Multiple layer decoders in gopacket use attacker-controlled lengths, counts, or offsets before validating against packet buffers. A crafted packet decoded through DecodingLayerParser or DecodeFromBytes can trigger an unrecovered panic, effectively crashing the process that uses the library. The vulnerability is a classic out‑of‑bounds read (CWE‑125) that results in denial of service (CWE‑400). It allows an unauthenticated attacker to stop the target from processing any further packets, compromising availability.

The vulnerability affects the gopacket library for the Go programming language. All applications or services that depend on gopacket versions up to and including 1.7.0 are susceptible. No later versions have been confirmed; a patch was merged in commit 210f25f and released in v1.7.1.

The CVSS score of 7.5 indicates a high severity, and the lack of EPSS data suggests that while exploitation has not been widely reported, the attack potential exists. The vulnerability is not listed in the CISA KEV catalog. It is likely to be exploited by sending a maliciously crafted network packet to any service or library consumer that decodes packets using the affected decoder. The vulnerability does not require authentication, so any remote host that can deliver the packet is a potential attacker.