GoBGP, an open source Border Gateway Protocol implementation, is vulnerable to a remote denial‑of‑service condition caused by an index out of range panic when parsing malformed BGP UPDATE messages that contain 4‑byte AS attributes. The panic results from an internal slice index error, leading to a process crash and outage. This weakness is classified as CWE‑129 and was rectified in the 4.3.0 release.

The affected product is GoBGP from osrg. Versions prior to 4.3.0 have not applied the fix and are susceptible. The latest 4.3.0 version includes the necessary patch.

The CVSS score is 7.5 and no EPSS value is available, indicating a moderate‑to‑high severity but uncertain exploitation likelihood. The vulnerability is not listed in CISA KEV. Likely attackers would need to send a crafted BGP UPDATE message from an untrusted peer, requiring that a BGP session is already established. A successful exploitation would crash the GoBGP process, resulting in loss of routing service. No public exploits have been reported at this time.