—Go
GO-2026-5713· CVE-2026-37461, GHSA-wmvj-f67g-qg4gGoBGP has an out-of-bounds read in the ParseIP6Extended function in github.com/osrg/gobgp
Modified: 7/7/2026
package
Go/github.com/osrg/gobgp/v4
pkg:go/github.com/osrg/gobgp/v4
—Go
GO-2026-5665· CVE-2026-7734, GHSA-vm3g-8xwv-mxfpGoBGP has an Improper Resource Shutdown or Release in github.com/osrg/gobgp
Modified: 7/7/2026
HIGH7.5Go
GHSA-4p9m-8gc4-rw2h· CVE-2026-30405, GO-2026-4736GoBGP vulnerable to a denial of service via the NEXT_HOP path attribute
Modified: 9/10/2026
HIGH7.5Go
GHSA-7235-89m6-f4px· CVE-2026-41642, GO-2026-5198GoBGP has Remote Denial of Service (Panic) via Malformed Well-known Path Attribute
Modified: 7/24/2026
HIGH7.5Go
GHSA-8rxh-r2p6-7f2q· CVE-2026-41643, GO-2026-5266GoBGP has Remote Denial of Service (Panic) in UpdatePathAttrs4ByteAs via Malformed BGP UPDATE
Modified: 7/24/2026
MEDIUM5.9Go
GHSA-frrj-87jh-2772· CVE-2026-49838, GO-2026-5954GoBGP confederation validation panics on empty AS_PATH attribute
Modified: 9/10/2026
MEDIUM5.9Go
GHSA-gjrg-jjr3-56cm· CVE-2026-49837, GO-2026-5955GoBGP: BGP OPEN capability parser may read capability values outside declared CapLen boundaries
Modified: 7/24/2026
HIGH7.3Go
GHSA-hj4w-qr9j-c4cf· CVE-2026-7736, GO-2026-5427GoBGP has an Integer Underflow Issue
Modified: 7/7/2026
HIGH7.5Go
GHSA-p3w2-64xm-833j· CVE-2026-42285, GO-2026-5525GoBGP has a panic in AdjRib.Update via malformed BGP Update message (Nil Pointer Dereference)
Modified: 7/24/2026
HIGH7.3Go
GHSA-pw7p-7fqv-hpj8· CVE-2026-37462, GO-2026-5971GoBGP: Integer underflow in the BGPUpdate.DecodeFromBytes function
Modified: 7/24/2026
MEDIUM5.3Go
GHSA-vm3g-8xwv-mxfp· CVE-2026-7734, GO-2026-5665GoBGP has an Improper Resource Shutdown or Release
Modified: 7/7/2026
HIGH7.5Go
GHSA-wmvj-f67g-qg4g· CVE-2026-37461, GO-2026-5713GoBGP has an out-of-bounds read in the ParseIP6Extended function
Modified: 7/7/2026
—Go
GO-2026-5699· CVE-2026-7737, GHSA-w88c-9vg8-cmq8GoBGP has Improper Restriction of Operations within the Bounds of a Memory Buffer in github.com/osrg/gobgp
Modified: 7/7/2026
—Go
GO-2026-4736· CVE-2026-30405, GHSA-4p9m-8gc4-rw2hGoBGP vulnerable to a denial of service via the NEXT_HOP path attribute in github.com/osrg/gobgp
Modified: 6/26/2026
—Go
GO-2026-5198· CVE-2026-41642, GHSA-7235-89m6-f4pxGoBGP: Remote Denial of Service (Panic) via Malformed Well-known Path Attribute in github.com/osrg/gobgp
Modified: 7/24/2026
—Go
GO-2026-5266· CVE-2026-41643, GHSA-8rxh-r2p6-7f2qGoBGP: Remote Denial of Service (Panic) in UpdatePathAttrs4ByteAs via Malformed BGP UPDATE in github.com/osrg/gobgp
Modified: 7/24/2026
—Go
GO-2026-5427· CVE-2026-7736, GHSA-hj4w-qr9j-c4cfGoBGP has an Integer Underflow Issue in github.com/osrg/gobgp
Modified: 7/7/2026
—Go
GO-2026-5525· CVE-2026-42285, GHSA-p3w2-64xm-833jGoBGP has a panic in AdjRib.Update via malformed BGP Update message (Nil Pointer Dereference) in github.com/osrg/gobgp
Modified: 7/24/2026
—Go
GO-2026-5954· CVE-2026-49838, GHSA-frrj-87jh-2772GoBGP confederation validation panics on empty AS_PATH attribute in github.com/osrg/gobgp
Modified: 7/24/2026
—Go
GO-2026-5955· CVE-2026-49837, GHSA-gjrg-jjr3-56cmGoBGP: BGP OPEN capability parser may read capability values outside declared CapLen boundaries in github.com/osrg/gobgp
Modified: 7/24/2026
—Go
GO-2026-5971· CVE-2026-37462, GHSA-pw7p-7fqv-hpj8GoBGP: Integer underflow in the BGPUpdate.DecodeFromBytes function in github.com/osrg/gobgp
Modified: 7/24/2026