CVE-2026-54345: gopacket Integer Underflow (Wrap or Wraparound)
CVSS: 7.5v3.1HighAnalyzed
AliasesUBUNTU-CVE-2026-54345CGA-23jv-h63f-45jhCGA-2m9j-7rw8-pgvrCGA-328r-9xf2-rch3CGA-342q-rv2q-j6pmCGA-3h9c-2944-fwp5CGA-4qg6-w6qw-4296CGA-4wcj-x24r-x8jrCGA-4x89-26g9-4vmwCGA-4xj3-g58m-rp92CGA-4xwm-mf4v-q84hCGA-593j-pqc5-wm2pCGA-5j74-54q9-4w7pCGA-5xcw-xv6f-mq6fCGA-6r35-v6hf-9rjhCGA-75p6-f985-9mc8CGA-7fg9-p64v-qppmCGA-7w7c-v254-j3vvCGA-86pc-wv48-9q33CGA-98wm-3wwm-gm67CGA-c374-8r42-2xhxCGA-fq93-wr93-5ghvCGA-ggg8-5mwf-6rgfCGA-jhh3-h8gc-vr32CGA-jjj2-8232-6h77CGA-jpvj-h646-qh8rCGA-jvhw-x68c-fvv5CGA-m99h-8j4f-gpjfCGA-p7h9-rm77-4rc7CGA-q69c-xc9r-qpg7CGA-qq87-9885-jwh2CGA-qqmw-gq63-52rvCGA-r89q-6r3r-rmfgCGA-r993-5rw8-mh54CGA-rjhq-3x89-m26pCGA-rvv5-q2f7-pcjjCGA-vf49-hw44-79j5CGA-w3w7-qq35-f34cCGA-w4fx-hwcv-3ffmCGA-xw4c-873q-73gwGHSA-6r28-9ppf-4hj5GO-2026-6121CGA-2526-pqrp-6vx7CGA-2f3q-6gxh-f346CGA-2jqf-4gm9-5v72CGA-38q2-fj4v-5h38CGA-3fh9-2p3m-9pf2CGA-3gcm-6m4h-6mqqCGA-3gf8-x274-24x6CGA-3v54-7qq8-23grCGA-479g-c3g3-4359CGA-4c8g-pjc5-mqgpCGA-4q83-3g3x-6c5rCGA-4vr8-v295-3hqfCGA-4wxw-cqhx-45qqCGA-56fw-r5rp-687xCGA-56vr-6ff5-5224CGA-5j9g-q29r-cj34CGA-6f25-w83w-44mfCGA-6rfm-rw84-jw53CGA-6vw4-v7gw-qf37CGA-7h8q-9qrj-j3j9CGA-8g86-c2xh-3fp8CGA-8hp5-83gh-6qrhCGA-8mxv-3g37-7w7wCGA-8rj5-wx3m-8g9mCGA-9p56-gq66-4c43CGA-9qf4-39v8-6rrpCGA-9xp6-f79r-gwf5CGA-ccrr-cf3g-3grpCGA-cfjc-h4vw-6fx8CGA-cw35-8x7p-xvj2CGA-cxhw-pmwf-66q5CGA-fj5v-wr7m-vr2mCGA-frx8-2f5r-9q96CGA-fx9j-2v47-53m3CGA-gpcv-p59p-jv7vCGA-gq4q-j32w-gjxfCGA-gxh8-g9j8-5jxcCGA-h3r4-j8wx-fcj4CGA-hcm5-28vm-7p5vCGA-mgpx-jp7r-c7ghCGA-mpvp-f5cj-hrqmCGA-mq5h-vg39-8r67CGA-mwvf-92xp-845rCGA-mx2g-mj3v-jwfwCGA-pcj9-58g5-77rhCGA-pfpq-vvjc-w5j5CGA-pg55-vmqm-xr4pCGA-q3xq-m4fm-48c9CGA-qh7r-q422-hg9xCGA-r4hq-g2c7-53xvCGA-rg9h-j6p8-fm9gCGA-rrc7-7pg2-7pvgCGA-v56q-c4v2-6468CGA-v9m3-2r52-4wphCGA-vjvq-fhxr-4jxpCGA-vm8r-pq6v-w9c7CGA-w57f-vx4r-5g9jCGA-w7gm-rvmr-qwpwCGA-wqcj-r22m-hgf4CGA-xj44-32x5-c7f3
Published 28-07-2026Last modified 28-07-2026
Vulnerability summary
CVE-2026-54345 is a high (CVSS 7.5) Integer Underflow (Wrap or Wraparound) vulnerability in gopacket. EPSS estimates a 0.79% chance of exploitation in the next 30 days, higher than 55.4% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
7.5/10
010
High · v3.1 (NVD)EPSS score
0.79%
0%100%
Low · +0.28 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1github
Advisory lineage
Upstream 0 · Downstream 2 · Related 3Timeline
- 28-07-2026PublishedVulnerability first disclosed.
