Description
gopacket provides packet processing capabilities for Go. Through version 1.7.0, multiple layer decoders use attacker-controlled lengths, counts, or offsets before validating them against packet buffers, allowing a crafted packet decoded through DecodingLayerParser or DecodeFromBytes to trigger an unrecovered panic and remotely deny service. A patch commit is available at 210f25f.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| gopacket | gopacket | <= 1.7.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | gopacket +1 | No fix yet | — |
| Debian 13 | gopacket +1 | No fix yet | — |
| Debian 12 | gopacket +1 | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | golang-github-gopacket-gopacket | No fix yet | — |
| Ubuntu 26.04 LTS | golang-github-gopacket-gopacket | No fix yet | — |
| Ubuntu 24.04 LTS | golang-github-gopacket-gopacket | No fix yet | — |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | telegraf | 1.31.0-31 | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | calico-node-3.32 +1 | 3.32.2-r2 | — |
| Wolfi rolling | calico-typhad-3.32 +2 | 3.32.2-r3 | — |
| Wolfi rolling | cilium-1.19 +2 | 1.19.7-r3 | — |
| Wolfi rolling | telegraf-1.38 | 1.38.4-r26 | — |