CVE-2026-54345 — Security Box Score

CVE · referencelatest edition

Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2026-54345MEDIUM

GoPacket's Diameter AVP decoder: uint32 underflow on vendor header size leads to unbounded ~4 GiB allocation (unauthenticated remote DoS)

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   N   N   L    6.9   .0045   37.8     —

AFFECTED
  Product   Versions   Fixed
  gopacket  < 1.6.1 –  —

TIMELINE
  Jun 12  Reserved by GitHub_M
  Jul 28  EXPLOIT PUBLISHED — CVE-2026-54345 (gopacket). Public exploit reference added.
  Jul 28  Published (CNA: GitHub_M)

CWE-191, CWE-770 · CNA: GitHub_M · CVSS v4.0 · 3 references · NVD status: Analyzed

Description

gopacket provides packet processing capabilities for Go. In version 1.6.0 and earlier, the Diameter AVP decoder computes an AVP data length by subtracting a fixed header size from an attacker-controlled AVP Length field, so a vendor-flagged AVP whose Length is smaller than the 12-byte header underflows the unsigned 32-bit value and drives an unbounded allocation of roughly 4 GiB, and two such messages in succession OOM-kill a collector, causing an unauthenticated remote denial of service. This issue is fixed in version 1.6.1.

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
June 12, 2026	Reserved	Reserved by GitHub_M
July 28, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2026-54345 (gopacket). Public exploit reference added.
July 28, 2026	Published	Published (CNA: GitHub_M)

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
gopacket	gopacket	—	< 1.6.1	—

Weaknesses

CWE-191 · CWE-770

References (3)

https://github.com/gopacket/gopacket/commit/145859d0eaee1a6f5925ffb93851c976449c3311 [Patch]
https://github.com/gopacket/gopacket/releases/tag/v1.6.1 [Release Notes]
https://github.com/gopacket/gopacket/security/advisories/GHSA-6r28-9ppf-4hj5 [Exploit, Third Party Advisory]

Authoritative record: CVE-2026-54345 at cve.org

Vendors: gopacket

Weaknesses: CWE-191 · CWE-770

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-54345 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.