GHSA-9rpw-2h95-666c

Cloudflare GoFlow vulnerable to a Denial of Service in the sflow packet handling package

Source: GitHub Advisory Database (reviewed) High CVE-2022-2529

Packages

Ecosystem	Package	Affected	Fixed in
Go	github.com/cloudflare/goflow/v3	< 3.4.4	3.4.4

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact The sflow decode package prior to version 3.4.4 does not employ sufficient packet sanitisation which can lead to a denial of service attack. Attackers can craft malformed packets causing the process to consume huge amounts of memory resulting in a denial of service. ### Specific Go Packages Affected github.com/cloudflare/goflow/v3/decoders/sflow ### Patches Version 3.4.4 contains patches fixing this. ### Workarounds A possible workaround is to not have your goflow collector publicly reachable. ### For more information If you have any questions or comments about this advisory: * Open an issue in [goflow repo](https://github.com/cloudflare/goflow) * Email us [netdev[@]cloudflare.com ](mailto:[email protected])

References

External links from the advisory. They lead to third-party sites.