An out‑of‑bounds read occurs in the ParseIP6Extended function of gobgp version 4.3.0. This flaw allows a malicious actor to trigger a crash by sending a specially crafted BGP UPDATE message. The primary impact is a loss of availability for the affected BGP process, potentially causing routing instability or outages in connected networks. The weakness is classified as an out‑of‑bounds read, corresponding to CWE‑125.

Any deployment of the gobgp BGP implementation running version 4.3.0 is susceptible. The vulnerability was identified in the GitHub repository and linked commits that modify the ParseIP6Extended routine. Users of older or patched versions are not impacted.

The vulnerability is exploitable over the network by an attacker who can send BGP UPDATE messages to the gobgp instance. Because it causes a crash rather than privileged code execution, the risk is limited to service disruption. No publicly known exploits exist at the time of this analysis, and the EPSS score is <1%, indicating a low but non‑zero exploitation probability. The CVSS score is 7.5, underscoring a moderate‑high impact risk.