CVE-2026-41642

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-41642", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-21T23:58:43.801Z", "datePublished": "2026-05-07T11:50:41.545Z", "dateUpdated": "2026-05-07T12:34:38.588Z"}, "containers": {"cna": {"title": "GoBGP: Remote Denial of Service (Panic) via Malformed Well-known Path Attribute", "problemTypes": [{"descriptions": [{"cweId": "CWE-476", "lang": "en", "description": "CWE-476: NULL Pointer Dereference", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/osrg/gobgp/security/advisories/GHSA-7235-89m6-f4px", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/osrg/gobgp/security/advisories/GHSA-7235-89m6-f4px"}, {"name": "https://github.com/osrg/gobgp/releases/tag/v4.4.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/osrg/gobgp/releases/tag/v4.4.0"}], "affected": [{"vendor": "osrg", "product": "gobgp", "versions": [{"version": "= 4.3.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-07T11:50:41.545Z"}, "descriptions": [{"lang": "en", "value": "GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. In version 4.3.0, a remote Denial of Service (DoS) vulnerability exists in GoBGP due to a nil pointer dereference. When a malformed BGP UPDATE message contains an unrecognized Path Attribute marked as \"Well-known,\" the daemon fails to interrupt the message handling flow. This results in an illegal memory access and a full process crash (panic). This issue has been patched in version 4.4.0."}], "source": {"advisory": "GHSA-7235-89m6-f4px", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/osrg/gobgp/security/advisories/GHSA-7235-89m6-f4px", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-07T12:32:55.282153Z", "id": "CVE-2026-41642", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-07T12:34:38.588Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-41642", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-07T12:32:55.282153Z"}}}], "references": [{"url": "https://github.com/osrg/gobgp/security/advisories/GHSA-7235-89m6-f4px", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-07T12:32:47.501Z"}}], "cna": {"title": "GoBGP: Remote Denial of Service (Panic) via Malformed Well-known Path Attribute", "source": {"advisory": "GHSA-7235-89m6-f4px", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "osrg", "product": "gobgp", "versions": [{"status": "affected", "version": "= 4.3.0"}]}], "references": [{"url": "https://github.com/osrg/gobgp/security/advisories/GHSA-7235-89m6-f4px", "name": "https://github.com/osrg/gobgp/security/advisories/GHSA-7235-89m6-f4px", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/osrg/gobgp/releases/tag/v4.4.0", "name": "https://github.com/osrg/gobgp/releases/tag/v4.4.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. In version 4.3.0, a remote Denial of Service (DoS) vulnerability exists in GoBGP due to a nil pointer dereference. When a malformed BGP UPDATE message contains an unrecognized Path Attribute marked as \"Well-known,\" the daemon fails to interrupt the message handling flow. This results in an illegal memory access and a full process crash (panic). This issue has been patched in version 4.4.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-476", "description": "CWE-476: NULL Pointer Dereference"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-07T11:50:41.545Z"}}}, "cveMetadata": {"cveId": "CVE-2026-41642", "state": "PUBLISHED", "dateUpdated": "2026-05-07T12:34:38.588Z", "dateReserved": "2026-04-21T23:58:43.801Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-05-07T11:50:41.545Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "gobgp", "vendor": "osrg", "versions": [{"status": "affected", "version": "= 4.3.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:osrg:gobgp:4.3.0:*:*:*:*:*:*:*", "matchCriteriaId": "21D99A4E-C785-427C-AB1C-3EE8B349E686", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. In version 4.3.0, a remote Denial of Service (DoS) vulnerability exists in GoBGP due to a nil pointer dereference. When a malformed BGP UPDATE message contains an unrecognized Path Attribute marked as \"Well-known,\" the daemon fails to interrupt the message handling flow. This results in an illegal memory access and a full process crash (panic). This issue has been patched in version 4.4.0."}, {"lang": "es", "value": "GoBGP es una implementaci\u00f3n de c\u00f3digo abierto del Border Gateway Protocol (BGP) en el lenguaje de programaci\u00f3n Go. En la versi\u00f3n 4.3.0, existe una vulnerabilidad remota de Denegaci\u00f3n de Servicio (DoS) en GoBGP debido a una desreferencia de puntero nulo. Cuando un mensaje BGP UPDATE malformado contiene un Atributo de Ruta no reconocido marcado como \u2019Well-known\u2019, el demonio no logra interrumpir el flujo de manejo de mensajes. Esto resulta en un acceso ilegal a la memoria y un fallo completo del proceso (panic). Este problema ha sido parcheado en la versi\u00f3n 4.4.0."}], "id": "CVE-2026-41642", "lastModified": "2026-10-26T22:10:00.163", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-41642", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-07T12:32:55.282153Z", "version": "2.0.3"}}]}, "published": "2026-05-07T12:16:17.460", "references": [{"source": "security-advisories@github.com", "tags": ["Patch", "Product"], "url": "https://github.com/osrg/gobgp/releases/tag/v4.4.0"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/osrg/gobgp/security/advisories/GHSA-7235-89m6-f4px"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/osrg/gobgp/security/advisories/GHSA-7235-89m6-f4px"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-476"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.3.0"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "gobgp", "source": "cna", "vendor": "osrg"}, "product": "gobgp", "vendor": "osrg"}], "created": "2026-05-07T15:00:13.966731+00:00", "updated": "2026-05-07T15:45:32.159987+00:00", "vendors": ["osrg", "osrg$PRODUCT$gobgp"]}