GoPackage

github.com/osrg/gobgp

6 known vulnerabilities (2 high, 4 medium), with the versions each affects and the releases that fix them.

Latest release: v2.0.0+incompatible (Dec 30, 2018): affected by 6 advisories
Newest unaffected release: Every release is affected by at least one advisory
Advisories: 6 · 2 high, 4 medium

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

CVE-2026-7737Medium 6.9
osrg GoBGP BMP Parser bmp.go BMPStatisticsReport.ParseBody out-of-bounds
Affected: fixed in 4.4.0.
No fix released. The advisory names 4.4.0 as the fix, which the registry doesn't have yet. The latest release, v2.0.0+incompatible, is still affected.
CVE-2026-30405High 7.5
An issue in GoBGP gobgpd v.4.2.0 allows a remote attacker to cause a denial of service via the NEXT_HOP path attribute
Affected: all versions.
No fix released. The latest release, v2.0.0+incompatible, is still affected.
CVE-2025-43973Medium 6.8
An issue was discovered in GoBGP before 3.35.0.
Affected: all versions.
No fix released. The latest release, v2.0.0+incompatible, is still affected.
CVE-2025-43972Medium 6.8
An issue was discovered in GoBGP before 3.35.0.
Affected: all versions.
No fix released. The latest release, v2.0.0+incompatible, is still affected.
CVE-2025-43971High 8.6
An issue was discovered in GoBGP before 3.35.0.
Affected: all versions.
No fix released. The latest release, v2.0.0+incompatible, is still affected.
CVE-2025-43970Medium 4.3
An issue was discovered in GoBGP before 3.35.0.
Affected: all versions.
No fix released. The latest release, v2.0.0+incompatible, is still affected.