GoPackage

github.com/osrg/gobgp/v3

6 known vulnerabilities (3 high, 3 medium), with the versions each affects and the releases that fix them.

Latest release: v3.37.0 (May 8, 2025): affected by CVE-2026-30405
Newest unaffected release: Every release is affected by at least one advisory
Advisories: 6 · 3 high, 3 medium

Releases: 42 since v3.0.0 (Mar 1, 2022)
Registry: pkg.go.dev
Releases read: Nov 8, 2026

Version timeline

CVE-2026-30405
Affects v3.0.0-rc1 to v3.37.0 (through the newest release)
CVE-2025-43973
Affects v3.0.0-rc1 to v3.34.0 (v3.35.0 is outside it)
CVE-2025-43972
Affects v3.0.0-rc1 to v3.34.0 (v3.35.0 is outside it)
CVE-2025-43971
Affects v3.0.0-rc1 to v3.34.0 (v3.35.0 is outside it)
CVE-2025-43970
Affects v3.0.0-rc1 to v3.34.0 (v3.35.0 is outside it)
CVE-2023-46565
Affects v3.0.0-rc1 to v3.20.0 (v3.21.0 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 6

CVE-2026-30405High 7.5
An issue in GoBGP gobgpd v.4.2.0 allows a remote attacker to cause a denial of service via the NEXT_HOP path attribute
Affected: all versions.
No fix released. The latest release, v3.37.0, is still affected.
CVE-2025-43973Medium 6.8
An issue was discovered in GoBGP before 3.35.0.
Affected: fixed in 3.35.0.
Fixed in v3.35.0 (released Mar 1, 2025, 51 days before disclosure).
The latest release, v3.37.0, is not affected.
CVE-2025-43972Medium 6.8
An issue was discovered in GoBGP before 3.35.0.
Affected: fixed in 3.35.0.
Fixed in v3.35.0 (released Mar 1, 2025, 51 days before disclosure).
The latest release, v3.37.0, is not affected.
CVE-2025-43971High 8.6
An issue was discovered in GoBGP before 3.35.0.
Affected: from 3.11.0, fixed in 3.35.0; fixed in 3.35.0.
Fixed in v3.35.0 (released Mar 1, 2025, 51 days before disclosure).
The latest release, v3.37.0, is not affected.
CVE-2025-43970Medium 4.3
An issue was discovered in GoBGP before 3.35.0.
Affected: fixed in 3.35.0.
Fixed in v3.35.0 (released Mar 1, 2025, 51 days before disclosure).
The latest release, v3.37.0, is not affected.
CVE-2023-46565High 7.5
Buffer Overflow vulnerability in osrg gobgp commit 419c50dfac578daa4d11256904d0dc182f1a9b22 allows a remote attacker to cause a denial of…
Affected: fixed in 3.20.0; through 3.20.0.
Fixed in v3.21.0 (released Dec 1, 2023, 150 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).
The latest release, v3.37.0, is not affected.