CVE-2026-42285

HighCVSS 7.5/10Last modified Oct 26, 2026

Description

GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. In version 4.4.0, an unauthenticated remote BGP peer can trigger a fatal panic in GoBGP by sending a specially crafted BGP UPDATE message. When the server receives a message with inconsistent attribute lengths, it improperly handles the internal state transition to a "withdraw" action, leading to a nil pointer dereference in the AdjRib.Update function. This causes the entire GoBGP process to crash, resulting in a complete loss of service availability. This issue has been patched in version 4.5.0.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-476

Affected software

Vendor	Product	Versions
osrg	gobgp	= 4.4.0

References

https://github.com/osrg/gobgp/releases/tag/v4.5.0Product, Release Notes
https://github.com/osrg/gobgp/security/advisories/GHSA-p3w2-64xm-833jExploit, Vendor Advisory
https://github.com/osrg/gobgp/security/advisories/GHSA-p3w2-64xm-833jExploit, Vendor Advisory

Timeline

Published: May 7, 2026
Last modified: Oct 26, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-422868.4Emlog is an open source website building system. Prior to version 2.6.11, missing CSRF protection in critical admin functions allows attacke CVE-2026-4228710.0Emlog is an open source website building system. Prior to version 2.6.11, direct SQL injection in article creation and update functions allo CVE-2026-4228810.0ChurchCRM is an open-source church management system. Prior to 7.3.2, The fix for CVE-2026-39337 is incomplete. The pre-authentication remot CVE-2026-422898.8ChurchCRM is an open-source church management system. Prior to 7.3.2, UserEditor.php processes user account creation and permission updates CVE-2026-42297.3A flaw has been found in vanna-ai vanna up to 2.0.2. This impacts the function remove_training_data of the file src/vanna/legacy/google/bigq CVE-2026-422907.8protobufjs-cli is the command line add-on for protobuf.js. Prior to 1.2.1 and 2.0.2, pbts invoked JSDoc by building a shell command string f CVE-2026-422916.8SysReptor is a fully customizable pentest reporting platform. From version 2026.4 to before version 2026.27, the endpoints for reading and c CVE-2026-422947.5Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to versions 3.7.14 an CVE-2026-422954.9Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From version 4.0.0 to befor CVE-2026-422968.1Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to versions 3.7.14 an CVE-2026-422978.3Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From version 4.0.0 to befor CVE-2026-422989.8Postiz is an AI social media scheduling tool. Prior to commit da44801, a "Pwn Request" vulnerability in the Build and Publish PR Docker Imag