osrg GoBGP vulnerabilities

CVEs per yearBy the year they were published

1. 20251
2. 202612

Newest CVEs

• CVE-2026-49838

  GoBGP confederation validation panics on empty AS_PATH attribute

  osrg · gobgp

  Medium5.9
• CVE-2026-49837

  GoBGP: BGP OPEN capability parser may read capability values outside declared CapLen boundaries

  osrg · gobgp

  Medium5.9
• CVE-2026-41643

  GoBGP: Remote Denial of Service (Panic) in UpdatePathAttrs4ByteAs via Malformed BGP UPDATE

  osrg · gobgp

  High7.5
• CVE-2026-42285

  GoBGP: Panic in AdjRib.Update via malformed BGP Update message (Nil Pointer Dereference)

  osrg · gobgp

  High7.5
• CVE-2026-41642

  GoBGP: Remote Denial of Service (Panic) via Malformed Well-known Path Attribute

  osrg · gobgp

  High7.5
• CVE-2026-7737

  osrg GoBGP BMP Parser bmp.go BMPStatisticsReport.ParseBody out-of-bounds

  osrg · GoBGP

  Medium6.9
• CVE-2026-7736

  osrg GoBGP mrt.go parseRibEntry integer underflow

  osrg · GoBGP

  Medium6.9
• CVE-2026-7735

  osrg GoBGP AIGP Attribute bgp.go PathAttributeAigp.DecodeFromBytes buffer overflow

  osrg · GoBGP

  Medium6.9
• CVE-2026-7734

  osrg GoBGP SRv6 L3 Service prefix_sid.go SRv6L3ServiceAttribute.DecodeFromBytes denial of service

  osrg · GoBGP

  Medium6.9
• CVE-2026-5124

  osrg GoBGP BGP Header bgp.go BGPHeader.DecodeFromBytes access control

  osrg · GoBGP

  Medium6.3