.6.1.

Critical Impact
Unauthenticated remote attackers can crash Diameter collectors and packet-processing services built on gopacket by sending two malformed AVP messages, producing a network-reachable denial of service.

Affected Products

gopacket version 1.6.0 and earlier
Go applications embedding the layers package for Diameter protocol decoding
Network collectors, monitoring tools, and packet analyzers built on gopacket

Discovery Timeline

2026-07-28 - CVE-2026-54345 published to NVD
2026-07-28 - Last updated in NVD database

Technical Details for CVE-2026-54345

Vulnerability Analysis

The Diameter AVP decoder in layers/diameter_avp_decoders.go parses attribute-value pairs from Diameter protocol messages. Each AVP contains a Length field describing the total size of the AVP including its header. The decoder computes payload length by subtracting the header size from the Length field. When the Vendor flag is set, the header expands from 8 bytes to 12 bytes, but the pre-existing bounds check validated only against the non-vendor 8-byte header size.

An attacker sending an AVP with the Vendor flag set and a Length value between 8 and 11 bypasses the initial validation. The subsequent subtraction avp.Length - uint32(headerSize) underflows the uint32 type, producing a value near 2^32. The decoder then calls make([]byte, dataLength), requesting approximately 4 GiB of memory per AVP. Two such messages in sequence exhaust process memory and trigger the Linux OOM killer.

Root Cause

The root cause is an unsigned integer underflow [CWE-191] combined with a missing lower-bound check for the vendor-flagged header case. The avp.Length < 8 guard did not account for the larger 12-byte header, permitting arithmetic on values that produced wraparound.

Attack Vector

Exploitation requires no authentication and no user interaction. An attacker with network reachability to a service that decodes Diameter traffic through gopacket sends two crafted AVP messages with the Vendor flag set and a Length value less than 12. The decoder allocates approximately 4 GiB per message, and the process is terminated by the kernel.

		return DiameterAVP{}, 0, fmt.Errorf("AVP data truncated: expected %d bytes, got %d", paddedLength, len(data))
	}

+	// Reject an AVP whose declared Length cannot cover its own header. The
+	// earlier "avp.Length < 8" check uses the non-vendor header size, but when
+	// the Vendor flag is set headerSize is 12, so a Length of 8..11 would make
+	// the dataLength subtraction below underflow the uint32 and request a
+	// multi-gigabyte allocation.
+	if avp.Length < uint32(headerSize) {
+		return DiameterAVP{}, 0, fmt.Errorf("invalid AVP length: %d, smaller than header size %d", avp.Length, headerSize)
+	}
+
	// Extract AVP data
	dataLength := avp.Length - uint32(headerSize)
	avp.Data = make([]byte, dataLength)

Source: GitHub Commit 145859d. The patch adds an explicit check that rejects any AVP whose declared Length is smaller than the actual headerSize, preventing the underflow before the allocation.

Detection Methods for CVE-2026-54345

Indicators of Compromise

Repeated OOM-kill events for processes linking gopacket, visible in dmesg or journalctl -k with messages such as Out of memory: Killed process.
Sudden process memory growth to approximately 4 GiB followed by termination within seconds of receiving Diameter traffic.
Diameter packets containing AVPs with the Vendor flag (V bit) set and a Length field value between 8 and 11.

Detection Strategies

Inspect Diameter traffic at the network edge for malformed AVP headers where the Length field is less than 12 while the Vendor flag is set.
Correlate application crash telemetry with inbound Diameter or packet capture activity to identify the trigger source.
Monitor container and host memory metrics for anomalous single-process spikes on services that decode Diameter traffic.

Monitoring Recommendations

Enable memory cgroup limits on gopacket-based collectors so runaway allocations fail fast without impacting the host.
Log all Diameter parsing errors returned by the layers package and alert on high volumes of invalid AVP length or AVP data truncated errors.
Track process restart counts on packet ingestion services and alert on rapid restart loops indicative of repeated crashes.

How to Mitigate CVE-2026-54345

Immediate Actions Required

Upgrade gopacket to version 1.6.1 or later in all Go projects that import github.com/gopacket/gopacket.
Rebuild and redeploy any binary that statically links the vulnerable library; a dependency bump alone is not sufficient without recompilation.
Audit dependency trees using go list -m all | grep gopacket to identify transitive uses of the vulnerable package.

Patch Information

The fix is available in gopacket v1.6.1 via commit 145859d. Full technical detail is documented in GitHub Security Advisory GHSA-6r28-9ppf-4hj5. The patch adds a validation check that rejects AVPs whose declared Length is smaller than the applicable header size.

Workarounds

Restrict network exposure of Diameter decoders to trusted peers using firewall rules or IPsec tunnels until the upgrade is deployed.
Enforce per-process memory limits via systemdMemoryMax= or Kubernetes resource limits to contain the impact of a triggered allocation.
Terminate or drop Diameter packets at an upstream proxy when AVP Length values fall below the protocol minimum.

bash

# Upgrade gopacket to the patched release
go get github.com/gopacket/gopacket@v1.6.1
go mod tidy
go build ./...

# Verify the resolved version
go list -m github.com/gopacket/gopacket