Executive brief
GoBGP is an open-source implementation of the Border Gateway Protocol (BGP) used to manage how data is routed across the internet. A vulnerability in how it processes specific network update messages could allow an attacker to crash the service. This results in a denial-of-service (DoS) condition, potentially disrupting network routing and connectivity for organizations relying on this software.
Technical details
Two related issues in GoBGP v4.3.0 contribute to potential instability. First, the 'ParseIP6Extended' function in 'bgp.go' performs an insufficient length check, validating only 8 bytes when 20 bytes are required for IPv6 extended community parsing, leading to an out-of-bounds read. Second, the 'DecodeFromBytes' function in 'BGPUpdate' is susceptible to a uint16 underflow when processing malformed UPDATE messages that declare section lengths smaller than the actual encoded elements. An unauthenticated remote attacker can exploit these flaws by sending specially crafted BGP UPDATE messages to trigger a crash (Denial of Service). Patches have been developed to enforce proper bounds checking and prevent integer wrapping.
Affected products
- osrg GoBGP 4.3.0
Timeline
- 2026-05-04: disclosed
- 2026-05-04: advisory