Executive brief
GoBGP is an open-source tool used to manage how internet traffic is routed between different networks. A vulnerability in version 4.4.0 allows an unauthenticated remote attacker to crash the GoBGP service by sending a specially crafted routing update message. This results in a complete loss of service availability, potentially disrupting network connectivity and routing operations until the service is manually restarted.
Technical details
A nil pointer dereference exists in GoBGP version 4.4.0 within the AdjRib.Update function. The vulnerability is triggered when the server receives a BGP UPDATE message containing inconsistent attribute lengths. While the software correctly identifies the malformed attributes and attempts to treat the message as a 'withdraw' action, it fails to properly manage the internal state transition, leading to a nil pointer access in internal/pkg/table/adj.go. An unauthenticated remote peer can exploit this over the network to cause a fatal panic (SIGSEGV), resulting in a complete denial of service. This issue is resolved in version 4.5.0.
Affected products
- osrg GoBGP 4.4.0
Timeline
- 2026-04-30: patched: Fixed in version 4.5.0
- 2026-05-07: disclosed: Public disclosure of CVE-2026-42285