Repository navigation
Tags
Tags
v1.7.1 - security release Fixes unauthenticated remote denial-of-service panics in layer decoders, covering four advisories. v1.7.0 and earlier are affected. CVE-2026-65819 / GHSA-8mcr-459q-5mx2 11 decoders (fix was unreleased) GHSA-6h9g-cjv3-pg2c TCP MPTCP options GHSA-25xj-ggj7-jqgf SIP header folding GHSA-cxrr-2gv2-m94w 12 link and tunnel decoders Also includes the #163 decoder length checks and the MDNS name serialization fix (#157).
build(deps): bump golang.org/x/net from 0.39.0 to 0.55.0 (#162) * build(deps): bump golang.org/x/net from 0.39.0 to 0.55.0 Bumps [golang.org/x/net](https://github.com/golang/net) from 0.39.0 to 0.55.0. - [Commits](golang/net@v0.39.0...v0.55.0) --- updated-dependencies: - dependency-name: golang.org/x/net dependency-version: 0.55.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> * ci: read go version from go.mod golang.org/x/net v0.55.0 requires go 1.25.0, which bumps the module's go directive. The workflow needs two fixes to cope: - setup-go reads the version from go.mod (checkout must run first) instead of a hardcoded version, so future bumps can't drift. - the test step uses "$(which go)" under sudo: sudo's secure_path resolves go to the runner's system toolchain, which no longer satisfies the go directive. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AEgqcfwb9wTW91oZQv9K7X --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Ali <10158936+mosajjal@users.noreply.github.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Merge commit from fork The sFlow ExtendedGatewayFlow (record type 1003) decoder allocated slices with make([]uint32, n) where n is a raw 32-bit wire field with no upper bound, and the allocation ran before the loop that consumes the bytes. A single ~104-byte UDP datagram could therefore request up to 16 GiB and OOM-kill any service parsing sFlow with gopacket (unauthenticated remote DoS, CWE-770). Both decodeExtendedGatewayFlowRecord (communitiesLength) and decodePath (ad.Count) now reject any count that exceeds the bytes actually remaining in the datagram (each element is 4 bytes on the wire, so the bound is len(remaining)/4) and return a decode error instead of pre-allocating. decodePath now returns that error and its caller propagates it. Adds a regression test that feeds an oversized communities count and asserts a decode error rather than an unbounded allocation, plus a negative control that a correctly sized record still decodes.
PreviousNext