CVE-2026-41643 Details
Description
GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. Prior to version 4.3.0, a remote Denial of Service (DoS) vulnerability exists in GoBGP where a malformed BGP UPDATE message can trigger a runtime error: index out of range panic. This occurs during the processing of 4-byte AS attributes when the message structure causes an internal slice index shift that is not properly handled. This issue has been patched in version 4.3.0.
A remote denial-of-service vulnerability has been identified in GoBGP, an open-source Border Gateway Protocol implementation in the Go programming language. This vulnerability exists in versions of GoBGP prior to 4.3.0. The issue arises when a malformed BGP UPDATE message is processed, particularly one that includes 4-byte AS attributes. The message structure can cause an internal slice index shift that is not properly managed, leading to a runtime error and a panic. This vulnerability has been patched in GoBGP version 4.3.0.
Users can upgrade to GoBGP version 4.3.0, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 7, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/osrg/gobgp/security/advisories/GHSA-8rxh-r2p6-7f2q | CISA-ADP | ExploitVendor Advisory |
| https://github.com/osrg/gobgp/releases/tag/v4.3.0 | [email protected] | PatchRelease Notes |
| https://github.com/osrg/gobgp/security/advisories/GHSA-8rxh-r2p6-7f2q | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-129 | Improper Validation of Array Index | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| osrg gobgp | < 4.3.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 7, 2026 | Initial Analysis | [email protected] |
| May 7, 2026 | CVE Modified | CISA-ADP |
| May 7, 2026 | New CVE Received | [email protected] |