CVE-2026-42285 Details
Description
GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. In version 4.4.0, an unauthenticated remote BGP peer can trigger a fatal panic in GoBGP by sending a specially crafted BGP UPDATE message. When the server receives a message with inconsistent attribute lengths, it improperly handles the internal state transition to a "withdraw" action, leading to a nil pointer dereference in the AdjRib.Update function. This causes the entire GoBGP process to crash, resulting in a complete loss of service availability. This issue has been patched in version 4.5.0.
A remote denial-of-service vulnerability has been identified in GoBGP version 4.4.0. An unauthenticated remote BGP peer can cause a fatal panic by sending a specially crafted BGP UPDATE message with inconsistent attribute lengths. This malformed message disrupts the internal state management, causing a nil pointer dereference in the AdjRib.Update function. As a result, the entire GoBGP process crashes, leading to a complete loss of service availability.
Users can upgrade to GoBGP version 4.5.0, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 7, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/osrg/gobgp/security/advisories/GHSA-p3w2-64xm-833j | CISA-ADP | ExploitVendor Advisory |
| https://github.com/osrg/gobgp/releases/tag/v4.5.0 | [email protected] | ProductRelease Notes |
| https://github.com/osrg/gobgp/security/advisories/GHSA-p3w2-64xm-833j | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-476 | NULL Pointer Dereference | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| osrg gobgp | 4.4.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 11, 2026 | Initial Analysis | [email protected] |
| May 7, 2026 | CVE Modified | CISA-ADP |
| May 7, 2026 | New CVE Received | [email protected] |