CVE-2022-2529
Multiple DoS Attack Vectors in sflow packet handling
sflow decode package does not employ sufficient packet sanitisation which can lead to a denial of service attack. Attackers can craft malformed packets causing the process to consume large amounts of memory resulting in a denial of service.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Multiple DoS Attack Vectors in sflow packet handling
sflow decode package does not employ sufficient packet sanitisation which can lead to a denial of service attack. Attackers can craft malformed packets causing the process to consume large amounts of memory resulting in a denial of service.
- Record
CVE-2022-2529- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-20, CWE-400
- Updated
- 2026-11-02
EUVDEUVD-2022-7068
sflow decode package does not employ sufficient packet sanitisation which can lead to a denial of service attack. Attackers can craft malformed packets causing the process to consume large amounts of memory resulting in a denial of service.
- Record
EUVD-2022-7068- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-9rpw-2h95-666c
Cloudflare GoFlow vulnerable to a Denial of Service in the sflow packet handling package
Impact
The sflow decode package prior to version 3.4.4 does not employ sufficient packet sanitisation which can lead to a denial of service attack. Attackers can craft malformed packets causing the process to consume huge amounts of memory resulting in a denial of service.
Specific Go Packages Affected
github.com/cloudflare/goflow/v3/decoders/sflow
Patches
Version 3.4.4 contains patches fixing this.
Workarounds
A possible workaround is to not have your goflow collector publicly reachable.
For more information
If you have any questions or comments about this advisory:
- Open an issue in goflow repo
- Email us netdev[@]cloudflare.com
- Record
GHSA-9rpw-2h95-666c- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-20, CWE-400
- Updated
- 2026-11-02
NVD
sflow decode package does not employ sufficient packet sanitisation which can lead to a denial of service attack. Attackers can craft malformed packets causing the process to consume large amounts of memory resulting in a denial of service.
- Record
CVE-2022-2529- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-20, CWE-400
- Updated
- 2026-11-02
OSV
Multiple DoS Attack Vectors in sflow packet handling
sflow decode package does not employ sufficient packet sanitisation which can lead to a denial of service attack. Attackers can craft malformed packets causing the process to consume large amounts of memory resulting in a denial of service.
- Record
CVE-2022-2529- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-20, CWE-400
- Updated
- 2026-11-02
OSVGHSA-9rpw-2h95-666c
Cloudflare GoFlow vulnerable to a Denial of Service in the sflow packet handling package
Impact
The sflow decode package prior to version 3.4.4 does not employ sufficient packet sanitisation which can lead to a denial of service attack. Attackers can craft malformed packets causing the process to consume huge amounts of memory resulting in a denial of service.
Specific Go Packages Affected
github.com/cloudflare/goflow/v3/decoders/sflow
Patches
Version 3.4.4 contains patches fixing this.
Workarounds
A possible workaround is to not have your goflow collector publicly reachable.
For more information
If you have any questions or comments about this advisory:
- Open an issue in goflow repo
- Email us netdev[@]cloudflare.com
- Record
GHSA-9rpw-2h95-666c- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-20, CWE-400
- Updated
- 2026-11-02
OSVGO-2022-1032 No score
Cloudflare GoFlow vulnerable to a Denial of Service in the sflow packet handling package in github.com/cloudflare/goflow
Cloudflare GoFlow vulnerable to a Denial of Service in the sflow packet handling package in github.com/cloudflare/goflow
- Record
GO-2022-1032- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/cloudflare/goflow/v3Go |
before 3.4.4 | 3.4.4 |
github.com/cloudflare/goflowGo |
All versions | None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-2529 is a high vulnerability (CVSS 7.5) in Cloudflare Goflow, published September 30, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.97%, the 62nd percentile. Fixed in github.com/cloudflare/goflow/v3 3.4.4.
References
github.com/cloudflare/goflow/security/advisories/GHSA-9rpw-2h95-666c
nvd.nist.gov/vuln/detail/CVE-2022-2529