CVE-2026-41643

{
  "id": "CVE-2026-41643",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-07T12:16:17.623",
  "lastModified": "2026-10-26T21:10:00.170",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. Prior to version 4.3.0, a remote Denial of Service (DoS) vulnerability exists in GoBGP where a malformed BGP UPDATE message can trigger a runtime error: index out of range panic. This occurs during the processing of 4-byte AS attributes when the message structure causes an internal slice index shift that is not properly handled. This issue has been patched in version 4.3.0."
    },
    {
      "lang": "es",
      "value": "GoBGP es una implementación de código abierto del Protocolo de Pasarela Fronteriza (BGP) en el Lenguaje de Programación Go. Antes de la versión 4.3.0, existe una vulnerabilidad remota de denegación de servicio (DoS) en GoBGP donde un mensaje BGP UPDATE malformado puede desencadenar un error en tiempo de ejecución: pánico de índice fuera de rango. Esto ocurre durante el procesamiento de atributos AS de 4 bytes cuando la estructura del mensaje causa un desplazamiento interno del índice de la slice que no se maneja correctamente. Este problema ha sido parcheado en la versión 4.3.0."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "osrg",
          "product": "gobgp",
          "versions": [
            {
              "version": "< 4.3.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-07T13:38:29.253036Z",
          "id": "CVE-2026-41643",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-129"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:osrg:gobgp:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "4.3.0",
              "matchCriteriaId": "163FE6F5-1F81-4932-98B8-0A4847DF0133"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/osrg/gobgp/releases/tag/v4.3.0",
      "source": "[email protected]",
      "tags": [
        "Patch",
        "Release Notes"
      ]
    },
    {
      "url": "https://github.com/osrg/gobgp/security/advisories/GHSA-8rxh-r2p6-7f2q",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://github.com/osrg/gobgp/security/advisories/GHSA-8rxh-r2p6-7f2q",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ]
    }
  ]
}