Description

gopacket provides packet processing capabilities for Go. Through version 1.7.0, multiple layer decoders use attacker-controlled lengths, counts, or offsets before validating them against packet buffers, allowing a crafted packet decoded through DecodingLayerParser or DecodeFromBytes to trigger an unrecovered panic and remotely deny service. A patch commit is available at 210f25f.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-07T20:16:52.603Z",
  "pubdate": "2026-08-07T20:16:52.603Z",
  "executiveSummary": "A denial of service vulnerability exists in gopacket through version 1.7.0, specifically within its packet processing and layer decoding mechanisms. The flaw is triggered when multiple layer decoders consume attacker-controlled lengths, counts, or offsets without performing preliminary validation checks against the boundaries of the underlying packet buffers. This oversight allows maliciously crafted packets processed via the DecodingLayerParser or DecodeFromBytes methods to induce unrecovered panics, such as index out-of-range or nil-pointer dereference errors during execution.\nThe primary impact of this vulnerability is a remote denial of service (DoS), as an unhandled panic in a core packet processing loop will terminate the host Go application or routine handling the network traffic. The affected systems include any Go-based services, network monitors, or security tools utilizing vulnerable versions of the gopacket library to parse untrusted network input. An attacker with the ability to transmit crafted network packets to the vulnerable target possesses the necessary capabilities to trigger the vulnerability without requiring authentication, administrative privileges, or prior interaction. Exploitation relies entirely on the ingestion and parsing of specially formatted network payloads through the vulnerable decoding paths.",
  "technicalDetails": "The root cause of the vulnerability stems from inadequate input validation and boundary checking within multiple layer decoders implemented in gopacket through version 1.7.0. Specifically, routines responsible for parsing specific protocol layers extract fields representing lengths, item counts, or byte offsets directly from the raw packet stream. These attacker-controlled values are subsequently utilized in slice indexing, memory allocation, or pointer arithmetic operations without verifying whether the specified constraints exceed the actual remaining bounds of the underlying packet buffer provided to the decoding function.\nThe vulnerable components include the DecodingLayerParser and DecodeFromBytes interfaces and their associated sub-layer decoders. When an application invokes these functions to parse untrusted network packets, the parser iterates through layers based on instructions derived from the packet headers. If a crafted packet contains manipulated length or offset parameters, the decoder attempts to read past the end of the byte slice or allocates data based on corrupted size metrics. In the Go programming language, out-of-bounds slice access results in a runtime panic. Because these decoding routines frequently execute within high-throughput packet handling loops without localized panic recovery mechanisms (defer/recover blocks), the panic propagates up the call stack, abruptly crashing the entire application or worker routine.\nThe attack flow proceeds as follows: First, an attacker constructs a specialized packet containing malformed protocol headers with deceptive length, count, or offset values. Second, the attacker transmits this crafted packet across the network to a target system running an application built with gopacket through version 1.7.0. Third, the target application captures the packet and passes the raw byte slice to gopacket via DecodeFromBytes or DecodingLayerParser. Fourth, the vulnerable layer decoders extract the malicious length or offset values and attempt buffer operations without validation. Finally, the operation triggers an unrecovered runtime panic, resulting in a complete denial of service for the affected application or service."
}