Impact The sflow decode package prior to version 3.4.4 does not employ sufficient packet sanitisation which can lead to a denial of service attack. Attackers can craft malformed packets causing the process to consume huge amounts of memory resulting in a denial of service.

Specific Go Packages Affected github.com/cloudflare/goflow/v3/decoders/sflow

Patches Version 3.4.4 contains patches fixing this.

Workarounds A possible workaround is to not have your goflow collector publicly reachable.

For more information If you have any questions or comments about this advisory: Open an issue in goflow repo Email us [netdev[@]cloudflare.com ](mailto:netdev@cloudflare.com)