CVE-2026-41643

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-41643", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-21T23:58:43.802Z", "datePublished": "2026-05-07T11:53:23.566Z", "dateUpdated": "2026-05-07T13:39:04.425Z"}, "containers": {"cna": {"title": "GoBGP: Remote Denial of Service (Panic) in UpdatePathAttrs4ByteAs via Malformed BGP UPDATE", "problemTypes": [{"descriptions": [{"cweId": "CWE-129", "lang": "en", "description": "CWE-129: Improper Validation of Array Index", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/osrg/gobgp/security/advisories/GHSA-8rxh-r2p6-7f2q", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/osrg/gobgp/security/advisories/GHSA-8rxh-r2p6-7f2q"}, {"name": "https://github.com/osrg/gobgp/releases/tag/v4.3.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/osrg/gobgp/releases/tag/v4.3.0"}], "affected": [{"vendor": "osrg", "product": "gobgp", "versions": [{"version": "< 4.3.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-07T11:53:23.566Z"}, "descriptions": [{"lang": "en", "value": "GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. Prior to version 4.3.0, a remote Denial of Service (DoS) vulnerability exists in GoBGP where a malformed BGP UPDATE message can trigger a runtime error: index out of range panic. This occurs during the processing of 4-byte AS attributes when the message structure causes an internal slice index shift that is not properly handled. This issue has been patched in version 4.3.0."}], "source": {"advisory": "GHSA-8rxh-r2p6-7f2q", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/osrg/gobgp/security/advisories/GHSA-8rxh-r2p6-7f2q", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-07T13:38:29.253036Z", "id": "CVE-2026-41643", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-07T13:39:04.425Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-41643", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-07T13:38:29.253036Z"}}}], "references": [{"url": "https://github.com/osrg/gobgp/security/advisories/GHSA-8rxh-r2p6-7f2q", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-07T13:38:03.249Z"}}], "cna": {"title": "GoBGP: Remote Denial of Service (Panic) in UpdatePathAttrs4ByteAs via Malformed BGP UPDATE", "source": {"advisory": "GHSA-8rxh-r2p6-7f2q", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "osrg", "product": "gobgp", "versions": [{"status": "affected", "version": "< 4.3.0"}]}], "references": [{"url": "https://github.com/osrg/gobgp/security/advisories/GHSA-8rxh-r2p6-7f2q", "name": "https://github.com/osrg/gobgp/security/advisories/GHSA-8rxh-r2p6-7f2q", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/osrg/gobgp/releases/tag/v4.3.0", "name": "https://github.com/osrg/gobgp/releases/tag/v4.3.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. Prior to version 4.3.0, a remote Denial of Service (DoS) vulnerability exists in GoBGP where a malformed BGP UPDATE message can trigger a runtime error: index out of range panic. This occurs during the processing of 4-byte AS attributes when the message structure causes an internal slice index shift that is not properly handled. This issue has been patched in version 4.3.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-129", "description": "CWE-129: Improper Validation of Array Index"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-07T11:53:23.566Z"}}}, "cveMetadata": {"cveId": "CVE-2026-41643", "state": "PUBLISHED", "dateUpdated": "2026-05-07T13:39:04.425Z", "dateReserved": "2026-04-21T23:58:43.802Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-05-07T11:53:23.566Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "gobgp", "vendor": "osrg", "versions": [{"status": "affected", "version": "< 4.3.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:osrg:gobgp:*:*:*:*:*:*:*:*", "matchCriteriaId": "163FE6F5-1F81-4932-98B8-0A4847DF0133", "versionEndExcluding": "4.3.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. Prior to version 4.3.0, a remote Denial of Service (DoS) vulnerability exists in GoBGP where a malformed BGP UPDATE message can trigger a runtime error: index out of range panic. This occurs during the processing of 4-byte AS attributes when the message structure causes an internal slice index shift that is not properly handled. This issue has been patched in version 4.3.0."}, {"lang": "es", "value": "GoBGP es una implementaci\u00f3n de c\u00f3digo abierto del Protocolo de Pasarela Fronteriza (BGP) en el Lenguaje de Programaci\u00f3n Go. Antes de la versi\u00f3n 4.3.0, existe una vulnerabilidad remota de denegaci\u00f3n de servicio (DoS) en GoBGP donde un mensaje BGP UPDATE malformado puede desencadenar un error en tiempo de ejecuci\u00f3n: p\u00e1nico de \u00edndice fuera de rango. Esto ocurre durante el procesamiento de atributos AS de 4 bytes cuando la estructura del mensaje causa un desplazamiento interno del \u00edndice de la slice que no se maneja correctamente. Este problema ha sido parcheado en la versi\u00f3n 4.3.0."}], "id": "CVE-2026-41643", "lastModified": "2026-10-26T21:10:00.170", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-41643", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-07T13:38:29.253036Z", "version": "2.0.3"}}]}, "published": "2026-05-07T12:16:17.623", "references": [{"source": "security-advisories@github.com", "tags": ["Patch", "Release Notes"], "url": "https://github.com/osrg/gobgp/releases/tag/v4.3.0"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/osrg/gobgp/security/advisories/GHSA-8rxh-r2p6-7f2q"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/osrg/gobgp/security/advisories/GHSA-8rxh-r2p6-7f2q"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-129"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,4.3.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "gobgp", "source": "cna", "vendor": "osrg"}, "product": "gobgp", "vendor": "osrg"}], "created": "2026-05-07T15:00:12.843716+00:00", "updated": "2026-05-07T15:00:13.965833+00:00", "vendors": ["osrg", "osrg$PRODUCT$gobgp"]}