Read the docs
TI-2026-30162 Aliases CVE-2026-41643GHSA-8rxh-r2p6-7f2q

GoBGP: Remote Denial of Service (Panic) in UpdatePathAttrs4ByteAs via Malformed BGP UPDATE

Priority HIGH 72CWE-129Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-129 and the CVSS impact.

Summary

GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. Prior to version 4.3.0, a remote Denial of Service (DoS) vulnerability exists in GoBGP where a malformed BGP UPDATE message can trigger a runtime error: index out of range panic. This occurs during the processing of 4-byte AS attributes when the message structure causes an internal slice index shift that is not properly handled. This issue has been patched in version 4.3.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00542 45th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed gobgp (osrg): 4.3.0github.com/osrg/gobgp/v4 (Go): 4.3.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
osrggobgpbefore 4.3.04.3.0Patch availableCNA
—github.com/osrg/gobgp/v4 (Go)before 4.3.04.3.0Patch availableGHSA-8rxh-r2p6-7f2q
  • gobgp Vendorosrg Affected before 4.3.0 Fixed in 4.3.0 Patch available CNA
  • github.com/osrg/gobgp/v4 (Go) Vendor— Affected before 4.3.0 Fixed in 4.3.0 Patch available GHSA-8rxh-r2p6-7f2q

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:osrg:gobgp:*:*:*:*:*:*:*:*before 4.3.0Vulnerableosrg
  • cpe:2.3:a:osrg:gobgp:*:*:*:*:*:*:*:* Versions before 4.3.0 Vulnerable ·osrg

Remediation

  • Fix · CNA gobgp (osrg) Fixed in 4.3.0
  • Fix · GHSA-8rxh-r2p6-7f2q github.com/osrg/gobgp/v4 (Go) Fixed in 4.3.0 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat OpenShift Container Platform 4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-41643
  2. 2026-10-03 Alias added: GHSA-8rxh-r2p6-7f2q

References

Exploit 1

Patch 1

Advisory 1

Other 1

  • TI-2026-30596 GoBGP: Panic in AdjRib.Update via malformed BGP Update message (Nil Pointer Dereference) CVSS 3.1HIGH 7.5
  • TI-2026-30161 GoBGP: Remote Denial of Service (Panic) via Malformed Well-known Path Attribute CVSS 3.1HIGH 7.5
  • TI-2026-23526 An issue in GoBGP gobgpd v.4.2.0 allows a remote attacker to cause a denial of service via the NEXT_HOP path attribute CVSS 3.1HIGH 7.5
  • TI-2025-28529 An issue was discovered in GoBGP before 3.35.0. CVSS 3.1HIGH 8.6
  • TI-2025-28531 An issue was discovered in GoBGP before 3.35.0. CVSS 3.1CRITICAL 9.8
  • TI-2026-28050 An out-of-bounds read in the ParseIP6Extended function (/bgp/bgp.go) of gobgp v4.3.0… CVSS 3.1HIGH 7.5
See all 15 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences