CVE-2026-42285

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-42285", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-26T12:13:55.551Z", "datePublished": "2026-05-07T11:53:14.498Z", "dateUpdated": "2026-05-07T13:04:56.019Z"}, "containers": {"cna": {"title": "GoBGP: Panic in AdjRib.Update via malformed BGP Update message (Nil Pointer Dereference)", "problemTypes": [{"descriptions": [{"cweId": "CWE-476", "lang": "en", "description": "CWE-476: NULL Pointer Dereference", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/osrg/gobgp/security/advisories/GHSA-p3w2-64xm-833j", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/osrg/gobgp/security/advisories/GHSA-p3w2-64xm-833j"}, {"name": "https://github.com/osrg/gobgp/releases/tag/v4.5.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/osrg/gobgp/releases/tag/v4.5.0"}], "affected": [{"vendor": "osrg", "product": "gobgp", "versions": [{"version": "= 4.4.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-07T11:53:14.498Z"}, "descriptions": [{"lang": "en", "value": "GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. In version 4.4.0, an unauthenticated remote BGP peer can trigger a fatal panic in GoBGP by sending a specially crafted BGP UPDATE message. When the server receives a message with inconsistent attribute lengths, it improperly handles the internal state transition to a \"withdraw\" action, leading to a nil pointer dereference in the AdjRib.Update function. This causes the entire GoBGP process to crash, resulting in a complete loss of service availability. This issue has been patched in version 4.5.0."}], "source": {"advisory": "GHSA-p3w2-64xm-833j", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/osrg/gobgp/security/advisories/GHSA-p3w2-64xm-833j", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-07T13:04:33.585849Z", "id": "CVE-2026-42285", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-07T13:04:56.019Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-42285", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-07T13:04:33.585849Z"}}}], "references": [{"url": "https://github.com/osrg/gobgp/security/advisories/GHSA-p3w2-64xm-833j", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-07T13:04:50.300Z"}}], "cna": {"title": "GoBGP: Panic in AdjRib.Update via malformed BGP Update message (Nil Pointer Dereference)", "source": {"advisory": "GHSA-p3w2-64xm-833j", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "osrg", "product": "gobgp", "versions": [{"status": "affected", "version": "= 4.4.0"}]}], "references": [{"url": "https://github.com/osrg/gobgp/security/advisories/GHSA-p3w2-64xm-833j", "name": "https://github.com/osrg/gobgp/security/advisories/GHSA-p3w2-64xm-833j", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/osrg/gobgp/releases/tag/v4.5.0", "name": "https://github.com/osrg/gobgp/releases/tag/v4.5.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. In version 4.4.0, an unauthenticated remote BGP peer can trigger a fatal panic in GoBGP by sending a specially crafted BGP UPDATE message. When the server receives a message with inconsistent attribute lengths, it improperly handles the internal state transition to a \"withdraw\" action, leading to a nil pointer dereference in the AdjRib.Update function. This causes the entire GoBGP process to crash, resulting in a complete loss of service availability. This issue has been patched in version 4.5.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-476", "description": "CWE-476: NULL Pointer Dereference"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-07T11:53:14.498Z"}}}, "cveMetadata": {"cveId": "CVE-2026-42285", "state": "PUBLISHED", "dateUpdated": "2026-05-07T13:04:56.019Z", "dateReserved": "2026-04-26T12:13:55.551Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-05-07T11:53:14.498Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "gobgp", "vendor": "osrg", "versions": [{"status": "affected", "version": "= 4.4.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:osrg:gobgp:4.4.0:*:*:*:*:*:*:*", "matchCriteriaId": "6EF1E97F-CA8A-45E6-B115-E9BD4EC8B36F", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. In version 4.4.0, an unauthenticated remote BGP peer can trigger a fatal panic in GoBGP by sending a specially crafted BGP UPDATE message. When the server receives a message with inconsistent attribute lengths, it improperly handles the internal state transition to a \"withdraw\" action, leading to a nil pointer dereference in the AdjRib.Update function. This causes the entire GoBGP process to crash, resulting in a complete loss of service availability. This issue has been patched in version 4.5.0."}, {"lang": "es", "value": "GoBGP es una implementaci\u00f3n de c\u00f3digo abierto del Border Gateway Protocol (BGP) en el lenguaje de programaci\u00f3n Go. En la versi\u00f3n 4.4.0, un par BGP remoto no autenticado puede desencadenar un p\u00e1nico fatal en GoBGP al enviar un mensaje BGP UPDATE especialmente dise\u00f1ado. Cuando el servidor recibe un mensaje con longitudes de atributo inconsistentes, maneja incorrectamente la transici\u00f3n de estado interno a una acci\u00f3n de \u2019retirada\u2019, lo que lleva a una desreferencia de puntero nulo en la funci\u00f3n AdjRib.Update. Esto provoca que todo el proceso de GoBGP falle, lo que resulta en una p\u00e9rdida completa de la disponibilidad del servicio. Este problema ha sido parcheado en la versi\u00f3n 4.5.0."}], "id": "CVE-2026-42285", "lastModified": "2026-10-26T22:10:00.163", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-42285", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-07T13:04:33.585849Z", "version": "2.0.3"}}]}, "published": "2026-05-07T12:16:18.180", "references": [{"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/osrg/gobgp/releases/tag/v4.5.0"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/osrg/gobgp/security/advisories/GHSA-p3w2-64xm-833j"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/osrg/gobgp/security/advisories/GHSA-p3w2-64xm-833j"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-476"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.4.0"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "gobgp", "source": "cna", "vendor": "osrg"}, "product": "gobgp", "vendor": "osrg"}], "created": "2026-05-07T14:45:25.777311+00:00", "updated": "2026-05-07T15:00:13.966289+00:00", "vendors": ["osrg", "osrg$PRODUCT$gobgp"]}