{"action":"Upgrade github.com/osrg/gobgp/v4 to 4.4.0 or later.","affected":[{"fixed":"4.4.0","introduced":"0"}],"component":"github.com/osrg/gobgp/v4","cve_ids":["CVE-2026-30405"],"ecosystem":"Go","epss":0.00346,"exploited":false,"fixed_versions":["4.4.0"],"ghsa_id":"GHSA-4p9m-8gc4-rw2h","id":"tcs_01M5KEWZ83CFEGQFXF545ZZPBK","modified_at":"2026-10-02T23:00:34.171213822Z","published_at":"2026-03-16T18:32:03Z","references":["https://osv.dev/vulnerability/GHSA-4p9m-8gc4-rw2h","https://nvd.nist.gov/vuln/detail/CVE-2026-30405","https://github.com/osrg/gobgp/issues/3305","https://github.com/osrg/gobgp/commit/583080a7258e22cc884162e15b078771aa2c2c80","https://github.com/osrg/gobgp","https://github.com/osrg/gobgp/releases/tag/v4.4.0"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-4p9m-8gc4-rw2h","url":"https://osv.dev/vulnerability/GHSA-4p9m-8gc4-rw2h"}],"summary":"GoBGP vulnerable to a denial of service via the NEXT_HOP path attribute"}