Description
GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. In version 4.3.0, a remote Denial of Service (DoS) vulnerability exists in GoBGP due to a nil pointer dereference. When a malformed BGP UPDATE message contains an unrecognized Path Attribute marked as "Well-known," the daemon fails to interrupt the message handling flow. This results in an illegal memory access and a full process crash (panic). This issue has been patched in version 4.4.0.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| osrg | gobgp | = 4.3.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | gobgp | 4.4.0-1 | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | govulncheck-vulndb | 0.0.20260727T201416-160000.1.1 | SUSE-SU-2026:23227-1, SUSE-SU-2026:23216-1 |
| SLES 16.0 | govulncheck-vulndb | 0.0.20260727T201416-160000.1.1 | SUSE-SU-2026:23227-1, SUSE-SU-2026:23216-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 16.0 | govulncheck-vulndb | 0.0.20260727T201416-160000.1.1 | openSUSE-SU-2026:21551-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/osrg/gobgp/v4 | >= 4.3.0, < 4.4.0 | 4.4.0 | GHSA-7235-89m6-f4px |
Advisories 3
- SUSE-SU-2026:23227-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Aug 27, 2026
- SUSE-SU-2026:23216-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Aug 27, 2026
- openSUSE-SU-2026:21551-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Aug 12, 2026