CVE-2026-30405 GoBGP vulnerable to a denial of service via the NEXT_HOP path attribute
A remote attacker can cause a denial of service in GoBGP by exploiting the NEXT_HOP path attribute.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-30405?
CVE-2026-30405 is a high-severity denial of service vulnerability in n/a, published on 16 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue in GoBGP gobgpd v.4.2.0 allows a remote attacker to cause a denial of service via the NEXT_HOP path attribute
Weakness: CWE-400
Which versions are affected by CVE-2026-30405?
5 open source packages ship an affected version, including github.com/osrg/gobgp/v4, github.com/osrg/gobgp and github.com/osrg/gobgp/v3. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/osrg/gobgp/v4 Go | All versions | None |
github.com/osrg/gobgp/v4 Go | All versions | 4.4.0 |
github.com/osrg/gobgp/v4 Go | All versions | 4.4.0 |
github.com/osrg/gobgp Go | All versions | None |
github.com/osrg/gobgp/v3 Go | All versions | None |
Products include Osrg Gobgp.
How do I fix CVE-2026-30405?
Upgrade github.com/osrg/gobgp/v4 to 4.4.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-30405 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-30405 exists.
Other vulnerabilities in n/a
- CVE-2025-43971 GoBGP panics due to a zero value for softwareVersionLen
- CVE-2026-41642 GoBGP: Remote Denial of Service (Panic) via Malformed Well-known Path Attribute
- CVE-2026-41643 GoBGP: Remote Denial of Service (Panic) in UpdatePathAttrs4ByteAs via Malformed BGP UPDATE
- CVE-2026-42285 GoBGP: Panic in AdjRib.Update via malformed BGP Update message (Nil Pointer Dereference)
- CVE-2026-37461 GoBGP has an out-of-bounds read in the ParseIP6Extended function
Sources
Also known as DEBIAN-CVE-2026-30405, GHSA-4p9m-8gc4-rw2h, GO-2026-4736, MINI-23g9-rh67-x3v7, MINI-3456-qr8v-7p8h, MINI-5rvh-c9r5-m8fh and 8 more.