—

GO-2026-6121

GoPacket's Diameter AVP decoder: uint32 underflow on vendor header size leads to unbounded ~4 GiB allocation (unauthenticated remote DoS) in github.com/gopacket/gopacket

Quick fix

GO-2026-6121 — github.com/gopacket/gopacket: upgrade to the fixed version with the command below.

go get github.com/gopacket/gopacket@v1.6.1

Details

GoPacket's Diameter AVP decoder: uint32 underflow on vendor header size leads to unbounded ~4 GiB allocation (unauthenticated remote DoS) in github.com/gopacket/gopacket

Are you affected?

Enter the version of the package you're using.

Affected packages

Go/github.com/gopacket/gopacket

Introduced in: 0Fixed in: 1.6.1

Fixgo get github.com/gopacket/gopacket@v1.6.1

References

https://github.com/gopacket/gopacket/security/advisories/GHSA-6r28-9ppf-4hj5[ADVISORY]
https://github.com/gopacket/gopacket/commit/145859d0eaee1a6f5925ffb93851c976449c3311[FIX]
https://github.com/gopacket/gopacket/releases/tag/v1.6.1[WEB]