Skip to main content
cve.nowby Sazabi
← Go
GoPackage

github.com/osrg/gobgp/v4

11 known vulnerabilities (6 high, 5 medium), with the versions each affects and the releases that fix them.

Latest release
v4.11.0 (Nov 1, 2026): affected by CVE-2026-30405
Newest unaffected release
Every release is affected by at least one advisory
Advisories
11 · 6 high, 5 medium
Releases
12 since v4.0.0 (Nov 3, 2025)
Registry
pkg.go.dev
Releases read
Nov 8, 2026

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 11

  • CVE-2026-49838Medium 5.9

    GoBGP confederation validation panics on empty AS_PATH attribute

    Affected: fixed in 4.7.0.

    Fixed in v4.7.0 (released Jun 30, 2026, 72 days before disclosure).

    The latest release, v4.11.0, is not affected.

  • CVE-2026-49837Medium 5.9

    GoBGP: BGP OPEN capability parser may read capability values outside declared CapLen boundaries

    Affected: fixed in 4.6.0.

    Fixed in v4.6.0 (released Jun 1, 2026, 101 days before disclosure).

    The latest release, v4.11.0, is not affected.

  • An integer underflow in the BGPUpdate.DecodeFromBytes function (/bgp/bgp.go) of gobgp v4.3.0 allows attackers to cause a Denial of Service…

    Affected: fixed in 4.4.0.

    Fixed in v4.4.0 (released Apr 1, 2026, 63 days before disclosure).

    The latest release, v4.11.0, is not affected.

  • GoBGP: Remote Denial of Service (Panic) in UpdatePathAttrs4ByteAs via Malformed BGP UPDATE

    Affected: fixed in 4.3.0.

    Fixed in v4.3.0 (released Feb 28, 2026, 68 days before disclosure).

    The latest release, v4.11.0, is not affected.

  • GoBGP: Panic in AdjRib.Update via malformed BGP Update message (Nil Pointer Dereference)

    Affected: from 4.4.0, fixed in 4.5.0; from 4.4.0, fixed in 4.5.0.

    Fixed in v4.5.0 (released Apr 30, 2026, 7 days before disclosure).

    The latest release, v4.11.0, is not affected.

  • GoBGP: Remote Denial of Service (Panic) via Malformed Well-known Path Attribute

    Affected: from 4.3.0, fixed in 4.4.0; from 4.3.0, fixed in 4.4.0.

    Fixed in v4.4.0 (released Apr 1, 2026, 36 days before disclosure).

    The latest release, v4.11.0, is not affected.

  • CVE-2026-7737Medium 6.9

    osrg GoBGP BMP Parser bmp.go BMPStatisticsReport.ParseBody out-of-bounds

    Affected: fixed in 4.4.0.

    Fixed in v4.4.0 (released Apr 1, 2026, 33 days before disclosure).

    The latest release, v4.11.0, is not affected.

  • CVE-2026-7736Medium 6.9

    osrg GoBGP mrt.go parseRibEntry integer underflow

    Affected: fixed in 4.4.0.

    Fixed in v4.4.0 (released Apr 1, 2026, 33 days before disclosure).

    The latest release, v4.11.0, is not affected.

  • CVE-2026-7734Medium 6.9

    osrg GoBGP SRv6 L3 Service prefix_sid.go SRv6L3ServiceAttribute.DecodeFromBytes denial of service

    Affected: fixed in 4.4.0.

    Fixed in v4.4.0 (released Apr 1, 2026, 33 days before disclosure).

    The latest release, v4.11.0, is not affected.

  • An out-of-bounds read in the ParseIP6Extended function (/bgp/bgp.go) of gobgp v4.3.0 allows attackers to cause a Denial of Service (DoS)…

    Affected: fixed in 4.4.0.

    Fixed in v4.4.0 (released Apr 1, 2026, 33 days before disclosure).

    The latest release, v4.11.0, is not affected.

  • An issue in GoBGP gobgpd v.4.2.0 allows a remote attacker to cause a denial of service via the NEXT_HOP path attribute

    Affected: fixed in 4.4.0; all versions.

    No fix released. The latest release, v4.11.0, is still affected.