VulnerabilityAnalyzed

CVE-2026-37461

An out-of-bounds read in the ParseIP6Extended function (/bgp/bgp.go) of gobgp v4.3.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted BGP UPDATE message.

HIGH 7.5EPSS 0.34%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.34%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

An out-of-bounds read in the ParseIP6Extended function (/bgp/bgp.go) of gobgp v4.3.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted BGP UPDATE message.

CVSS 3.1: 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS: 0.34% probability · 27th percentile
CISA KEV: Not listed
Weakness: CWE-125
Affected: osrg/gobgp
Source: cve@mitre.org

References

https://github.com/osrg/gobgp/blob/v4.3.0/pkg/packet/bgp/bgp.goProduct
https://github.com/osrg/gobgp/commit/362cce3e325f56e7a4f792ccb9689b3bdda9e682Patch
https://github.com/osrg/gobgp/commit/9ce8936672ebc07df524da77fa4c6ae26d92be6dPatch

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.