Vulnerabilities

TI-2026-36742 CVE-2026-49838 · GHSA-frrj-87jh-2772

GoBGP confederation validation panics on empty AS_PATH attribute

LOW 27

GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00412 Published 2026-09-10 Partial fix · 4.7.0 CWE-129

TI-2026-36741 CVE-2026-49837 · GHSA-gjrg-jjr3-56cm

GoBGP: BGP OPEN capability parser may read capability values outside declared CapLen boundaries

LOW 26

GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00332 Published 2026-09-10 Fixed in 4.6.0 CWE-125

TI-2026-30162 CVE-2026-41643 · GHSA-8rxh-r2p6-7f2q

GoBGP: Remote Denial of Service (Panic) in UpdatePathAttrs4ByteAs via Malformed BGP UPDATE

HIGH 72

GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00542 Published 2026-05-07 Fixed in 4.3.0 CWE-129

TI-2026-30596 CVE-2026-42285 · GHSA-p3w2-64xm-833j

GoBGP: Panic in AdjRib.Update via malformed BGP Update message (Nil Pointer Dereference)

HIGH 72

GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00418 Published 2026-05-07 Fixed in 4.5.0 CWE-476

TI-2026-30161 CVE-2026-41642 · GHSA-7235-89m6-f4px

GoBGP: Remote Denial of Service (Panic) via Malformed Well-known Path Attribute

HIGH 72

GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00503 Published 2026-05-07 Fixed in 4.4.0 CWE-476

TI-2026-06819 CVE-2026-7737 · GHSA-w88c-9vg8-cmq8

osrg GoBGP BMP Parser bmp.go BMPStatisticsReport.ParseBody out-of-bounds

LOW 37

A vulnerability was identified in osrg GoBGP up to 4.3.0.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00631 Published 2026-05-04 Fixed in 4.4.0 CWE-119

TI-2026-06818 CVE-2026-7736 · GHSA-hj4w-qr9j-c4cf

osrg GoBGP mrt.go parseRibEntry integer underflow

LOW 37

A vulnerability was determined in osrg GoBGP up to 4.3.0.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00454 Published 2026-05-04 Fixed in 4.4.0 CWE-189

TI-2026-06817 CVE-2026-7735 · GHSA-5jvq-55xj-6qff

osrg GoBGP AIGP Attribute bgp.go PathAttributeAigp.DecodeFromBytes buffer overflow

LOW 36

A vulnerability was found in osrg GoBGP up to 4.3.0.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00361 Published 2026-05-04 Fixed in 4.4.0 CWE-119

TI-2026-06816 CVE-2026-7734 · GHSA-vm3g-8xwv-mxfp

osrg GoBGP SRv6 L3 Service prefix_sid.go SRv6L3ServiceAttribute.DecodeFromBytes denial of service

LOW 37

A vulnerability has been found in osrg GoBGP up to 4.3.0.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00464 Published 2026-05-04 Fixed in 4.4.0 CWE-404

TI-2026-28050 CVE-2026-37461 · GHSA-wmvj-f67g-qg4g

An out-of-bounds read in the ParseIP6Extended function (/bgp/bgp.go) of gobgp v4.3.0…

LOW 39

An out-of-bounds read in the ParseIP6Extended function (/bgp/bgp.go) of gobgp v4.3.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted BGP UPDATE message.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00335 Published 2026-05-04 Fixed in 4.4.0 CWE-125

TI-2026-04474 CVE-2026-5124 · GHSA-688c-h9c2-ffwg

osrg GoBGP BGP Header bgp.go BGPHeader.DecodeFromBytes access control

LOW 28

A security vulnerability has been detected in osrg GoBGP up to 4.3.0.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00298 Published 2026-03-30 No fix listed CWE-266

TI-2026-04473 CVE-2026-5123 · GHSA-m763-9mqf-95rq

osrg GoBGP bgp.go DecodeFromBytes off-by-one

LOW 28

A weakness has been identified in osrg GoBGP up to 4.3.0.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00425 Published 2026-03-30 No fix listed CWE-189

TI-2026-04472 CVE-2026-5122 · GHSA-vj73-h4qp-97x2

osrg GoBGP BGP OPEN Message bgp.go DecodeFromBytes access control

LOW 28

A security flaw has been discovered in osrg GoBGP up to 4.3.0.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00298 Published 2026-03-30 No fix listed CWE-266

TI-2026-23526 CVE-2026-30405 · GHSA-4p9m-8gc4-rw2h

An issue in GoBGP gobgpd v.4.2.0 allows a remote attacker to cause a denial of service via the NEXT_HOP path attribute

HIGH 72

An issue in GoBGP gobgpd v.4.2.0 allows a remote attacker to cause a denial of service via the NEXT_HOP path attribute

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00354 Published 2026-03-16 Fixed in 4.4.0 CWE-400

TI-2025-06802 CVE-2025-7464 · GHSA-vwjp-r23f-3f37

osrg GoBGP rtr.go SplitRTR out-of-bounds

LOW 29

A vulnerability classified as problematic has been found in osrg GoBGP up to 3.37.0.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00482 Published 2025-07-12 No fix listed CWE-119

TI-2025-28531 CVE-2025-43973 · GHSA-c5jg-wr5v-2wp2

An issue was discovered in GoBGP before 3.35.0.

MEDIUM 43

An issue was discovered in GoBGP before 3.35.0.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00573 Published 2025-04-21 Fixed in 3.35.0 CWE-193

TI-2025-28530 CVE-2025-43972 · GHSA-mfvv-mgf6-q25r

An issue was discovered in GoBGP before 3.35.0.

LOW 34

An issue was discovered in GoBGP before 3.35.0.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00559 Published 2025-04-21 Fixed in 3.35.0 CWE-1284

TI-2025-28529 CVE-2025-43971 · GHSA-7m35-vw2c-696v

An issue was discovered in GoBGP before 3.35.0.

MEDIUM 44

An issue was discovered in GoBGP before 3.35.0.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00554 Published 2025-04-21 Fixed in 3.35.0 CWE-193

TI-2025-28528 CVE-2025-43970 · GHSA-hqhq-hp5x-xp3w

An issue was discovered in GoBGP before 3.35.0.

LOW 24

An issue was discovered in GoBGP before 3.35.0.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.0043 Published 2025-04-21 Fixed in 3.35.0 CWE-1284

Vulnerabilities

Filters