{"id":"EUVD-2026-28351","enisaUuid":"1793e29b-8526-3683-9d4a-ac0dcaf2a8de","description":"GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. In version 4.3.0, a remote Denial of Service (DoS) vulnerability exists in GoBGP due to a nil pointer dereference. When a malformed BGP UPDATE message contains an unrecognized Path Attribute marked as \"Well-known,\" the daemon fails to interrupt the message handling flow. This results in an illegal memory access and a full process crash (panic). This issue has been patched in version 4.4.0.","datePublished":"May 7, 2026, 11:50:41 AM","dateUpdated":"May 7, 2026, 12:34:38 PM","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/osrg/gobgp/security/advisories/GHSA-7235-89m6-f4px\nhttps://github.com/osrg/gobgp/releases/tag/v4.4.0\n","aliases":"CVE-2026-41642\nGHSA-7235-89m6-f4px\n","assigner":"GitHub_M","epss":0.5,"enisaIdProduct":[{"id":"f170a0fe-0b08-3b76-8984-21c1920495ae","product":{"name":"GoBGP","vendor":{"name":"osrg"}},"product_version":"\u003d 4.3.0"}],"enisaIdVendor":[{"id":"f9151589-1eed-39eb-8643-d2253be6c7ad","vendor":{"name":"osrg"}}],"enisaIdVulnerability":[{"id":"855893e6-bb28-33f9-9a65-9285fbac62e2","vulnerability":{"id":"CVE-2026-41642","description":"GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. In version 4.3.0, a remote Denial of Service (DoS) vulnerability exists in GoBGP due to a nil pointer dereference. When a malformed BGP UPDATE message contains an unrecognized Path Attribute marked as \"Well-known,\" the daemon fails to interrupt the message handling flow. This results in an illegal memory access and a full process crash (panic). This issue has been patched in version 4.4.0.","datePublished":"May 7, 2026, 11:50:41 AM","dateUpdated":"May 7, 2026, 12:34:38 PM","status":"PUBLISHED","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/osrg/gobgp/security/advisories/GHSA-7235-89m6-f4px\nhttps://github.com/osrg/gobgp/releases/tag/v4.4.0\n","enisa_id":"EUVD-2026-28351\n","assigner":"GitHub_M","epss":0.5,"dataProcessed":"Oct 30, 2026, 7:17:35 AM","vulnerabilityProduct":[{"id":"bd9099e5-a9d9-37f4-901c-31d7e6f1c299","product":{"name":"GoBGP","vendor":{"name":"osrg"}},"product_version":"\u003d 4.3.0"}],"vulnerabilityVendor":[{"id":"aaabce06-3362-3938-ba58-62e233e6bb25","vendor":{"name":"osrg"}}]}},{"id":"9146f206-b4c2-3a41-98d7-6cab091cd51d","vulnerability":{"id":"GHSA-7235-89m6-f4px","description":"GoBGP has Remote Denial of Service (Panic) via Malformed Well-known Path Attribute","datePublished":"Apr 29, 2026, 8:43:36 PM","dateUpdated":"May 8, 2026, 8:42:26 PM","baseScore":0.0,"references":"https://github.com/osrg/gobgp/security/advisories/GHSA-7235-89m6-f4px\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-41642\nhttps://github.com/osrg/gobgp\nhttps://github.com/osrg/gobgp/releases/tag/v4.4.0\n","enisa_id":"EUVD-2026-28351\n","aliases":"CVE-2026-41642\nGHSA-7235-89m6-f4px\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:55:50 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}