Executive brief
GoBGP is an open-source software implementation of the Border Gateway Protocol (BGP) used to manage internet routing. A vulnerability in how it processes routing updates allows a remote attacker to crash the service by sending a specially crafted message. This results in a denial of service, potentially disrupting network routing operations.
Technical details
An integer underflow vulnerability exists in the BGPUpdate.DecodeFromBytes function within pkg/packet/bgp/bgp.go. When processing a malformed BGP UPDATE message that declares a section length smaller than the actual encoded element, the uint16 subtraction for 'routelen' or 'pathlen' wraps to a large value. This causes the decoding loop to consume data beyond the intended section boundary, leading to a crash or undefined behavior. The vulnerability can be triggered by a remote, unauthenticated attacker over the network. The issue is fixed in version 4.4.0 by adding bounds checks before subtraction.
Affected products
- osrg GoBGP < 4.4.0
Timeline
- 2026-06-03: advisory: Initial disclosure and NVD publication
- 2026-07-13: patched: GitHub Advisory reviewed and patch confirmed in version 4.4.0