A bug in the GoBGP router software allows an attacker to send a crafted SRv6 L3 Service attribute that causes the DecodeFromBytes function to hang, leading to a denial of service of the BGP daemon. The vulnerability is triggered by malformed prefix_sid data and results in the process becoming unresponsive, creating a potential interruption to routing services. This flaw maps to CWE‑404, indicating an improper shutdown or release of resources.

The issue affects osrg’s GoBGP implementation in versions up to and including 4.3.0. The affected component is the SRv6 L3 Service module, specifically the DecodeFromBytes routine in pkg/packet/bgp/prefix_sid.go. The vulnerability was resolved in GoBGP 4.4.0, which incorporates the patch identified by commit f9f7b55ec258e514be0264871fa645a2c3edad11.

The CVSS vector for this flaw is 6.9, placing it in the moderate risk category. Because the description states “The attack may be performed from remote,” it is reasonable to infer a remote attack vector, though no mention of local privilege escalation or authentication is made. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. Consequently, while the likelihood of exploitation is uncertain, the potential impact of service disruption justifies prompt remediation.