CVE-2026-41642

GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. In version 4.3.0, a remote Denial of Service (DoS) vulnerability exists in GoBGP due to a nil pointer dereference. When a malformed BGP UPDATE message contains an unrecognized Path Attribute marked as "Well-known," the daemon fails to interrupt the message handling flow. This results in an illegal memory access and a full process crash (panic). This issue has been patched in version 4.4.0.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/osrg/gobgp/releases/tag/v4.4.0	Patch Product
https://github.com/osrg/gobgp/security/advisories/GHSA-7235-89m6-f4px	Exploit Vendor Advisory
https://github.com/osrg/gobgp/security/advisories/GHSA-7235-89m6-f4px	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:osrg:gobgp:4.3.0:*:*:*:*:*:*:*

History

26 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) GoBGP es una implementación de código abierto del Border Gateway Protocol (BGP) en el lenguaje de programación Go. En la versión 4.3.0, existe una vulnerabilidad remota de Denegación de Servicio (DoS) en GoBGP debido a una desreferencia de puntero nulo. Cuando un mensaje BGP UPDATE malformado contiene un Atributo de Ruta no reconocido marcado como ’Well-known’, el demonio no logra interrumpir el flujo de manejo de mensajes. Esto resulta en un acceso ilegal a la memoria y un fallo completo del proceso (panic). Este problema ha sido parcheado en la versión 4.4.0.

Information

Published : 2026-05-07 12:16

Updated : 2026-10-26 22:10

NVD link : CVE-2026-41642

Mitre link : CVE-2026-41642

CVE.ORG link : CVE-2026-41642

JSON object : View

Products Affected

osrg

gobgp

CWE

CWE-476

NULL Pointer Dereference

{"id": "CVE-2026-41642", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-41642", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-07T12:32:55.282153Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "osrg", "product": "gobgp", "versions": [{"status": "affected", "version": "= 4.3.0"}]}]}], "published": "2026-05-07T12:16:17.460", "references": [{"url": "https://github.com/osrg/gobgp/releases/tag/v4.4.0", "tags": ["Patch", "Product"], "source": "security-advisories@github.com"}, {"url": "https://github.com/osrg/gobgp/security/advisories/GHSA-7235-89m6-f4px", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/osrg/gobgp/security/advisories/GHSA-7235-89m6-f4px", "tags": ["Exploit", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-476"}]}], "descriptions": [{"lang": "en", "value": "GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. In version 4.3.0, a remote Denial of Service (DoS) vulnerability exists in GoBGP due to a nil pointer dereference. When a malformed BGP UPDATE message contains an unrecognized Path Attribute marked as \"Well-known,\" the daemon fails to interrupt the message handling flow. This results in an illegal memory access and a full process crash (panic). This issue has been patched in version 4.4.0."}, {"lang": "es", "value": "GoBGP es una implementaci\u00f3n de c\u00f3digo abierto del Border Gateway Protocol (BGP) en el lenguaje de programaci\u00f3n Go. En la versi\u00f3n 4.3.0, existe una vulnerabilidad remota de Denegaci\u00f3n de Servicio (DoS) en GoBGP debido a una desreferencia de puntero nulo. Cuando un mensaje BGP UPDATE malformado contiene un Atributo de Ruta no reconocido marcado como \u2019Well-known\u2019, el demonio no logra interrumpir el flujo de manejo de mensajes. Esto resulta en un acceso ilegal a la memoria y un fallo completo del proceso (panic). Este problema ha sido parcheado en la versi\u00f3n 4.4.0."}], "lastModified": "2026-10-26T22:10:00.163", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:osrg:gobgp:4.3.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "21D99A4E-C785-427C-AB1C-3EE8B349E686"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}