-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from missing input validation on size fields in packet decoding functions. The patches explicitly add constraints like MAX_FLOWS_PER_PACKET, MAX_AS_PATH_LENGTH, and MAX_SAMPLES_PER_PACKET to these functions. The pre-patch code allocated memory based directly on attacker-controlled packet fields without sanitization, enabling memory exhaustion attacks. The affected functions are clearly identified in the commit diffs (netflow.go and sflow.go), and the CWE mappings (CWE-20/CWE-400) directly correlate to these missing validations.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/cloudflare/goflow/v3 | go | < 3.4.4 | 3.4.4 |
A Semantic Attack on Google Gemini - Read the Latest Research