CVE-2026-41643 - Vulnerability Analysis

Overview

GoBGP < 4.3.0 contains a denial of service caused by improper handling of malformed BGP UPDATE messages with 4-byte AS attributes, letting remote attackers trigger runtime panic, exploit requires sending crafted BGP UPDATE messages.

Severity & Score

Impact

Remote attackers can cause a denial of service by triggering a runtime panic, disrupting BGP service availability.

Mitigation

Update to version 4.3.0 or later.

References

• https://github.com/osrg/gobgp/releases/tag/v4.3.0
• https://github.com/osrg/gobgp/security/advisories/GHSA-8rxh-r2p6-7f2q

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner