CVE-2026-37462: GoBGP: Integer underflow in the BGPUpdate.DecodeFromBytes function

June 3, 2026 (updated July 13, 2026)

An integer underflow in the BGPUpdate.DecodeFromBytes function (/bgp/bgp.go) of gobgp v4.3.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted BGP UPDATE message.

References

github.com/advisories/GHSA-pw7p-7fqv-hpj8
github.com/osrg/gobgp/blob/v4.3.0/pkg/packet/bgp/bgp.go
github.com/osrg/gobgp/commit/9ce8936672ebc07df524da77fa4c6ae26d92be6d
nvd.nist.gov/vuln/detail/CVE-2026-37462

Code Behaviors & Features

Detect and mitigate CVE-2026-37462 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →