Cloudflare GoFlow vulnerable to a Denial of Service in the sflow packet handling package

CAO 7.5CVE-2022-2529 · GHSA-9rpw-2h95-666c · GO-2022-1032 · Công bố 30/09/2022 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2022-2529 là lỗ hổng mức CAO (CVSS 7.5) ảnh hưởng github.com/cloudflare/goflow, github.com/cloudflare/goflow/v3, goflow (cloudflare).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.97%, cao hơn 61.9% các lỗ hổng khác.
Cách xử lý: cập nhật lên 3.4.4 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
github.com/cloudflare/goflow Go	`mọi phiên bản`	Chưa có bản vá
github.com/cloudflare/goflow/v3 Go	`< 3.4.4`	`3.4.4`
goflow cloudflare	`< 3.4.4`	`3.4.4`

Mô tả

Impact

The sflow decode package prior to version 3.4.4 does not employ sufficient packet sanitisation which can lead to a denial of service attack. Attackers can craft malformed packets causing the process to consume huge amounts of memory resulting in a denial of service.

Specific Go Packages Affected

github.com/cloudflare/goflow/v3/decoders/sflow

Patches

Version 3.4.4 contains patches fixing this.

Workarounds

A possible workaround is to not have your goflow collector publicly reachable.

For more information

If you have any questions or comments about this advisory:

Open an issue in goflow repo
Email us netdev[@]cloudflare.com

Mô tả của NVD

sflow decode package does not employ sufficient packet sanitisation which can lead to a denial of service attack. Attackers can craft malformed packets causing the process to consume large amounts of memory resulting in a denial of service.