Description
GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. In version 4.4.0, an unauthenticated remote BGP peer can trigger a fatal panic in GoBGP by sending a specially crafted BGP UPDATE message. When the server receives a message with inconsistent attribute lengths, it improperly handles the internal state transition to a "withdraw" action, leading to a nil pointer dereference in the AdjRib.Update function. This causes the entire GoBGP process to crash, resulting in a complete loss of service availability. This issue has been patched in version 4.5.0.
Published: 2026-05-07
Score: 7.5 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A crafted BGP UPDATE message with incorrect attribute lengths causes GoBGP, an open‐source BGP implementation, to panic inside AdjRib.Update. The resulting nil pointer dereference makes the entire GoBGP process crash. This error manifests as a complete loss of service availability for the affected router. The flaw is a classic null pointer dereference (CWE‑476).

Affected Systems

The vulnerability affects Open Source Routing Group’s GoBGP 4.4.0. Versions 4.5.0 and newer contain the fix. No other releases are known to be impacted.

Risk and Exploitability

The flaw is exploitable by any unauthenticated remote BGP peer. A CVSS score of 7.5 indicates high severity, and the EPSS score is not yet available, so detection of attacks is uncertain. The vulnerability is not listed in the CISA KEV catalog, but its high availability impact warrants urgent attention. Attackers would simply send a malicious UPDATE to trigger a crash without needing prior authentication or special privileges.

Generated by OpenCVE AI on May 7, 2026 at 14:59 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade GoBGP to version 4.5.0 or later, which contains the proper bounds checking for UPDATE attributes.
  • If an upgrade cannot be performed immediately, block or filter BGP UPDATE traffic from untrusted peers using firewall or router ACL rules.
  • Enforce BGP session authentication (MD5 or TCP MD5) so that only authenticated peers can exchange UPDATE messages, reducing the window for exploitation.
  • Enable logging and monitor for abnormal BGP UPDATE message patterns and high-frequency process restarts to detect ongoing attempts.

Generated by OpenCVE AI on May 7, 2026 at 14:59 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-p3w2-64xm-833j GoBGP has a panic in AdjRib.Update via malformed BGP Update message (Nil Pointer Dereference)
History

Thu, 07 May 2026 15:00:00 +0000

Type Values Removed Values Added
First Time appeared Osrg
Osrg gobgp
Vendors & Products Osrg
Osrg gobgp

Thu, 07 May 2026 14:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 07 May 2026 12:15:00 +0000

Type Values Removed Values Added
Description GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. In version 4.4.0, an unauthenticated remote BGP peer can trigger a fatal panic in GoBGP by sending a specially crafted BGP UPDATE message. When the server receives a message with inconsistent attribute lengths, it improperly handles the internal state transition to a "withdraw" action, leading to a nil pointer dereference in the AdjRib.Update function. This causes the entire GoBGP process to crash, resulting in a complete loss of service availability. This issue has been patched in version 4.5.0.
Title GoBGP: Panic in AdjRib.Update via malformed BGP Update message (Nil Pointer Dereference)
Weaknesses CWE-476
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Osrg Gobgp
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-05-07T13:04:56.019Z

Reserved: 2026-04-26T12:13:55.551Z

Link: CVE-2026-42285

cve-icon Vulnrichment

Updated: 2026-05-07T13:04:50.300Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-05-07T12:16:18.180

Modified: 2026-05-07T15:06:11.573

Link: CVE-2026-42285

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-05-07T15:00:13Z

Weaknesses