Osrg Gobgp vulnerabilities

• osrg gobgp GoBGP confederation validation panics on empty AS_PATH attribute CVE-2026-49838 Fix available 5.9 MediumJuly 9, 2026
• osrg gobgp GoBGP: BGP OPEN capability parser may read capability values outside declared CapLen boundaries CVE-2026-49837 Fix available 5.9 MediumJuly 9, 2026
• osrg gobgp GoBGP: Panic in AdjRib.Update via malformed BGP Update message (Nil Pointer Dereference) CVE-2026-42285 Fix available 7.5 HighMay 5, 2026
• osrg gobgp osrg GoBGP BMP Parser bmp.go BMPStatisticsReport.ParseBody out-of-bounds CVE-2026-7737 Fix available 6.9 MediumMay 4, 2026
• osrg gobgp osrg GoBGP mrt.go parseRibEntry integer underflow CVE-2026-7736 Fix available 6.9 MediumMay 4, 2026
• osrg gobgp osrg GoBGP AIGP Attribute bgp.go PathAttributeAigp.DecodeFromBytes buffer overflow CVE-2026-7735 Fix available 6.9 MediumMay 4, 2026
• osrg gobgp osrg GoBGP SRv6 L3 Service prefix_sid.go SRv6L3ServiceAttribute.DecodeFromBytes denial of service CVE-2026-7734 Fix available 6.9 MediumMay 4, 2026
• osrg gobgp GoBGP has an out-of-bounds read in the ParseIP6Extended function CVE-2026-37461 Fix available 7.5 HighMay 4, 2026
• osrg gobgp GoBGP: Remote Denial of Service (Panic) in UpdatePathAttrs4ByteAs via Malformed BGP UPDATE CVE-2026-41643 Fix available 7.5 HighApril 29, 2026
• osrg gobgp GoBGP: Remote Denial of Service (Panic) via Malformed Well-known Path Attribute CVE-2026-41642 Fix available 7.5 HighApril 29, 2026
• osrg gobgp osrg GoBGP BGP Header bgp.go BGPHeader.DecodeFromBytes access control CVE-2026-5124 Fix available 6.3 MediumMarch 30, 2026
• osrg gobgp osrg GoBGP bgp.go DecodeFromBytes off-by-one CVE-2026-5123 Fix available 6.3 MediumMarch 30, 2026
• osrg gobgp osrg GoBGP BGP OPEN Message bgp.go DecodeFromBytes access control CVE-2026-5122 Fix available 6.3 MediumMarch 30, 2026
• osrg gobgp GoBGP vulnerable to a denial of service via the NEXT_HOP path attribute CVE-2026-30405 Fix available 7.5 HighMarch 16, 2026
• osrg gobgp osrg GoBGP rtr.go SplitRTR out-of-bounds CVE-2025-7464 Fix available 6.3 MediumJuly 12, 2025
• gobgp GoBGP does not verify that the input length CVE-2025-43973 Fix available 6.8 MediumApril 21, 2025
• gobgp GoBGP crashes in the flowspec parser CVE-2025-43972 Fix available 6.8 MediumApril 21, 2025
• gobgp GoBGP panics due to a zero value for softwareVersionLen CVE-2025-43971 Fix available 8.6 HighApril 21, 2025
• gobgp GoBGP does not properly check the input length CVE-2025-43970 Fix available 4.3 MediumApril 21, 2025
• osrg gobgp Buffer Overflow vulnerability in osrg gobgp CVE-2023-46565 Fix available 7.5 HighApril 29, 2024