An integer underflow occurs in the BGPUpdate.DecodeFromBytes function of gobgp v4.3.0 when parsing a BGP UPDATE message. The underflow causes a failure in processing the packet, which leads to a crash or unresponsiveness of the gobgp daemon, resulting in a denial of service that can disrupt BGP routing functionality.

This vulnerability affects any deployment running gobgp version 4.3.0 that processes BGP UPDATE messages. Users should verify whether this exact version is used in their environment and whether the instance participates in BGP sessions. Newer releases are not known to be affected.

The EPSS score is <1% and the vulnerability is not listed in the CISA KEV catalog, indicating no publicly known exploits at the time of this analysis. The likely attack vector is an attacker who can send a crafted BGP UPDATE message to the gobgp instance, such as through a faulty BGP peer or a compromised session. The integer underflow condition is present in the decoding path and can be triggered by malformed input, making exploitation straightforward for a determined attacker. The CVSS score of 7.5 indicates a high‑severity vulnerability, and the impact of a DoS on BGP routing is significant.