CVE-2026-37462
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
An integer underflow in the BGPUpdate.DecodeFromBytes function (/bgp/bgp.go) of gobgp v4.3.0 allows attackers to cause a denial of service by sending a crafted BGP UPDATE message.
Risk Assessment
An attacker can remotely crash the BGP router, causing network connectivity loss and routing disruptions.
Recommendation
Update gobgp to version 4.3.1 or later which contains the fix.
Other vulnerabilities in gobgp
See all- CVE-2026-42285High
In version 4.4.0 of GoBGP, an unauthenticated remote BGP peer can trigger a fatal panic by sending a specially crafted BGP UPDATE message. This bug causes the entire GoBGP process to crash, resulting in a complete loss of service availability.
- CVE-2026-41643High
GoBGP, an open source implementation of the BGP protocol in Go, prior to version 4.3.0 has a remote Denial of Service (DoS) vulnerability. A malformed BGP UPDATE message can trigger a runtime error related to an index out of range.
- CVE-2026-41642High
In version 4.3.0 of GoBGP, an open source BGP implementation, a remote Denial of Service (DoS) vulnerability exists due to a nil pointer dereference. A malformed BGP UPDATE message containing an unrecognized Path Attribute marked as 'Well-known' leads to a process crash.
- CVE-2026-37461High
An out-of-bounds read in the ParseIP6Extended function in gobgp v4.3.0 allows attackers to cause a Denial of Service (DoS) by supplying a crafted BGP UPDATE message.
Original NVD description (English source)
An integer underflow in the BGPUpdate.DecodeFromBytes function (/bgp/bgp.go) of gobgp v4.3.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted BGP UPDATE message.