CVE-2026-30405 Details
Description
An issue in GoBGP gobgpd v.4.2.0 allows a remote attacker to cause a denial of service via the NEXT_HOP path attribute
A denial-of-service vulnerability exists in GoBGP version 4.2.0, where a remote attacker can cause the application to panic by sending a malformed BGP UPDATE message. The issue arises when the NEXT_HOP path attribute has an invalid length of less than 4 bytes, which is not compliant with the BGP specification. This malformed attribute is partially processed, leading to misaligned parsing and out-of-bounds access during validation, causing GoBGP to crash.
Users can upgrade to GoBGP version 4.3.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 17, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/osrg/gobgp/issues/3305 | [email protected] | ExploitIssue TrackingVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-400 | Uncontrolled Resource Consumption | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| osrg gobgp | 4.2.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 7, 2026 | Initial Analysis | [email protected] |
| Mar 17, 2026 | CVE Modified | CISA-ADP |
| Mar 16, 2026 | New CVE Received | [email protected] |