CVE-2026-41642

{
  "id": "CVE-2026-41642",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-07T12:16:17.460",
  "lastModified": "2026-10-26T22:10:00.163",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. In version 4.3.0, a remote Denial of Service (DoS) vulnerability exists in GoBGP due to a nil pointer dereference. When a malformed BGP UPDATE message contains an unrecognized Path Attribute marked as \"Well-known,\" the daemon fails to interrupt the message handling flow. This results in an illegal memory access and a full process crash (panic). This issue has been patched in version 4.4.0."
    },
    {
      "lang": "es",
      "value": "GoBGP es una implementación de código abierto del Border Gateway Protocol (BGP) en el lenguaje de programación Go. En la versión 4.3.0, existe una vulnerabilidad remota de Denegación de Servicio (DoS) en GoBGP debido a una desreferencia de puntero nulo. Cuando un mensaje BGP UPDATE malformado contiene un Atributo de Ruta no reconocido marcado como ’Well-known’, el demonio no logra interrumpir el flujo de manejo de mensajes. Esto resulta en un acceso ilegal a la memoria y un fallo completo del proceso (panic). Este problema ha sido parcheado en la versión 4.4.0."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "osrg",
          "product": "gobgp",
          "versions": [
            {
              "version": "= 4.3.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-07T12:32:55.282153Z",
          "id": "CVE-2026-41642",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-476"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:osrg:gobgp:4.3.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "21D99A4E-C785-427C-AB1C-3EE8B349E686"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/osrg/gobgp/releases/tag/v4.4.0",
      "source": "[email protected]",
      "tags": [
        "Patch",
        "Product"
      ]
    },
    {
      "url": "https://github.com/osrg/gobgp/security/advisories/GHSA-7235-89m6-f4px",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://github.com/osrg/gobgp/security/advisories/GHSA-7235-89m6-f4px",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ]
    }
  ]
}