CVE-2026-54332
Summary
The sFlow ExtendedGatewayFlow record decoder in github.com/gopacket/gopacket allocates a slice with make([]uint32, n) where n is an attacker-controlled 32-bit wire field that has no upper bound. Because the allocation happens *before* the read loop that would consume the corresponding bytes, a single small UDP datagram can force a multi-gigabyte allocation. A 104-byte sFlow datagram can request up to 16 GiB and OOM-kill any service that parses sFlow with gopacket. This is an unauthenticated remote denial of service (CWE-770).
Root cause (file:line @ v1.6.0)
Two sinks in layers/sflow.go, both in the ExtendedGatewayFlow (record type 1003) decode path:
1. layers/sflow.go:1306 in decodeExtendedGatewayFlowRecord:
*data, communitiesLength = (*data)[4:], binary.BigEndian.Uint32((*data)[:4])
eg.Communities = make([]uint32, communitiesLength) // communitiesLength is a raw wire uint32, no bound
for j := uint32(0); j < communitiesLength; j++ { ... }
2. layers/sflow.go:1276 in decodePath (a helper called from the same record decoder):
*data, ad.Count = (*data)[4:], binary.BigEndian.Uint32((*data)[:4])
ad.Members = make([]uint32, ad.Count) // ad.Count is a raw wire uint32, no bound
for i := uint32(0); i < ad.Count; i++ { ... }
In both cases the make is executed before the loop that reads the element bytes, so the allocation size is fully determined by the attacker-supplied count field and is never checked against the number of bytes actually remaining in the packet. communitiesLength = 0xFFFFFFFF requests make([]uint32, 4294967295) = 16,384 MB (16 GiB).
Reachability (remote attacker -> sink)
The registered LayerTypeSFlow decoder parses sFlow datagrams from the wire:
SFlowDatagram.DecodeFromBytes (sflow.go:302) -> SampleCount loop -> decodeFlowSample(expanded=false) (sflow.go:458) -> RecordCount loop -> record format 1003 SFlowTypeExtendedGatewayFlow (sflow.go:573) -> decodeExtendedGatewayFlowRecord (sflow.go:1284) -> sink at line 1306 (and line 1276 via the AS
⚡ Watch CVE-2026-54332
Get an email if CVE-2026-54332 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.
Exploitation outlook
- Low exploitation risk0.37% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 29% of all EPSS-scored CVEs.
Advisory coverage (2)
External references
Embed the live status
— this badge updates automatically when the KEV or exploit status changes. How to embed it →
[](https://www.csirts.com/cve/CVE-2026-54332)