All vulnerabilities
CVE-2026-30405GHSA-4p9m-8gc4-rw2hGO-2026-4736

github.com/osrg/gobgp/v4: GoBGP vulnerable to a denial of service via the NEXT_HOP path attribute

n/a github.com/osrg/gobgp/v4goLibraries & packages
Open in ThreatlineRecord JSON
CVSS
7.5High
ExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 17 Mar 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.57%Chance of exploitation activity in the next 30 days, higher than 46% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in4.4.0Fixed versionGitHub
Published16 Mar 2026Updated 2 Oct 2026CVE List

What fixes it

  • 4.4.0github.com/osrg/gobgp/v4, goGitHubgo get github.com/osrg/gobgp/v4@v4.4.0
  • 4.4.0github.com/osrg/gobgp/v4, GoOSVgo get github.com/osrg/gobgp/v4@v4.4.0

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

An issue in GoBGP gobgpd v.4.2.0 allows a remote attacker to cause a denial of service via the NEXT_HOP path attribute.

Text from CVE List

Affected versions 3

  • github.com/osrg/gobgp/v4, go<= 4.3.0GitHub
  • n/aaffected: n/aCVE List
  • github.com/osrg/gobgp/v4, Gofrom first release, fixed in 4.4.0OSV

References 5