This vulnerability allows a remote attacker to cause a denial of service in the GoBGP gobgpd daemon by sending a BGP update that contains a malicious NEXT_HOP path attribute. The flaw stems from improper handling of this attribute, which can lead to resource exhaustion or a crash when the attribute is processed. The impact is loss of BGP routing service for the affected router, potentially disrupting network connectivity and availability for any networks that rely on it. The weakness is identified as CWE-400, Denial of Service.

The affected product is the GoBGP gobgpd daemon, version 4.2.0. No other vendors or products are listed in the data. The vendor is not specified.

The CVSS score of 7.5 indicates high severity, while the EPSS score of less than 1% and the absence from the CISA KEV catalog suggest a low likelihood of widespread exploitation at present. The attack vector is inferred to be remote, requiring an attacker to be able to send a crafted BGP update to the target router. No additional prerequisite conditions are stated in the description, so the risk assessment relies on the provided severity metrics and the inferred remote nature of the exploit.