What is the CVSS score of CVE-2026-41642?

CVE-2026-41642 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Which versions of GoBGP are affected by CVE-2026-41642?

GoBGP 4.3.0 suffers a remote denial of service vulnerability that terminates the entire BGP daemon when processing malformed UPDATE messages from established peers, directly impacting network…. A patch is available.

How to fix or mitigate CVE-2026-41642?

Within 24 hours: Inventory all GoBGP 4.3.0 deployments and document peer relationships; isolate affected instances to test networks if possible. Within 7 days: Implement input validation and rate-limiting on BGP UPDATE messages at network boundary; monitor BGP session logs for malformed packets matching the vulnerability signature (invalid Type Codes 0xEE, 0xFF with Optional bit = 0). Within 30 days: Upgrade to GoBGP version 4.4.0 or later when vendor patch is released; alternatively, evaluate migration to patched BGP implementations (e.g., BIRD, Quagga) if upgrade timeline exceeds risk tolerance.

GoBGP CVE-2026-41642

HIGH

NULL Pointer Dereference (CWE-476)

2026-04-29 https://github.com/osrg/gobgp

GHSA-7235-89m6-f4px

Microsoft Null Pointer Dereference Denial Of Service Suse

7.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SUSE

HIGH

qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

Apr 29, 2026 - 20:58 vuln.today

Analysis Generated

Apr 29, 2026 - 20:58 vuln.today

Analysis Generated

Apr 29, 2026 - 20:45 vuln.today

CVE Published

Apr 29, 2026 - 20:43 nvd

HIGH 7.5

DescriptionGitHub Advisory

Summary

A remote Denial of Service (DoS) vulnerability exists in GoBGP due to a nil pointer dereference. When a malformed BGP UPDATE message contains an unrecognized Path Attribute marked as "Well-known," the daemon fails to interrupt the message handling flow. This results in an illegal memory access and a full process crash (panic).

Details

The vulnerability is located in the Finite State Machine (FSM) message handling loop in pkg/server/fsm.go. According to RFC 4271, any Path Attribute with the Optional bit set to 0 is treated as "Well-known." If the Type Code is unrecognized, the BGP speaker MUST send a NOTIFICATION message.

In GoBGP v4.3.0, when such an attribute (e.g., Type 0xEE or 0xFF with flags 0x40) is received, the parsing layer identifies the error. However, the logic in recvMessageloop (around Line 1826) does not properly halt execution. It proceeds to reference the body of the parsed message. Because the message was deemed invalid during the initial attribute check, the body pointer is nil, leading to: panic: runtime error: invalid memory address or nil pointer dereference.

This bypasses the intended error-handling mechanism and causes the entire BGP daemon to terminate, rather than just closing the affected session.

panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x18 pc=0xc225e4]

goroutine 50 [running]:
github.com/osrg/gobgp/v4/pkg/server.(*fsmHandler).recvMessageloop(0x19f29bca92c0, {0x10069f0, 0x19f29bc48780}, {0x1014658, 0x19f29bc2a890}, 0x19f29baa0540, 0x19f29bc393b0, 0x19f29bc96cc0?)
        /home/base/Desktop/gobgp/pkg/server/fsm.go:1826 +0xa44
created by github.com/osrg/gobgp/v4/pkg/server.(*fsmHandler).established in goroutine 37
        /home/base/Desktop/gobgp/pkg/server/fsm.go:1916 +0x2d5
exit status 2

PoC

GoBGP Version: v4.3.0 Configure GoBGP with a neighbor (e.g., 192.168.31.195) in passive mode. Establish a standard BGP session (OPEN/KEEPALIVE exchange). Send a specifically crafted UPDATE packet containing an unrecognized Type Code marked as "Well-known" (Optional bit = 0). Payload 1 (Hex):

FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
00 17
# Length: 23
02
# Type: UPDATE
00 00
# Withdrawn Routes Length: 0
00 04
# Total Path Attribute Length: 4
40 EE 00
# Flag: 0x40 (Well-known, Transitive), Type: 0xEE (Unknown), Len: 0

Payload 2 (Hex):

FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
00 17
# Length: 23
02
# Type: UPDATE
00 00
# Withdrawn Routes Length: 0
00 04
# Total Path Attribute Length: 4
40 01 01 00
# IGP Attribute
40 FF 00
# Flag: 0x40 (Well-known, Transitive), Type: 0xFF (Unknown), Len: 0

Impact

This vulnerability affects all GoBGP deployments peering with external or internal speakers. A single malformed UPDATE message from any peer can trigger a nil pointer dereference, causing the GoBGP daemon to panic and crash.

AnalysisAI

Remote denial of service via nil pointer dereference crashes GoBGP 4.3.0 when processing malformed BGP UPDATE messages containing unrecognized well-known path attributes. A single crafted UPDATE packet with an invalid Type Code (e.g., 0xEE or 0xFF) marked as well-known (Optional bit = 0) triggers a panic that terminates the entire BGP daemon process, not just the affected session. Publicly available exploit code exists with detailed proof-of-concept payloads confirmed by GitHub advisory GHSA-7235-89m6-f4px. Network-facing BGP deployments are at immediate operational risk despite CVSS 7.5, as BGP peering relationships make this trivially exploitable by any established peer.

Technical ContextAI

BGP (Border Gateway Protocol) is the routing protocol of the internet, and GoBGP is a Go-based BGP implementation often used in software-defined networking and network automation. RFC 4271 mandates that BGP Path Attributes with the Optional bit set to 0 are treated as well-known attributes, and speakers must send NOTIFICATION messages for unrecognized Type Codes. The vulnerability stems from CWE-476 (NULL Pointer Dereference) in the Finite State Machine message handling loop (pkg/server/fsm.go, line 1826). When the parsing layer detects an invalid well-known attribute during initial validation, it sets the message body pointer to nil but does not halt execution flow in recvMessageloop. Subsequent code attempts to dereference this nil pointer, causing a SIGSEGV segmentation fault that panics the entire Go process. The CPE identifier pkg:go/github.com_osrg_gobgp_v4 confirms this affects the Go package at version 4.3.0, with fix available in 4.4.0.

RemediationAI

Upgrade to GoBGP version 4.4.0 immediately, which contains the vendor-released patch fixing the nil pointer dereference in the FSM message handling loop. The fix is confirmed in the GitHub package manifest showing vulnerability resolved in 4.4.0. Download from the official GoBGP repository at https://github.com/osrg/gobgp or update via Go module dependency management with 'go get github.com/osrg/gobgp/v4@v4.4.0'. If immediate upgrade is not feasible, implement strict BGP peer authentication and filter untrusted peering relationships, though this is limited mitigation since established legitimate peers can still be compromised. Network segmentation can contain blast radius by isolating BGP speaker failures from critical routing infrastructure, but does not prevent the crash. Monitoring for unexpected GoBGP process terminations and automated restart mechanisms can reduce downtime but do not address root cause. There are no configuration-based workarounds to disable vulnerable code paths. Refer to official advisory at https://github.com/osrg/gobgp/security/advisories/GHSA-7235-89m6-f4px and https://github.com/advisories/GHSA-7235-89m6-f4px for additional vendor guidance.