CVE-2026-37461: GoBGP has an out-of-bounds read in the ParseIP6Extended function

May 4, 2026 (updated May 8, 2026)

An out-of-bounds read in the ParseIP6Extended function (/bgp/bgp.go) of gobgp v4.3.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted BGP UPDATE message.

References

github.com/advisories/GHSA-wmvj-f67g-qg4g
github.com/osrg/gobgp/blob/v4.3.0/pkg/packet/bgp/bgp.go
github.com/osrg/gobgp/commit/362cce3e325f56e7a4f792ccb9689b3bdda9e682
github.com/osrg/gobgp/commit/9ce8936672ebc07df524da77fa4c6ae26d92be6d
nvd.nist.gov/vuln/detail/CVE-2026-37461

Code Behaviors & Features

Detect and mitigate CVE-2026-37461 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →