CVE-2026-41642
HighSummary
In version 4.3.0 of GoBGP, an open source BGP implementation, a remote Denial of Service (DoS) vulnerability exists due to a nil pointer dereference. A malformed BGP UPDATE message containing an unrecognized Path Attribute marked as 'Well-known' leads to a process crash.
Risk Assessment
This vulnerability can lead to a complete service outage of GoBGP, affecting network stability and availability. Organizations using GoBGP should be aware of the risks associated with unauthorized access to their systems.
Recommendation
It is recommended to upgrade GoBGP to version 4.4.0, where the issue has been patched. Additionally, system logs should be monitored for potential attempts to exploit this vulnerability.
Other vulnerabilities in GoBGP
See all- CVE-2026-42285High
In version 4.4.0 of GoBGP, an unauthenticated remote BGP peer can trigger a fatal panic by sending a specially crafted BGP UPDATE message. This bug causes the entire GoBGP process to crash, resulting in a complete loss of service availability.
- CVE-2026-41643High
GoBGP, an open source implementation of the BGP protocol in Go, prior to version 4.3.0 has a remote Denial of Service (DoS) vulnerability. A malformed BGP UPDATE message can trigger a runtime error related to an index out of range.
- CVE-2026-37461High
An out-of-bounds read in the ParseIP6Extended function in gobgp v4.3.0 allows attackers to cause a Denial of Service (DoS) by supplying a crafted BGP UPDATE message.
- CVE-2026-37462High
An integer underflow in the BGPUpdate.DecodeFromBytes function (/bgp/bgp.go) of gobgp v4.3.0 allows attackers to cause a denial of service by sending a crafted BGP UPDATE message.
Original NVD description (English source)
GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. In version 4.3.0, a remote Denial of Service (DoS) vulnerability exists in GoBGP due to a nil pointer dereference. When a malformed BGP UPDATE message contains an unrecognized Path Attribute marked as "Well-known," the daemon fails to interrupt the message handling flow. This results in an illegal memory access and a full process crash (panic). This issue has been patched in version 4.4.0.