GoBGP vulnerabilities
5 known CVE vulnerabilities in GoBGP, translated and rated.
- CVE-2026-42285High
In version 4.4.0 of GoBGP, an unauthenticated remote BGP peer can trigger a fatal panic by sending a specially crafted BGP UPDATE message. This bug causes the entire GoBGP process to crash, resulting in a complete loss of service availability.
- CVE-2026-41643High
GoBGP, an open source implementation of the BGP protocol in Go, prior to version 4.3.0 has a remote Denial of Service (DoS) vulnerability. A malformed BGP UPDATE message can trigger a runtime error related to an index out of range.
- CVE-2026-41642High
In version 4.3.0 of GoBGP, an open source BGP implementation, a remote Denial of Service (DoS) vulnerability exists due to a nil pointer dereference. A malformed BGP UPDATE message containing an unrecognized Path Attribute marked as 'Well-known' leads to a process crash.
- CVE-2026-37461High
An out-of-bounds read in the ParseIP6Extended function in gobgp v4.3.0 allows attackers to cause a Denial of Service (DoS) by supplying a crafted BGP UPDATE message.
- CVE-2026-37462High
An integer underflow in the BGPUpdate.DecodeFromBytes function (/bgp/bgp.go) of gobgp v4.3.0 allows attackers to cause a denial of service by sending a crafted BGP UPDATE message.