Affected: CleanStart: calico

Security vulnerability affects the calico package. This issue is resolved in later releases. See references for vulnerability details.

gopacket provides packet processing capabilities for Go. In version 1.6.0 and earlier, the sFlow ExtendedGatewayFlow decoder in layers/sflow.go reads an attacker-controlled 32-bit community count and AS path member count and sizes a slice allocation from those counts without bounding them against the bytes remaining in the datagram, so a 104-byte UDP datagram can drive an allocation of up to 16 GiB and cause an unauthenticated remote denial of service. This issue is fixed in version 1.6.1.

Affected: Go: github.com/gopacket/gopacket

## Summary

The sFlow `ExtendedGatewayFlow` record decoder in `github.com/gopacket/gopacket` allocates a slice with `make([]uint32, n)` where `n` is an attacker-controlled 32-bit wire field that has no upper bound. Because the allocation happens *before* the read loop that would consume the corresponding bytes, a single small UDP datagram can force a multi-gigabyte allocation. A 104-byte sFlow datagram can request up to 16 GiB and OOM-kill any service that parses sFlow with gopacket. This is an unauthenticated remote denial of service (CWE-770).

## Root cause (file:line @ v1.6.0)

Two sinks in `layers/sflow.go`, both in the `ExtendedGatewayFlow` (record type 1003) decode path:

1. `layers/sflow.go:1306` in `decodeExtendedGatewayFlowRecord`: ```go *data, communitiesLength = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) eg.Communities = make([]uint32, communitiesLength) // communitiesLength is a raw wire uint32, no bound for j := uint32(0); j < communitiesLength; j++ { ... } ```

2. `layers/sflow.go:1276` in `decodePath` (a helper called from the same record decoder): ```go *data, ad.Count = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) ad.Members = make([]uint32, ad.Count) // ad.Count is a raw wire uint32, no bound for i := uint32(0); i < ad.Count; i++ { ... } ```

In both cases the `make` is executed before the loop that reads the element bytes, so the allocation size is fully determined by the attacker-supplied count field and is never checked agai…

Affected: Ubuntu:16.04:LTS: gopacket, Ubuntu:18.04:LTS: gopacket, Ubuntu:20.04:LTS: gopacket, Ubuntu:22.04:LTS: gopacket, Ubuntu:24.04:LTS: golang-github-gopacket-gopacket, Ubuntu:24.04:LTS: gopacket, Ubuntu:26.04:LTS: golang-github-gopacket-gopacket, Ubuntu:26.04:LTS: gopacket

gopacket provides packet processing capabilities for Go. In version 1.6.0 and earlier, the sFlow ExtendedGatewayFlow decoder in layers/sflow.go reads an attacker-controlled 32-bit community count and AS path member count and sizes a slice allocation from those counts without bounding them against the bytes remaining in the datagram, so a 104-byte UDP datagram can drive an allocation of up to 16 GiB and cause an unauthenticated remote denial of service. This issue is fixed in version 1.6.1.