CVE-2026-37462: GoBGP integer underflow in BGPUpdate.DecodeFromBytes

CVE-2026-37462 · Severity: high · CVSS 7.3 · Published 2026-06-03

GoBGP is an open-source software implementation of the Border Gateway Protocol (BGP) used to manage internet routing. A vulnerability in how it processes routing updates allows a remote attacker to crash the service by sending a specially crafted message. This results in a denial of service, potentially disrupting network routing operations.

Technologies: github.com/osrg/gobgp/v4 (Go), Osrg Gobgp. Vendors: Go, Osrg.

Quick answers

Is CVE-2026-37462 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-37462 being exploited in the wild.
How severe is CVE-2026-37462?
High severity, with a CVSS score of 7.3, published 3 June 2026.
Which products and versions are affected?
github.com/osrg/gobgp/v4 (Go) < 4.4.0, SEMVER:introduced=0,fixed=4.4.0; Osrg Gobgp < 4.4.0, 4.3.0.
Is there a fix for CVE-2026-37462?
Yes. github.com/osrg/gobgp/v4 (Go): upgrade to 4.4.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-37462 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-37462?
Check whether you run github.com/osrg/gobgp/v4 (Go) or Osrg Gobgp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/osrg/gobgp/v4 (Go): upgrade to 4.4.0 or later
    go get github.com/osrg/gobgp/v4@v4.4.0

Technical details

An integer underflow vulnerability exists in the BGPUpdate.DecodeFromBytes function within pkg/packet/bgp/bgp.go. When processing a malformed BGP UPDATE message that declares a section length smaller than the actual encoded element, the uint16 subtraction for 'routelen' or 'pathlen' wraps to a large value. This causes the decoding loop to consume data beyond the intended section boundary, leading to a crash or undefined behavior. The vulnerability can be triggered by a remote, unauthenticated attacker over the network. The issue is fixed in version 4.4.0 by adding bounds checks before subtraction.

Affected products

  • osrg GoBGP < 4.4.0

Identifiers

  • CVE-2026-37462
  • GHSA-pw7p-7fqv-hpj8
  • GO-2026-5971

Timeline

  • 2026-06-03: advisory: Initial disclosure and NVD publication
  • 2026-07-13: patched: GitHub Advisory reviewed and patch confirmed in version 4.4.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.