- 28-07-2026Last modifiedVulnerability information updated.
Description
gopacket provides packet processing capabilities for Go. In version 1.6.0 and earlier, the Diameter AVP decoder computes an AVP data length by subtracting a fixed header size from an attacker-controlled AVP Length field, so a vendor-flagged AVP whose Length is smaller than the 12-byte header underflows the unsigned 32-bit value and drives an unbounded allocation of roughly 4 GiB, and two such messages in succession OOM-kill a collector, causing an unauthenticated remote denial of service. This issue is fixed in version 1.6.1.
CVSS metrics
8 scores · 6 sources · 2 versionsMedium 6.9Preferred score · CVE.org (CNA)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:NSourcesAll 6 agree
- OSV · UbuntuEcosystem advisory · calculated6.9MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
- OSV · WolfiEcosystem advisory · calculated6.9MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
- OSV · GoEcosystem advisory · calculated6.9MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
- OSV · ChainguardEcosystem advisory · calculated6.9MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
- NVDNIST6.9MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
High 7.5Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSourcesAll 2 agree
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.79%
Chance of exploitation in the next 30 days
Percentile
55%
Versus all other CVEs
30-day change
+0.28 pp
From 0.51% on 18-09-2026
18-09-202618-10-2026
EPSS score0.79%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundGopacket
Maturity: poc
Weaknesses
CWE · root cause- CWE-191Integer Underflow (Wrap or Wraparound)The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.
- CWE-770Allocation of Resources Without Limits or ThrottlingThe product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
Affected systems
Chainguard40 products
- calico-felix-3.32< 3.32.1-r8 | < 3.32.2-r3
- calico-felix-fips-3.32< 3.32.1-r6
- calico-goldmane-3.32< 3.32.2-r3
- calico-key-cert-provisioner-3.32< 3.32.2-r3
- calico-node-3.32< 3.32.1-r8
Wolfi16 products
- calico-felix-3.32< 3.32.1-r8 | < 3.32.2-r3
- calico-goldmane-3.32< 3.32.2-r3
- calico-key-cert-provisioner-3.32< 3.32.2-r3
- calico-node-3.32< 3.32.1-r8
- calico-typhad-3.32< 3.32.2-r3
Ubuntu2 products
- golang-github-gopacket-gopacketAll versions (No fix recorded)
- gopacketAll versions (No fix recorded)
Github.com/gopacket1 product
- gopacket< 1.6.1
Gopacket1 product
- gopacket< 1.6.1
5 vendors · 60 products
References
8 links- github.com/gopacket/gopacket/security/advisories/GHSA-6r28-9ppf-4hj5X Refsource CONFIRMREPORTAdvisoryWEBExploitThird Party Advisory
- github.com/gopacket/gopacket/commit/145859d0eaee1a6f5925ffb93851c976449c3311X Refsource MISCFIXWEBPatch
- github.com/gopacket/gopacketPACKAGE