Go/github.com/osrg/gobgp/v4 CVE-2026-41642: high 7.5, EPSS 0.50%

GoBGP has Remote Denial of Service (Panic) via Malformed Well-known Path Attribute

Action: Upgrade github.com/osrg/gobgp/v4 to 4.4.0 or later.

go get github.com/osrg/gobgp/v4@v4.4.0

Affected

Fixed versions

Sources

• osv: GHSA-7235-89m6-f4px
• https://github.com/osrg/gobgp/security/advisories/GHSA-7235-89m6-f4px
• https://nvd.nist.gov/vuln/detail/CVE-2026-41642
• https://github.com/osrg/gobgp
• https://github.com/osrg/gobgp/releases/tag/v4.4.0

CVE-2026-41642 · published 2026-04-29T20:43:36Z · modified 2026-07-24T19:11:42.596064081Z · JSON