CVE-2026-54332: gopacket
CVSS: 7.5v3.1HighAnalyzed
AliasesUBUNTU-CVE-2026-54332DEBIAN-CVE-2026-54332CGA-299r-82rj-c3jjCGA-2wp9-m3xh-jvxqCGA-375g-xhqp-vhx8CGA-387w-4crj-7436CGA-3gm4-93jp-p6h3CGA-3xhg-53x4-83j7CGA-5mj9-j3c2-fwj9CGA-653q-64rj-xrwfCGA-6fgg-jjfh-f4p4CGA-6xpc-6f6g-vfqgCGA-7j97-5xw2-77gcCGA-8397-phmp-xjh9CGA-8wrf-c98c-4gq6CGA-9j2q-p9p2-ff85CGA-9q47-p6mq-p8gjCGA-c7pm-4p9q-j936CGA-cm7f-cvpg-pjhrCGA-cm7f-m883-5v6fCGA-cvwx-4j7c-x64pCGA-f99p-cjpg-45r3CGA-g6w8-45jw-2pvhCGA-hg47-r48w-2233CGA-hr28-x79j-xfvgCGA-j3hv-876m-9jvwCGA-j725-8p4v-xwx6CGA-jjq8-574f-xj73CGA-mg6p-g54w-6gq2CGA-mjr7-39g5-rf24CGA-p2qm-9774-rw89CGA-p3pw-3h3c-4x2hCGA-pw46-whgg-x8qjCGA-q26g-35cf-mg8pCGA-r5cr-r4f3-q28pCGA-rgvj-w2g6-fmxcCGA-rgxc-7cx4-7r3xCGA-wgrx-wc44-33grCGA-wmwg-f8x3-7rm8CGA-wr2q-5frx-f5r3CGA-xr3j-x6wx-jg75GHSA-g6v3-7xmc-w563GO-2026-6122CGA-2438-phq5-mpxjCGA-2gvc-33mq-7wvgCGA-399h-r48p-rrm6CGA-42f7-9h43-g4fpCGA-4fvg-5w7h-9m4gCGA-4wp9-rcr5-g6xhCGA-5mc4-f7mh-f2wxCGA-5pwq-fh7p-fjcvCGA-66wv-qfjj-vprrCGA-6gfh-38wr-wf28CGA-6mgr-fxh7-vcxwCGA-6wj4-jch5-6h8qCGA-72jq-w82c-2qqwCGA-765g-9466-9397CGA-799w-55j6-jx23CGA-7frj-rccq-vr54CGA-83xr-4x24-6gfxCGA-864f-v77q-26qfCGA-87fr-j6g2-cmm3CGA-9x84-49r6-fv9gCGA-cpr3-w8x8-gf28CGA-cr6g-pv43-rq8fCGA-cvrw-mgxq-2mjpCGA-cw26-rv7j-m7x6CGA-f32w-6w49-5vq6CGA-f63j-23w5-w8g6CGA-fhrv-3g84-9q63CGA-fwwq-3m95-r7gpCGA-g2x2-hp73-cjpgCGA-gfr9-9cjr-f532CGA-gj8p-4322-2p7jCGA-h4w7-4pxc-mvhpCGA-hc5c-6h6f-w2xwCGA-j3h4-3x52-x3jcCGA-jv6j-h598-693wCGA-m4cm-h6xh-gqcmCGA-m63q-wqcf-8fwwCGA-mf6v-phxm-jgc9CGA-mg66-38mf-9qhpCGA-mgrf-m92x-5g8mCGA-mhpc-57j4-f5cpCGA-mmxg-pvx5-f9g7CGA-p788-m2rx-8wh4CGA-p8xc-7wcv-7mp4CGA-pfwp-fg7v-qg5gCGA-q728-h23h-f7c3CGA-q94x-xrqq-772cCGA-qc7w-hc4g-fvv9CGA-qg86-c497-mr9pCGA-r56v-2qjf-7vcjCGA-r955-9r8h-5j85CGA-v3cm-fxrq-8gmcCGA-v8r5-c76p-wgfwCGA-w9q6-3c86-g69rCGA-wgrq-pghw-hwg4CGA-wv8m-32g9-jjvhCGA-x34q-8vmf-6v7gCGA-xjj6-6r29-gphpCGA-xmpw-rhpw-cp9jCGA-xp2j-m8gv-3gc7
Published 28-07-2026Last modified 28-07-2026
Vulnerability summary
CVE-2026-54332 is a high (CVSS 7.5) vulnerability in gopacket. EPSS estimates a 0.79% chance of exploitation in the next 30 days, higher than 55.4% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
7.5/10
010
High · v3.1 (NVD)EPSS score
0.79%
0%100%
Low · +0.30 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1github
Advisory lineage
Upstream 0 · Downstream 2 · Related 3Timeline
- 28-07-2026PublishedVulnerability first disclosed.
- 28-07-2026Last modifiedVulnerability information updated.
Description
gopacket provides packet processing capabilities for Go. In version 1.6.0 and earlier, the sFlow ExtendedGatewayFlow decoder in layers/sflow.go reads an attacker-controlled 32-bit community count and AS path member count and sizes a slice allocation from those counts without bounding them against the bytes remaining in the datagram, so a 104-byte UDP datagram can drive an allocation of up to 16 GiB and cause an unauthenticated remote denial of service. This issue is fixed in version 1.6.1.
CVSS metrics
9 scores · 7 sources · 2 versionsMedium 6.9Preferred score · CVE.org (CNA)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:NSourcesAll 6 agree
- OSV · UbuntuEcosystem advisory · calculated6.9MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
- OSV · WolfiEcosystem advisory · calculated6.9MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
- OSV · GoEcosystem advisory · calculated6.9MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
- OSV · ChainguardEcosystem advisory · calculated6.9MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
- NVDNIST6.9MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
High 7.5Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSourcesAll 3 agree
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.79%
Chance of exploitation in the next 30 days
Percentile
55%
Versus all other CVEs
30-day change
+0.30 pp
From 0.50% on 19-09-2026
19-09-202619-10-2026
EPSS score0.79%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundGopacket
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Chainguard40 products
- calico-felix-3.32< 3.32.1-r8 | < 3.32.2-r3
- calico-felix-fips-3.32< 3.32.1-r6
- calico-goldmane-3.32< 3.32.2-r3
- calico-key-cert-provisioner-3.32< 3.32.2-r3
- calico-node-3.32< 3.32.1-r8
Wolfi16 products
- calico-felix-3.32< 3.32.1-r8 | < 3.32.2-r3
- calico-goldmane-3.32< 3.32.2-r3
- calico-key-cert-provisioner-3.32< 3.32.2-r3
- calico-node-3.32< 3.32.1-r8
- calico-typhad-3.32All versions (No fix recorded)
Debian2 products
- golang-github-gopacket-gopacketAll versions (No fix recorded)
- gopacketAll versions (No fix recorded)
Ubuntu2 products
- golang-github-gopacket-gopacketAll versions (No fix recorded)
- gopacketAll versions (No fix recorded)
Github.com/gopacket1 product
- gopacket< 1.6.1
Gopacket1 product
- gopacket< 1.6.1
6 vendors · 62 products
References
9 links- github.com/gopacket/gopacket/security/advisories/GHSA-g6v3-7xmc-w563X Refsource CONFIRMREPORTAdvisoryWEBExploitThird Party Advisory
- github.com/gopacket/gopacket/commit/76119086f5936aacd7088bdf97d565501bb6c4ccX Refsource MISCFIXWEBPatch
- github.com/gopacket/gopacketPACKAGE