{"id":"CVE-2022-2529","aliases":["GHSA-9rpw-2h95-666c","GO-2022-1032"],"url":"https://o3.security/vulnerability/CVE-2022-2529","summary":"Multiple DoS Attack Vectors in sflow packet handling","details":"### Impact\nThe sflow decode package prior to version 3.4.4 does not employ sufficient packet sanitisation which can lead to a denial of service attack. Attackers can craft malformed packets causing the process to consume huge amounts of memory resulting in a denial of service.\n\n### Specific Go Packages Affected\ngithub.com/cloudflare/goflow/v3/decoders/sflow\n\n### Patches\nVersion 3.4.4 contains patches fixing this.\n\n### Workarounds\nA possible workaround is to not have your goflow collector publicly reachable.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [goflow repo](https://github.com/cloudflare/goflow)\n* Email us [netdev[@]cloudflare.com ](mailto:netdev@cloudflare.com)\n","published":"2022-09-30T10:45:11Z","modified":"2026-10-28T02:31:14.060598930Z","cvss":{"score":7.5,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"epss":{"score":0.00856,"percentile":0.55218,"asOf":"2026-08-23"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Go","name":"github.com/cloudflare/goflow/v3","fixedVersion":"3.4.4"}],"fix":{"url":"https://github.com/cloudflare/goflow/commit/2b94619a6204443e3ca1769f4e459f9f57039c51","label":"cloudflare/goflow@2b94619"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/2xxx/CVE-2022-2529.json"},{"type":"ADVISORY","url":"https://github.com/cloudflare/goflow/security/advisories/GHSA-9rpw-2h95-666c"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-2529"},{"type":"WEB","url":"https://github.com/cloudflare/goflow/commit/2b94619a6204443e3ca1769f4e459f9f57039c51"},{"type":"WEB","url":"https://github.com/cloudflare/goflow/commit/c829ccd2c0aafdc9b886b20bf6f28095607f4998"},{"type":"PACKAGE","url":"https://github.com/cloudflare/goflow"},{"type":"WEB","url":"https://github.com/cloudflare/goflow/releases/tag/v3.4.4"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T02:31:14.060598930Z"}}