GoPacket's Diameter AVP decoder: uint32 underflow on vendor header size leads to unbounded ~4 GiB allocation (unauthenticated remote DoS)

Summary The Diameter AVP decoder in github.com/gopacket/gopacket computes dataLength := avp.Length - uint32headerSize without first ensuring avp.Length = headerSize. When the Vendor flag is set, headerSize is 12, but the only length guard upstream rejects avp.Length CWE-770 unbounded allocation...

CVE-2026-54345

CVE-2026-54345 concerns the GoPacket project (github.com/gopacket/gopacket) <= v1.6.0, where the Diameter AVP decoder uses a fixed 12-byte header for vendor AVPs. If avp.Length is less than the header size, under certain conditions the code computes dataLength as avp.Length - headerSize, which...

CVE-2026-54345 GoPacket's Diameter AVP decoder: uint32 underflow on vendor header size leads to unbounded ~4 GiB allocation (unauthenticated remote DoS)

gopacket provides packet processing capabilities for Go. In version 1.6.0 and earlier, the Diameter AVP decoder computes an AVP data length by subtracting a fixed header size from an attacker-controlled AVP Length field, so a vendor-flagged AVP whose Length is smaller than the 12-byte header...

CVE-2026-54345

gopacket provides packet processing capabilities for Go. In version 1.6.0 and earlier, the Diameter AVP decoder computes an AVP data length by subtracting a fixed header size from an attacker-controlled AVP Length field, so a vendor-flagged AVP whose Length is smaller than the 12-byte header...