{"id":"EUVD-2026-28352","enisaUuid":"ef057ba7-7377-345f-8ce6-69de79ecdad7","description":"GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. Prior to version 4.3.0, a remote Denial of Service (DoS) vulnerability exists in GoBGP where a malformed BGP UPDATE message can trigger a runtime error: index out of range panic. This occurs during the processing of 4-byte AS attributes when the message structure causes an internal slice index shift that is not properly handled. This issue has been patched in version 4.3.0.","datePublished":"May 7, 2026, 11:53:23 AM","dateUpdated":"May 7, 2026, 1:39:04 PM","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/osrg/gobgp/security/advisories/GHSA-8rxh-r2p6-7f2q\nhttps://github.com/osrg/gobgp/releases/tag/v4.3.0\n","aliases":"CVE-2026-41643\nGHSA-8rxh-r2p6-7f2q\n","assigner":"GitHub_M","epss":0.54,"enisaIdProduct":[{"id":"64272895-83aa-3418-89fc-7e618c710031","product":{"name":"GoBGP","vendor":{"name":"osrg"}},"product_version":"\u003c 4.3.0"}],"enisaIdVendor":[{"id":"872ba11a-16b5-3c69-840d-e2eddaa10b6e","vendor":{"name":"osrg"}}],"enisaIdVulnerability":[{"id":"2df67ee9-54c2-3616-993c-4e639293a728","vulnerability":{"id":"GHSA-8rxh-r2p6-7f2q","description":"GoBGP has Remote Denial of Service (Panic) in UpdatePathAttrs4ByteAs via Malformed BGP UPDATE","datePublished":"Apr 29, 2026, 8:44:04 PM","dateUpdated":"May 8, 2026, 8:42:30 PM","baseScore":0.0,"references":"https://github.com/osrg/gobgp/security/advisories/GHSA-8rxh-r2p6-7f2q\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-41643\nhttps://github.com/osrg/gobgp\nhttps://github.com/osrg/gobgp/releases/tag/v4.3.0\n","enisa_id":"EUVD-2026-28352\n","aliases":"CVE-2026-41643\nGHSA-8rxh-r2p6-7f2q\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:55:50 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"dcee7a20-60b7-30bc-b599-854801e99df8","vulnerability":{"id":"CVE-2026-41643","description":"GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. Prior to version 4.3.0, a remote Denial of Service (DoS) vulnerability exists in GoBGP where a malformed BGP UPDATE message can trigger a runtime error: index out of range panic. This occurs during the processing of 4-byte AS attributes when the message structure causes an internal slice index shift that is not properly handled. This issue has been patched in version 4.3.0.","datePublished":"May 7, 2026, 11:53:23 AM","dateUpdated":"May 7, 2026, 1:39:04 PM","status":"PUBLISHED","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/osrg/gobgp/security/advisories/GHSA-8rxh-r2p6-7f2q\nhttps://github.com/osrg/gobgp/releases/tag/v4.3.0\n","enisa_id":"EUVD-2026-28352\n","assigner":"GitHub_M","epss":0.54,"dataProcessed":"Oct 27, 2026, 7:17:29 AM","vulnerabilityProduct":[{"id":"305371ea-2539-3b53-ab03-0d2bcdceb157","product":{"name":"GoBGP","vendor":{"name":"osrg"}},"product_version":"\u003c 4.3.0"}],"vulnerabilityVendor":[{"id":"793880e6-b896-3518-acf4-a1fb9cd26f94","vendor":{"name":"osrg"}}]}}],"enisaIdAdvisory":[]}