{"id":"EUVD-2026-28355","enisaUuid":"340306f2-e112-3e9c-bc11-c3a3aa7a4f60","description":"GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. In version 4.4.0, an unauthenticated remote BGP peer can trigger a fatal panic in GoBGP by sending a specially crafted BGP UPDATE message. When the server receives a message with inconsistent attribute lengths, it improperly handles the internal state transition to a \"withdraw\" action, leading to a nil pointer dereference in the AdjRib.Update function. This causes the entire GoBGP process to crash, resulting in a complete loss of service availability. This issue has been patched in version 4.5.0.","datePublished":"May 7, 2026, 11:53:14 AM","dateUpdated":"May 7, 2026, 1:04:56 PM","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/osrg/gobgp/security/advisories/GHSA-p3w2-64xm-833j\nhttps://github.com/osrg/gobgp/releases/tag/v4.5.0\n","aliases":"CVE-2026-42285\nGHSA-p3w2-64xm-833j\n","assigner":"GitHub_M","epss":0.42,"enisaIdProduct":[{"id":"2e892ccd-341e-3a6f-996e-621b78b87f34","product":{"name":"GoBGP","vendor":{"name":"osrg"}},"product_version":"\u003d 4.4.0"}],"enisaIdVendor":[{"id":"72f648d0-ad91-37f5-9044-03d44a45a208","vendor":{"name":"osrg"}}],"enisaIdVulnerability":[{"id":"34dea0f6-411f-3233-a422-45d23ad0ee70","vulnerability":{"id":"CVE-2026-42285","description":"GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. In version 4.4.0, an unauthenticated remote BGP peer can trigger a fatal panic in GoBGP by sending a specially crafted BGP UPDATE message. When the server receives a message with inconsistent attribute lengths, it improperly handles the internal state transition to a \"withdraw\" action, leading to a nil pointer dereference in the AdjRib.Update function. This causes the entire GoBGP process to crash, resulting in a complete loss of service availability. This issue has been patched in version 4.5.0.","datePublished":"May 7, 2026, 11:53:14 AM","dateUpdated":"May 7, 2026, 1:04:56 PM","status":"PUBLISHED","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/osrg/gobgp/security/advisories/GHSA-p3w2-64xm-833j\nhttps://github.com/osrg/gobgp/releases/tag/v4.5.0\n","enisa_id":"EUVD-2026-28355\n","assigner":"GitHub_M","epss":0.42,"dataProcessed":"Oct 30, 2026, 7:17:17 AM","vulnerabilityProduct":[{"id":"27b7a83e-ba42-3090-93b8-e9374429ace3","product":{"name":"GoBGP","vendor":{"name":"osrg"}},"product_version":"\u003d 4.4.0"}],"vulnerabilityVendor":[{"id":"44b4e086-7e3d-3d14-bb3d-8b3ffc26ce60","vendor":{"name":"osrg"}}]}},{"id":"f61933c5-04e6-3815-a937-f9b6f82f44a8","vulnerability":{"id":"GHSA-p3w2-64xm-833j","description":"GoBGP has a panic in AdjRib.Update via malformed BGP Update message (Nil Pointer Dereference)","datePublished":"May 5, 2026, 8:57:14 PM","dateUpdated":"May 8, 2026, 8:42:39 PM","baseScore":0.0,"references":"https://github.com/osrg/gobgp/security/advisories/GHSA-p3w2-64xm-833j\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-42285\nhttps://github.com/osrg/gobgp\nhttps://github.com/osrg/gobgp/releases/tag/v4.5.0\n","enisa_id":"EUVD-2026-28355\n","aliases":"GHSA-p3w2-64xm-833j\nCVE-2026-42285\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:55:50 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}