Description
A vulnerability has been found in osrg GoBGP up to 4.3.0. This impacts the function SRv6L3ServiceAttribute.DecodeFromBytes of the file pkg/packet/bgp/prefix_sid.go of the component SRv6 L3 Service. Such manipulation of the argument data leads to denial of service. The attack may be performed from remote. Upgrading to version 4.4.0 will fix this issue. The name of the patch is f9f7b55ec258e514be0264871fa645a2c3edad11. You should upgrade the affected component.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| osrg | GoBGP | 4.0, 4.1, 4.2, 4.3.0 | 4.4.0 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | gobgp | 4.4.0-1 | — |
| Debian 13 | gobgp | No fix yet | — |
| Debian 12 | gobgp | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 25.10 | gobgp | No fix yet | — |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 26.04 LTS | gobgp | 3.36.0-2ubuntu0.1~esm1 | USN-8348-1 |
| Ubuntu Pro 24.04 LTS | gobgp | 3.23.0-1ubuntu0.3+esm4 | USN-8348-1 |
| Ubuntu Pro 22.04 LTS | gobgp | 2.25.0-3ubuntu0.1+esm4 | USN-8348-1 |
| Ubuntu Pro 20.04 LTS | gobgp | 2.12.0-1ubuntu0.1~esm3 | USN-8348-1 |
| Ubuntu Pro 18.04 LTS | gobgp | 1.29-1ubuntu0.1+esm2 | USN-8348-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 16.0 | govulncheck-vulndb | 0.0.20260723T184607-160000.1.1 | openSUSE-SU-2026:21483-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/osrg/gobgp/v4 | < 4.4.0 | 4.4.0 | GHSA-vm3g-8xwv-mxfp |
Advisories 2
- openSUSE-SU-2026:21483-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Jul 31, 2026
- USN-8348-1 gobgp vulnerabilities Ubuntu Security Notices (USN) · Jun 3, 2026
References
- VDB-360909 | osrg GoBGP SRv6 L3 Service prefix_sid.go SRv6L3ServiceAttribute.DecodeFromBytes denial of service vdb-entry technical-description
- VDB-360909 | CTI Indicators (IOB, IOC, TTP, IOA) signature permissions-required
- Submit #807581 | GoBGP 4.3.0 Infinite Loop third-party-advisory
- https://github.com/osrg/gobgp/commit/f9f7b55ec258e514be0264871fa645a2c3edad11 patch
- https://github.com/osrg/gobgp/releases/tag/v4.4.0 patch
- https://github.com/osrg/gobgp/ product