The vulnerability in GoBGP version 4.2.0 allows a remote attacker to cause a denial of service by manipulating the NEXT_HOP path attribute in BGP UPDATE messages. This flaw triggers resource exhaustion, disrupting normal routing operations and potentially rendering affected routers inoperative. The weakness is classified as a resource exhaustion vulnerability (CWE-400). The CVE description states the impact but does not explicitly describe the attack vector; it is inferred that the attacker would need to send a crafted BGP UPDATE containing a malformed NEXT_HOP attribute.

Affected systems are instances of the OSRG GoBGP distribution running exactly version 4.2.0. Any machine that accepts external BGP updates from peers not fully trusted is susceptible; no other GoBGP versions are known to be impacted.

The CVSS score of 7.5 indicates high severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. It is inferred that exploitation requires establishing a BGP session with the vulnerable daemon and sending a specifically crafted UPDATE message, which may be limited to environments that receive BGP traffic from untrusted sources. If exploited, the outage could affect network reachability for all routes processed by the affected instance.