Vulnerability GHSA-4p9m-8gc4-rw2h
High Risk
HIGH RISK
CVSS Score: 7.5
Score Range: 7.0–8.9
High severity vulnerabilities (CVSS 7.0–8.9). Serious vulnerabilities that should be prioritized soon after critical fixes.
6 months ago
March 16, 2026 at 06:32 PM UTC
GoBGP vulnerable to a denial of service via the NEXT_HOP path attribute
v4.0.0 - v4.3.0
v4.0.0 - v4.3.0
Summary
GoBGP vulnerable to a denial of service via the NEXT_HOP path attribute
Details
An issue in GoBGP gobgpd v.4.2.0 allows a remote attacker to cause a denial of service via the NEXT_HOP path attribute.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Unknown
2 months ago
GoBGP: Remote Denial of Service (Panic) via Malformed Well-known Path Attribute in github.com/osrg/gobgp
v4.3.0 GO-2026-5198
v4.3.0 GO-2026-5198
Unknown
2 months ago
GoBGP: Remote Denial of Service (Panic) in UpdatePathAttrs4ByteAs via Malformed BGP UPDATE in github.com/osrg/gobgp
v4.0.0 - v4.2.0 GO-2026-5266
v4.0.0 - v4.2.0 GO-2026-5266
Unknown
2 months ago
GoBGP has a panic in AdjRib.Update via malformed BGP Update message (Nil Pointer Dereference) in github.com/osrg/gobgp
v4.4.0 GO-2026-5525
v4.4.0 GO-2026-5525
Unknown
2 months ago
GoBGP confederation validation panics on empty AS_PATH attribute in github.com/osrg/gobgp
v4.0.0 - v4.6.0 GO-2026-5954
v4.0.0 - v4.6.0 GO-2026-5954
Unknown
2 months ago
GoBGP: BGP OPEN capability parser may read capability values outside declared CapLen boundaries in github.com/osrg/gobgp
v4.0.0 - v4.5.0 GO-2026-5955
v4.0.0 - v4.5.0 GO-2026-5955
Impacted packages
Timeline
Published
6 months ago
March 16, 2026 at 06:32 PM UTC
Last Modified
10 hours ago
October 02, 2026 at 11:00 PM UTC