https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 23:56:26 +0000 https://vulnerability.circl.lu/vuln/cve-2026-41643 <p><strong>Affected:</strong> osrg gobgp</p> <p>GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. Prior to version 4.3.0, a remote Denial of Service (DoS) vulnerability exists in GoBGP where a malformed BGP UPDATE message can trigger a runtime error: index out of range panic. This occurs during the processing of 4-byte AS attributes when the message structure causes an internal slice index shift that is not properly handled. This issue has been patched in version 4.3.0.</p> <p><strong>Affected:</strong> osrg gobgp</p> <p>GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. Prior to version 4.3.0, a remote Denial of Service (DoS) vulnerability exists in GoBGP where a malformed BGP UPDATE message can trigger a runtime error: index out of range panic. This occurs during the processing of 4-byte AS attributes when the message structure causes an internal slice index shift that is not properly handled. This issue has been patched in version 4.3.0.</p> https://vulnerability.circl.lu/vuln/cve-2026-41643 https://vulnerability.circl.lu/vuln/ghsa-8rxh-r2p6-7f2q <p><strong>Affected:</strong> Go: github.com/osrg/gobgp/v4</p> <p>### Summary A remote Denial of Service (DoS) vulnerability exists in GoBGP where a malformed BGP UPDATE message can trigger a runtime error: index out of range panic. This occurs during the processing of 4-byte AS attributes when the message structure causes an internal slice index shift that is not properly handled.</p> <p>### Details The vulnerability is located in internal/pkg/table/message.go within the UpdatePathAttrs4ByteAs function.</p> <p>When GoBGP processes a BGP UPDATE message containing both an AS_PATH and an AS4_PATH attribute, it attempts to merge or validate them to support 4-byte AS numbers. If the attributes are ordered such that AS4_PATH (Type 17) appears before AS_PATH (Type 2), and the AS4_PATH is deemed invalid/malformed, the code attempts to remove the AS4_PATH attribute from the msg.PathAttributes slice. It appears the crash happens due to an index shift in msg.PathAttributes: ``` #GoBGP v4.2.0 // Line 112: If AS4_PATH precedes AS_PATH, the deletion causes all subsequent attributes to shift left. msg.PathAttributes = append(msg.PathAttributes[:as4AttrPos], msg.PathAttributes[as4AttrPos+1:]...)</p> <p>// Line 206: The stale asAttrPos index is used here. //The function continues to use the stale index (asAttrPos) to update the AS_PATH. Since the slice length has decreased, accessing the old index leads to a panic. msg.PathAttributes[asAttrPos] = bgp.NewPathAttributeAsPath(newIntfParams) ``` This deletion causes all subsequent attributes in the slice to shift left by one p…</p> <p><strong>Affected:</strong> Go: github.com/osrg/gobgp/v4</p> <p>### Summary A remote Denial of Service (DoS) vulnerability exists in GoBGP where a malformed BGP UPDATE message can trigger a runtime error: index out of range panic. This occurs during the processing of 4-byte AS attributes when the message structure causes an internal slice index shift that is not properly handled.</p> <p>### Details The vulnerability is located in internal/pkg/table/message.go within the UpdatePathAttrs4ByteAs function.</p> <p>When GoBGP processes a BGP UPDATE message containing both an AS_PATH and an AS4_PATH attribute, it attempts to merge or validate them to support 4-byte AS numbers. If the attributes are ordered such that AS4_PATH (Type 17) appears before AS_PATH (Type 2), and the AS4_PATH is deemed invalid/malformed, the code attempts to remove the AS4_PATH attribute from the msg.PathAttributes slice. It appears the crash happens due to an index shift in msg.PathAttributes: ``` #GoBGP v4.2.0 // Line 112: If AS4_PATH precedes AS_PATH, the deletion causes all subsequent attributes to shift left. msg.PathAttributes = append(msg.PathAttributes[:as4AttrPos], msg.PathAttributes[as4AttrPos+1:]...)</p> <p>// Line 206: The stale asAttrPos index is used here. //The function continues to use the stale index (asAttrPos) to update the AS_PATH. Since the slice length has decreased, accessing the old index leads to a panic. msg.PathAttributes[asAttrPos] = bgp.NewPathAttributeAsPath(newIntfParams) ``` This deletion causes all subsequent attributes in the slice to shift left by one p…</p> https://vulnerability.circl.lu/vuln/ghsa-8rxh-r2p6-7f2q