CVE-2026-41642: GoBGP has Remote Denial of Service (Panic) via Malformed Well-known Path Attribute

April 29, 2026 (updated May 8, 2026)

A remote Denial of Service (DoS) vulnerability exists in GoBGP due to a nil pointer dereference. When a malformed BGP UPDATE message contains an unrecognized Path Attribute marked as “Well-known,” the daemon fails to interrupt the message handling flow. This results in an illegal memory access and a full process crash (panic).

References

github.com/advisories/GHSA-7235-89m6-f4px
github.com/osrg/gobgp/releases/tag/v4.4.0
github.com/osrg/gobgp/security/advisories/GHSA-7235-89m6-f4px
nvd.nist.gov/vuln/detail/CVE-2026-41642

Code Behaviors & Features

Detect and mitigate CVE-2026-41642 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →