GoPacket's Diameter AVP decoder: uint32 underflow on vendor header size leads to unbounded ~4 GiB allocation (unauthenticated remote DoS)

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-54345 · CVE overview and exploitation status

EUVD-2026-49893

GHSA-6r28-9ppf-4hj5

GO-2026-6121

cve-program · CVE-2026-54345

• https://github.com/gopacket/gopacket/security/advisories/GHSA-6r28-9ppf-4hj5
• https://github.com/gopacket/gopacket/commit/145859d0eaee1a6f5925ffb93851c976449c3311
• https://github.com/gopacket/gopacket/releases/tag/v1.6.1

euvd · EUVD-2026-49893

• https://github.com/gopacket/gopacket/security/advisories/GHSA-6r28-9ppf-4hj5
• https://github.com/gopacket/gopacket/commit/145859d0eaee1a6f5925ffb93851c976449c3311
• https://github.com/gopacket/gopacket/releases/tag/v1.6.1

nvd · CVE-2026-54345

• https://github.com/gopacket/gopacket/commit/145859d0eaee1a6f5925ffb93851c976449c3311
• https://github.com/gopacket/gopacket/releases/tag/v1.6.1
• https://github.com/gopacket/gopacket/security/advisories/GHSA-6r28-9ppf-4hj5

osv · GHSA-6r28-9ppf-4hj5

• https://github.com/gopacket/gopacket/security/advisories/GHSA-6r28-9ppf-4hj5
• https://github.com/gopacket/gopacket/commit/145859d0eaee1a6f5925ffb93851c976449c3311
• https://github.com/gopacket/gopacket
• https://github.com/gopacket/gopacket/releases/tag/v1.6.1

osv · GO-2026-6121

• https://github.com/gopacket/gopacket/security/advisories/GHSA-6r28-9ppf-4hj5
• https://github.com/gopacket/gopacket/commit/145859d0eaee1a6f5925ffb93851c976449c3311
• https://github.com/gopacket/gopacket/releases/tag/v1.6.1

No related changes are available here.