GO-2026-6121 GoPacket's Diameter AVP decoder: uint32 underflow on vendor header size leads to unbounded ~4 GiB allocation (unauthenticated remote DoS) in github.com/gopacket/gopacket

GoPacket's Diameter AVP decoder: uint32 underflow on vendor header size leads to unbounded 4 GiB allocation unauthenticated remote DoS in github.com/gopacket/gopacket...

PT-2026-65536

Name of the Vulnerable Software and Affected Versions gopacket versions prior to 1.6.1 Description The Diameter AVP decoder in the decodeDiameterAVP function contains an integer underflow. When the Vendor flag is set, the decoder uses a 12-byte header size but only validates that the avp.Length...