CVE-2026-41643: GoBGP has Remote Denial of Service (Panic) in UpdatePathAttrs4ByteAs via Malformed BGP UPDATE

April 29, 2026 (updated May 8, 2026)

A remote Denial of Service (DoS) vulnerability exists in GoBGP where a malformed BGP UPDATE message can trigger a runtime error: index out of range panic. This occurs during the processing of 4-byte AS attributes when the message structure causes an internal slice index shift that is not properly handled.

References

github.com/advisories/GHSA-8rxh-r2p6-7f2q
github.com/osrg/gobgp/releases/tag/v4.3.0
github.com/osrg/gobgp/security/advisories/GHSA-8rxh-r2p6-7f2q
nvd.nist.gov/vuln/detail/CVE-2026-41643

Code Behaviors & Features

Detect and mitigate CVE-2026-41643 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →