CVE-2026-41643 GoBGP: Remote Denial of Service (Panic) in UpdatePathAttrs4ByteAs via Malformed BGP UPDATE
Remote attackers can cause a denial of service in GoBGP by sending malformed BGP UPDATE messages that trigger a panic.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-41643?
CVE-2026-41643 is a high-severity denial of service vulnerability in osrg gobgp, published on 7 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. Prior to version 4.3.0, a remote Denial of Service (DoS) vulnerability exists in GoBGP where a malformed BGP UPDATE message can trigger a runtime error: index out of range panic. This occurs during the processing of 4-byte AS attributes when the message structure causes an internal slice index shift that is not properly handled. This issue has been patched in version 4.3.0.
Weakness: CWE-129
Which versions are affected by CVE-2026-41643?
3 open source packages ship an affected version, including github.com/osrg/gobgp/v4. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/osrg/gobgp/v4 Go | All versions | 4.3.0 |
github.com/osrg/gobgp/v4 Go | All versions | 4.3.0 |
github.com/osrg/gobgp/v4 Go | All versions | 4.3.0 |
Products include Osrg Gobgp.
How do I fix CVE-2026-41643?
Upgrade github.com/osrg/gobgp/v4 to 4.3.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-41643 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-41643 exists.
Other vulnerabilities in osrg gobgp
- CVE-2025-43971 GoBGP panics due to a zero value for softwareVersionLen
- CVE-2026-41642 GoBGP: Remote Denial of Service (Panic) via Malformed Well-known Path Attribute
- CVE-2026-42285 GoBGP: Panic in AdjRib.Update via malformed BGP Update message (Nil Pointer Dereference)
- CVE-2026-37461 GoBGP has an out-of-bounds read in the ParseIP6Extended function
- CVE-2026-30405 GoBGP vulnerable to a denial of service via the NEXT_HOP path attribute
Sources
Also known as DEBIAN-CVE-2026-41643, GHSA-8rxh-r2p6-7f2q, GO-2026-5266, UBUNTU-CVE-2026-41643.