The vulnerability resides in the Diameter AVP decoder of the GoPacket library. An attacker‑controlled AVP length that is smaller than the constant 12‑byte header causes a 32‑bit underflow when the driver computes the payload length. This calculation results in an allocation request of roughly 4 GiB. Two such consecutive allocations can exhaust the system’s memory, leading to an out‑of‑memory condition that kills the collector or any process using the library. The flaw is an integer underflow (CWE‑191) that feeds an uncontrolled allocation size (CWE‑770). Affected systems are Go projects that link to the gopacket library version 1.6.0 or earlier. The library is commonly used for packet parsing in network monitoring, intrusion detection, and custom packet processing tools. All users of the older library that process Diameter packets are potentially impacted until they upgrade to the patched 1.6.1 release. The CVSS score of 6.9 indicates medium severity, and the EPSS value of less than 1 % suggests a low likelihood of exploitation at present. The vulnerability is not listed in CISA’s KEV catalog. Because the error occurs during packet parsing, an unauthenticated remote attacker can trigger it by sending specially crafted Diameter messages to any service that processes such packets through the vulnerable library. No validation is performed before the allocation, and failure results in a denial‑of‑service rather than code execution.

Affected systems are any Go applications that link to the gopacket library version 1.6.0 or earlier and that parse Diameter packets. These include network monitoring tools, intrusion detection systems, and custom packet‑processing utilities written in Go that depend on gopacket for packet decoding.

The CVSS score of 6.9 indicates medium severity, with an EPSS score of <1 % pointing to a low likelihood of exploitation. It is not listed in CISA’s KEV catalog. The flaw can be exploited by any external entity that can send Diameter messages to a vulnerable service; no authentication or elevated privileges are required. By crafting AVP lengths smaller than the 12‑byte header, an attacker can trigger the 32‑bit underflow and request an almost 4 GiB allocation. Sending two such messages in quick succession can exhaust system memory and cause the application or collector to terminate, resulting in a denial‑of‑service.