# github.com/osrg/gobgp/v4 (Go) vulnerabilities 11 known vulnerabilities (6 high, 5 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: v4.11.0 (Nov 1, 2026): affected by CVE-2026-30405 - Newest unaffected release: Every release is affected by at least one advisory - Releases: 12 since v4.0.0 (Nov 3, 2025) - Registry: https://pkg.go.dev/github.com/osrg/gobgp/v4 - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-49838: v4.0.0 to v4.6.0 (v4.7.0 is outside it) - CVE-2026-49837: v4.0.0 to v4.5.0 (v4.6.0 is outside it) - CVE-2026-37462: v4.0.0 to v4.3.0 (v4.4.0 is outside it) - CVE-2026-41643: v4.0.0 to v4.2.0 (v4.3.0 is outside it) - CVE-2026-42285: v4.4.0 (v4.5.0 is outside it) - CVE-2026-41642: v4.3.0 (v4.4.0 is outside it) - CVE-2026-7737: v4.0.0 to v4.3.0 (v4.4.0 is outside it) - CVE-2026-7736: v4.0.0 to v4.3.0 (v4.4.0 is outside it) - CVE-2026-7734: v4.0.0 to v4.3.0 (v4.4.0 is outside it) - CVE-2026-37461: v4.0.0 to v4.3.0 (v4.4.0 is outside it) - CVE-2026-30405: v4.0.0 to v4.11.0 (through the newest release) ## Advisories (11) ### [CVE-2026-49838](https://cve.now/CVE-2026-49838): GoBGP confederation validation panics on empty AS\_PATH attribute - Severity: Medium 5.9 - Published: Sep 10, 2026 - Affected: fixed in 4.7.0. - Fixed in v4.7.0 (released Jun 30, 2026, 72 days before disclosure). - The latest release, v4.11.0, is not affected. ### [CVE-2026-49837](https://cve.now/CVE-2026-49837): GoBGP: BGP OPEN capability parser may read capability values outside declared CapLen boundaries - Severity: Medium 5.9 - Published: Sep 10, 2026 - Affected: fixed in 4.6.0. - Fixed in v4.6.0 (released Jun 1, 2026, 101 days before disclosure). - The latest release, v4.11.0, is not affected. ### [CVE-2026-37462](https://cve.now/CVE-2026-37462): An integer underflow in the BGPUpdate.DecodeFromBytes function (/bgp/bgp.go) of gobgp v4.3.0 allows attackers to cause a Denial of Service… - Severity: High 7.5 - Published: Jun 3, 2026 - Affected: fixed in 4.4.0. - Fixed in v4.4.0 (released Apr 1, 2026, 63 days before disclosure). - The latest release, v4.11.0, is not affected. ### [CVE-2026-41643](https://cve.now/CVE-2026-41643): GoBGP: Remote Denial of Service (Panic) in UpdatePathAttrs4ByteAs via Malformed BGP UPDATE - Severity: High 7.5 - Published: May 7, 2026 - Affected: fixed in 4.3.0. - Fixed in v4.3.0 (released Feb 28, 2026, 68 days before disclosure). - The latest release, v4.11.0, is not affected. ### [CVE-2026-42285](https://cve.now/CVE-2026-42285): GoBGP: Panic in AdjRib.Update via malformed BGP Update message (Nil Pointer Dereference) - Severity: High 7.5 - Published: May 7, 2026 - Affected: from 4.4.0, fixed in 4.5.0; from 4.4.0, fixed in 4.5.0. - Fixed in v4.5.0 (released Apr 30, 2026, 7 days before disclosure). - The latest release, v4.11.0, is not affected. ### [CVE-2026-41642](https://cve.now/CVE-2026-41642): GoBGP: Remote Denial of Service (Panic) via Malformed Well-known Path Attribute - Severity: High 7.5 - Published: May 7, 2026 - Affected: from 4.3.0, fixed in 4.4.0; from 4.3.0, fixed in 4.4.0. - Fixed in v4.4.0 (released Apr 1, 2026, 36 days before disclosure). - The latest release, v4.11.0, is not affected. ### [CVE-2026-7737](https://cve.now/CVE-2026-7737): osrg GoBGP BMP Parser bmp.go BMPStatisticsReport.ParseBody out-of-bounds - Severity: Medium 6.9 - Published: May 4, 2026 - Affected: fixed in 4.4.0. - Fixed in v4.4.0 (released Apr 1, 2026, 33 days before disclosure). - The latest release, v4.11.0, is not affected. ### [CVE-2026-7736](https://cve.now/CVE-2026-7736): osrg GoBGP mrt.go parseRibEntry integer underflow - Severity: Medium 6.9 - Published: May 4, 2026 - Affected: fixed in 4.4.0. - Fixed in v4.4.0 (released Apr 1, 2026, 33 days before disclosure). - The latest release, v4.11.0, is not affected. ### [CVE-2026-7734](https://cve.now/CVE-2026-7734): osrg GoBGP SRv6 L3 Service prefix\_sid.go SRv6L3ServiceAttribute.DecodeFromBytes denial of service - Severity: Medium 6.9 - Published: May 4, 2026 - Affected: fixed in 4.4.0. - Fixed in v4.4.0 (released Apr 1, 2026, 33 days before disclosure). - The latest release, v4.11.0, is not affected. ### [CVE-2026-37461](https://cve.now/CVE-2026-37461): An out-of-bounds read in the ParseIP6Extended function (/bgp/bgp.go) of gobgp v4.3.0 allows attackers to cause a Denial of Service (DoS)… - Severity: High 7.5 - Published: May 4, 2026 - Affected: fixed in 4.4.0. - Fixed in v4.4.0 (released Apr 1, 2026, 33 days before disclosure). - The latest release, v4.11.0, is not affected. ### [CVE-2026-30405](https://cve.now/CVE-2026-30405): An issue in GoBGP gobgpd v.4.2.0 allows a remote attacker to cause a denial of service via the NEXT\_HOP path attribute - Severity: High 7.5 - Published: Mar 16, 2026 - Affected: fixed in 4.4.0; all versions. - No fix released. The latest release, v4.11.0, is still affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/go/github.com/osrg/gobgp/v4 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.