What’s Vulnerable › Products

osrg GoBGP vulnerabilities

20 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 19 published in the last 12 months.

Check whether your osrg GoBGP version is affected

Latest osrg GoBGP vulnerabilities

• CVE-2026-49838 — GoBGP confederation validation panics on empty AS_PATH attribute (CVSS 5.9)
• CVE-2026-49837 — GoBGP: BGP OPEN capability parser may read capability values outside declared CapLen boundaries (CVSS 5.9)
• CVE-2026-42285 — GoBGP: Panic in AdjRib.Update via malformed BGP Update message (Nil Pointer Dereference) (CVSS 7.5)
• CVE-2026-41643 — GoBGP: Remote Denial of Service (Panic) in UpdatePathAttrs4ByteAs via Malformed BGP UPDATE (CVSS 7.5)
• CVE-2026-41642 — GoBGP: Remote Denial of Service (Panic) via Malformed Well-known Path Attribute (CVSS 7.5)
• CVE-2026-37461 — (CVSS 7.5)
• CVE-2026-7737 — osrg GoBGP BMP Parser bmp.go BMPStatisticsReport.ParseBody out-of-bounds (CVSS 7.5)
• CVE-2026-7736 — osrg GoBGP mrt.go parseRibEntry integer underflow (CVSS 7.5)
• CVE-2026-7735 — osrg GoBGP AIGP Attribute bgp.go PathAttributeAigp.DecodeFromBytes buffer overflow (CVSS 7.3)
• CVE-2026-7734 — osrg GoBGP SRv6 L3 Service prefix_sid.go SRv6L3ServiceAttribute.DecodeFromBytes denial of service (CVSS 7.5)
• CVE-2026-5124 — osrg GoBGP BGP Header bgp.go BGPHeader.DecodeFromBytes access control (CVSS 3.7)
• CVE-2026-5123 — osrg GoBGP bgp.go DecodeFromBytes off-by-one (CVSS 3.7)
• CVE-2026-5122 — osrg GoBGP BGP OPEN Message bgp.go DecodeFromBytes access control (CVSS 3.7)
• CVE-2026-30405 — (CVSS 7.5)
• CVE-2025-7464 — osrg GoBGP rtr.go SplitRTR out-of-bounds (CVSS 3.7)
• CVE-2025-43973 — (CVSS 9.8)
• CVE-2025-43972 — (CVSS 7.5)
• CVE-2025-43971 — (CVSS 7.5)
• CVE-2025-43970 — (CVSS 5.3)
• CVE-2023-46565 — (CVSS 7.5)