EUVD-2026-26917Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
7DescriptionCVE.org
A vulnerability was identified in osrg GoBGP up to 4.3.0. Affected by this issue is the function BMPPeerUpNotification.ParseBody/BMPStatisticsReport.ParseBody of the file pkg/packet/bmp/bmp.go of the component BMP Parser. The manipulation leads to out-of-bounds read. The attack can be initiated remotely. Upgrading to version 4.4.0 can resolve this issue. The identifier of the patch is bc77597d42335c78464bc8e15a471d887bbdf260. Upgrading the affected component is recommended.
AnalysisAI
Out-of-bounds read in GoBGP BMP parser allows remote attackers to trigger information disclosure via malformed BMP messages to the BMPPeerUpNotification.ParseBody and BMPStatisticsReport.ParseBody functions. Affected versions are up to 4.3.0; patch available in version 4.4.0. CVSS 6.9 reflects availability impact. No public exploit code or active exploitation has been identified.
Technical ContextAI
GoBGP is an open-source BGP implementation written in Go. The BMP (BGP Monitoring Protocol) parser in pkg/packet/bmp/bmp.go processes monitoring messages from BGP speakers. The vulnerability exists in two parsing functions that fail to validate minimum buffer lengths before reading fixed-size fields. BMPPeerUpNotification expects at least 20 bytes and BMPStatisticsReport expects at least 4 bytes; attackers sending crafted BMP messages with truncated payloads trigger out-of-bounds reads that expose adjacent memory. This is a classic bounds-checking failure (CWE-125) in protocol parsing code exposed over the network via AV:N.
RemediationAI
Upgrade GoBGP to version 4.4.0 or later, which includes explicit length validation checks before buffer reads in BMPPeerUpNotification.ParseBody and BMPStatisticsReport.ParseBody. The patch (commit bc77597d42335c78464bc8e15a471d887bbdf260, available at https://github.com/osrg/gobgp/releases/tag/v4.4.0) adds minimum length assertions (20 bytes for peer up notifications, 4 bytes for statistics reports) and returns formatted errors when messages are truncated. As interim mitigation, implement network-level filtering to restrict BMP connections to trusted BGP speakers only and monitor GoBGP logs for truncation errors. If upgrading is not immediately feasible, disable BMP monitoring until patched, though this eliminates monitoring visibility.
An issue was discovered in GoBGP before 3.35.0. Rated high severity (CVSS 8.6), this vulnerability is remotely exploitab
Buffer overflow in GoBGP's AIGP Attribute Parser allows remote unauthenticated attackers to manipulate the PathAttribute
Denial of service in osrg GoBGP up to version 4.3.0 allows remote attackers to trigger an infinite loop via malformed SR
Integer underflow in osrg GoBGP up to version 4.3.0 allows remote attackers to trigger a crash or information disclosure
An issue was discovered in GoBGP before 3.35.0. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploit
An issue was discovered in GoBGP before 3.35.0. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploit
Denial of service in osrg GoBGP up to version 4.3.0 via off-by-one error in the DecodeFromBytes function allows remote,
Improper access controls in osrg GoBGP up to version 4.3.0 allow remote attackers to bypass authentication via manipulat
Improper access control in osrg GoBGP up to 4.3.0 allows remote attackers to manipulate the domainNameLen parameter in B
An issue was discovered in GoBGP before 3.35.0. Rated medium severity (CVSS 4.3), this vulnerability is no authenticatio
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: ImportantShare
External POC / Exploit Code
Leaving vuln.today