CVE-2026-37461 GoBGP has an out-of-bounds read in the ParseIP6Extended function

What is CVE-2026-37461?

CVE-2026-37461 is a high-severity denial of service vulnerability in n/a, published on 4 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An out-of-bounds read in the ParseIP6Extended function (/bgp/bgp.go) of gobgp v4.3.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted BGP UPDATE message.

Weakness: CWE-125

Which versions are affected by CVE-2026-37461?

3 open source packages ship an affected version, including github.com/osrg/gobgp/v4. It affects 1 product.

Products include Osrg Gobgp.

How do I fix CVE-2026-37461?

Upgrade github.com/osrg/gobgp/v4 to 4.4.0 or later.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2026-37461 being exploited?

There is no known exploitation of CVE-2026-37461 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2025-43971 GoBGP panics due to a zero value for softwareVersionLen High 8.6
• CVE-2026-41642 GoBGP: Remote Denial of Service (Panic) via Malformed Well-known Path Attribute High 7.5
• CVE-2026-41643 GoBGP: Remote Denial of Service (Panic) in UpdatePathAttrs4ByteAs via Malformed BGP UPDATE High 7.5
• CVE-2026-42285 GoBGP: Panic in AdjRib.Update via malformed BGP Update message (Nil Pointer Dereference) High 7.5
• CVE-2026-30405 GoBGP vulnerable to a denial of service via the NEXT_HOP path attribute High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2026-37461, GHSA-wmvj-f67g-qg4g, GO-2026-5713, UBUNTU-CVE-2026-37461.