Cloudflare GoFlow vulnerable to a Denial of Service in the sflow packet handling package

Impact

The sflow decode package prior to version 3.4.4 does not employ sufficient packet sanitisation which can lead to a denial of service attack. Attackers can craft malformed packets causing the process to consume huge amounts of memory resulting in a denial of service.

Specific Go Packages Affected

github.com/cloudflare/goflow/v3/decoders/sflow

Patches

Version 3.4.4 contains patches fixing this.

Workarounds

A possible workaround is to not have your goflow collector publicly reachable.

For more information

If you have any questions or comments about this advisory:

• Open an issue in goflow repo
• Email us netdev[@]cloudflare.com