Most recent entries from all

Withdrawn: CLEANSTART-2026-HP09399 — ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label

Withdrawn by the publisher.

Affected: CleanStart: calico

Multiple security vulnerabilities affect the calico package. The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. See references for individual vulnerability details.

EUVD-2026-342154

fkie_cve-2026-54345

gopacket provides packet processing capabilities for Go. In version 1.6.0 and earlier, the Diameter AVP decoder computes an AVP data length by subtracting a fixed header size from an attacker-controlled AVP Length field, so a vendor-flagged AVP whose Length is smaller than the 12-byte header underflows the unsigned 32-bit value and drives an unbounded allocation of roughly 4 GiB, and two such messages in succession OOM-kill a collector, causing an unauthenticated remote denial of service. This issue is fixed in version 1.6.1.

GHSA-6r28-9ppf-4hj5 — GoPacket's Diameter AVP decoder: uint32 underflow on vendor header size leads to unbounded ~4 GiB allocation (unauthent…

Affected: Go: github.com/gopacket/gopacket

## Summary

The Diameter AVP decoder in `github.com/gopacket/gopacket` computes `dataLength := avp.Length - uint32(headerSize)` without first ensuring `avp.Length >= headerSize`. When the Vendor flag is set, `headerSize` is 12, but the only length guard upstream rejects `avp.Length < 8`. An AVP with the Vendor flag set and a 24-bit Length field of 8, 9, 10, or 11 therefore underflows the `uint32` subtraction to ~4,294,967,292, which is passed straight to `make([]byte, dataLength)`. A single 32-byte Diameter message forces a ~4 GiB allocation; a short burst of such messages exhausts memory and OOM-kills memory-constrained collectors. This is an unauthenticated remote denial of service (CWE-191 integer underflow -> CWE-770 unbounded allocation).

## Root cause (file:line @ v1.6.0)

`layers/diameter_avp_decoders.go`, `decodeDiameterAVP`:

```go avp.Length = uint32(data[5])<<16 | uint32(data[6])<<8 | uint32(data[7]) // 24-bit wire value

if avp.Length < 8 { // only rejects < 8 return DiameterAVP{}, 0, fmt.Errorf("invalid AVP length: %d", avp.Length) }

headerSize := 8 dataOffset := 8 if avp.Flags.Vendor { // Vendor flag = wire bit data[4] & 0x80 if len(data) < 12 { ... } avp.VendorID = binary.BigEndian.Uint32(data[8:12]) headerSize = 12 // header is now 12, but only >= 8 was checked dataOffset = 12 }

paddedLength := avp.Length // equals avp.Length; for avp.Length <= 12 if avp.Leng…

UBUNTU-CVE-2026-54345

Affected: Ubuntu:16.04:LTS: gopacket, Ubuntu:18.04:LTS: gopacket, Ubuntu:20.04:LTS: gopacket, Ubuntu:22.04:LTS: gopacket, Ubuntu:24.04:LTS: golang-github-gopacket-gopacket, Ubuntu:24.04:LTS: gopacket, Ubuntu:26.04:LTS: golang-github-gopacket-gopacket, Ubuntu:26.04:LTS: gopacket