The gopacket library’s sFlow ExtendedGatewayFlow decoder mistakenly reads a 32‑bit community count and AS path member count from an incoming UDP packet without constraining the size of the slice allocation to the remaining packet bytes. Consequently, a small 104‑byte packet can trigger a memory allocation as large as 16 GiB, exhausting system resources and causing a denial‑of‑service. This weakness is a classic instance of unbounded allocation (CWE‑770).

The vulnerability exists in gopacket for Go, affecting all releases up through version 1.6.0. The fix is included in release 1.6.1 and later.

With a CVSS score of 6.9 and an EPSS score of less than 1 %, exploitation is considered moderately difficult and low probability, but the attack vector is remote and unauthenticated via crafted UDP packets. The vulnerability is not listed in the CISA KEV catalog, yet an attacker could still leverage it from anywhere that can reach the sFlow decoder on a host running the vulnerable library.