CVE-2026-7737

An out-of-bounds read in the ParseIP6Extended function in gobgp v4.3.0 allows attackers to cause a Denial of Service (DoS) by supplying a crafted BGP UPDATE message.

GoBGP, a BGP implementation in Go, prior to version 4.7.0 accepts a zero-length AS_PATH during UPDATE decoding and later panics while validating that attribute for a confederation eBGP peer. A malformed UPDATE that should be rejected as an invalid AS_PATH reaches an unchecked p.Value[0] access, allowing a configured confederation eBGP peer to trigger a denial of service. Version 4.7.0 patches the issue.

GoBGP, a BGP implementation in Go, prior to version 4.6.0 has a BGP OPEN capability parsing issue where several capability decoders may read from the full remaining capability buffer instead of the slice bounded by the declared CapLen. A malformed BGP OPEN message can cause bytes from a following capability to be interpreted as part of the current one; the most security-relevant case is the 4-octet AS capability, where CapLen == 0 may cause the parser to read bytes from the following capability as the 4-octet AS value. This parsed value may later affect peer AS validation during BGP session establishment. Version 4.6.0 patches the issue.

An integer underflow in the BGPUpdate.DecodeFromBytes function (/bgp/bgp.go) of gobgp v4.3.0 allows attackers to cause a denial of service by sending a crafted BGP UPDATE message.

In version 4.4.0 of GoBGP, an unauthenticated remote BGP peer can trigger a fatal panic by sending a specially crafted BGP UPDATE message. This bug causes the entire GoBGP process to crash, resulting in a complete loss of service availability.

GoBGP, an open source implementation of the BGP protocol in Go, prior to version 4.3.0 has a remote Denial of Service (DoS) vulnerability. A malformed BGP UPDATE message can trigger a runtime error related to an index out of range.

In version 4.3.0 of GoBGP, an open source BGP implementation, a remote Denial of Service (DoS) vulnerability exists due to a nil pointer dereference. A malformed BGP UPDATE message containing an unrecognized Path Attribute marked as 'Well-known' leads to a process crash.

A vulnerability was found in osrg GoBGP up to 4.3.0 in the SRv6L3ServiceAttribute.DecodeFromBytes function of pkg/packet/bgp/prefix_sid.go (SRv6 L3 Service component). Manipulation of the data argument leads to denial of service, and the attack can be performed remotely. The fix is available in version 4.4.0 (commit f9f7b55ec258e514be0264871fa645a2c3edad11).