Description
GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. In version 4.4.0, an unauthenticated remote BGP peer can trigger a fatal panic in GoBGP by sending a specially crafted BGP UPDATE message. When the server receives a message with inconsistent attribute lengths, it improperly handles the internal state transition to a "withdraw" action, leading to a nil pointer dereference in the AdjRib.Update function. This causes the entire GoBGP process to crash, resulting in a complete loss of service availability. This issue has been patched in version 4.5.0.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| osrg | gobgp | = 4.4.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | gobgp | 4.5.0-1 | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | govulncheck-vulndb | 0.0.20260727T201416-160000.1.1 | SUSE-SU-2026:23227-1, SUSE-SU-2026:23216-1 |
| SLES 16.0 | govulncheck-vulndb | 0.0.20260727T201416-160000.1.1 | SUSE-SU-2026:23227-1, SUSE-SU-2026:23216-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 16.0 | govulncheck-vulndb | 0.0.20260727T201416-160000.1.1 | openSUSE-SU-2026:21551-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/osrg/gobgp/v4 | >= 4.4.0, < 4.5.0 | 4.5.0 | GHSA-p3w2-64xm-833j |
Advisories 3
- SUSE-SU-2026:23227-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Aug 27, 2026
- SUSE-SU-2026:23216-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Aug 27, 2026
- openSUSE-SU-2026:21551-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Aug 12, 2026