CVE-2026-54345
Summary
The Diameter AVP decoder in github.com/gopacket/gopacket computes dataLength := avp.Length - uint32(headerSize) without first ensuring avp.Length >= headerSize. When the Vendor flag is set, headerSize is 12, but the only length guard upstream rejects avp.Length < 8. An AVP with the Vendor flag set and a 24-bit Length field of 8, 9, 10, or 11 therefore underflows the uint32 subtraction to ~4,294,967,292, which is passed straight to make([]byte, dataLength). A single 32-byte Diameter message forces a ~4 GiB allocation; a short burst of such messages exhausts memory and OOM-kills memory-constrained collectors. This is an unauthenticated remote denial of service (CWE-191 integer underflow -> CWE-770 unbounded allocation).
Root cause (file:line @ v1.6.0)
layers/diameter_avp_decoders.go, decodeDiameterAVP:
avp.Length = uint32(data[5])<<16 | uint32(data[6])<<8 | uint32(data[7]) // 24-bit wire value
if avp.Length < 8 { // only rejects < 8
return DiameterAVP{}, 0, fmt.Errorf("invalid AVP length: %d", avp.Length)
}
headerSize := 8
dataOffset := 8
if avp.Flags.Vendor { // Vendor flag = wire bit data[4] & 0x80
if len(data) < 12 { ... }
avp.VendorID = binary.BigEndian.Uint32(data[8:12])
headerSize = 12 // header is now 12, but only >= 8 was checked
dataOffset = 12
}
paddedLength := avp.Length // equals avp.Length; for avp.Length <= 12
if avp.Length%4 != 0 { paddedLength = avp.Length + (4 - avp.Length%4) }
if uint32(len(data)) < paddedLength { // only requires ~12 bytes present
return DiameterAVP{}, 0, fmt.Errorf("AVP data truncated: ...")
}
dataLength := avp.Length - uint32(headerSize) // 8 - 12 = uint32 underflow = 4294967292
avp.Data = make([]byte, dataLength) // make([]byte, ~4.29e9) ~= 4 GiB
copy(avp.Data, data[dataOffset:dataOffset+int(dataLength)]) // out-of-bounds slice -> panic
For avp.Length in {8, 9, 10, 11} with the Vendor flag set: the avp.Length < 8 guard passes, paddedLength == avp.Length so only avp.Length bytes must be present, and dataLength = a
⚡ Watch CVE-2026-54345
Get an email if CVE-2026-54345 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.
Exploitation outlook
- Low exploitation risk0.39% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 32% of all EPSS-scored CVEs.
Advisory coverage (2)
External references
Embed the live status
— this badge updates automatically when the KEV or exploit status changes. How to embed it →
[](https://www.csirts.com/cve/CVE-2026-54345)