GoBGP has Remote Denial of Service (Panic) via Malformed Well-known Path Attribute

Exploitation

No confirmed exploitation recorded. Patch Next marks exploitation only from CISA KEV.

CVSS

7.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

• CVE-2026-41642: 0.50% estimated exploitation activity in the next 30 days; percentile 43.09 (FIRST EPSS, 2026-11-03). This is a model estimate, not proof of exploitation or customer exposure.

As published by the source; long descriptions are shortened.

Summary A remote Denial of Service (DoS) vulnerability exists in GoBGP due to a nil pointer dereference. When a malformed BGP UPDATE message contains an unrecognized Path Attribute marked as "Well-known," the daemon fails to interrupt the message handling flow. This results in an illegal memory access and a full process crash (panic). Details The vulnerability is located in the Finite State Machine (FSM) message handling loop in pkg/server/fsm.go. According to RFC 4271, any Path Attribute with the Optional bit set to 0 is treated as "Well-known." If the Type Code is unrecognized, the BGP speaker MUST send a NOTIFICATION message. In GoBGP v4.3.0, when such an attribute (e.g., Type 0xEE or 0xFF with flags 0x40) is received, the parsing layer identifies the error. However, the logic in recvMessageloop (around Line 1826) does not properly halt execution. It proceeds to reference the body of the parsed message. Because the message was deemed invalid during the initial attribute check, the…

Published by the source

29 Apr 2026, 20:43 UTC

Last modified by the source

8 May 2026, 20:42 UTC

Source last checked

26 Oct 2026, 15:20 UTC

1. Revision 1 · created · 26 Oct 2026

   Published from ghsa record GHSA-7235-89m6-f4px

Preview the exact text before you copy it. Commands are read-only suggestions; review them before running anything.

# Patch Next advisory brief: CVE-2026-41642

Advisory: GoBGP has Remote Denial of Service (Panic) via Malformed Well-known Path Attribute
IDs: CVE-2026-41642, GHSA-7235-89m6-f4px
Record: https://patchnext.com/advisories/cve-2026-41642 (revision 1, source checked 26 Oct 2026, 15:20 UTC)
Inventory: none attached. This brief comes from a public page and does not say whether any deployment is affected.
Severity: High (CVSS 7.5)
Exploitation: no confirmed exploitation recorded. Patch Next confirms exploitation only from CISA KEV.
Vendor response: Vendor fix available; fixed versions by package: github.com/osrg/gobgp/v4 4.4.0. A vendor fix does not mean a deployment is fixed.

## Affected components
- Go github.com/osrg/gobgp/v4: affected >= 4.3.0, <= 4.3.0; fixed in 4.4.0

## Suggested inspection (read-only)
- Go github.com/osrg/gobgp/v4: check the installed version with your package manager.

## Supported action
Upgrade each affected component to a fixed version on its release line. For a transitive dependency, upgrade the parent package or add an override or constraint, then regenerate the lockfile. Redeploy every environment that ran an affected version.

## Required regression checks
- Run the test suite and a production build.
- Exercise the features that depend on github.com/osrg/gobgp/v4.
- Repeat the inspection and confirm that only fixed versions remain installed.

## Rollback considerations
- Keep the previous lockfile and deployment artifact. Rolling back reinstates the vulnerable version, so apply any documented mitigation while you fix forward.

## Unresolved questions
- Which deployments run an affected version?
- Exploitation status can change. Check again before lowering the priority.
- Mark the work resolved only after the fixed version is verified in production.

## Sources
- Verified: https://github.com/advisories/GHSA-7235-89m6-f4px (GitHub-reviewed advisory GHSA-7235-89m6-f4px lists affected ranges: Go github.com/osrg/gobgp/v4 >=4.3.0 <=4.3.0)

Commands are suggestions: review each one before running it.