CVE-2026-42285: GoBGP Nil Pointer Dereference Vulnerability in BGP Update Processing
Summary
CVE-2026-42285: GoBGP has a panic in AdjRib.Update via malformed BGP Update message (Nil Pointer Dereference). Affects github.com/osrg/gobgp/v4 versions >= 4.4.0, < 4.5.0. Fixed in 4.5.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GoBGP is an open-source implementation of the Border Gateway Protocol (BGP) designed to facilitate the exchange of routing information between different networks. It is widely used in various networking applications due to its flexibility and performance. However, like any software, it is susceptible to vulnerabilities that can compromise its functionality and security. This specific vulnerability allows unauthenticated remote BGP peers to exploit the system, leading to a denial of service.
Vulnerability Detail
The vulnerability arises from a nil pointer dereference in the AdjRib.Update function when GoBGP processes malformed BGP UPDATE messages. If a BGP peer sends an UPDATE message with inconsistent attribute lengths, GoBGP fails to handle the internal state transition correctly, resulting in a crash of the entire GoBGP process. This can lead to a complete loss of service availability, making the system vulnerable to denial of service attacks.
How To Fix
Latest published version: v4.10.0 as of 22 Oct 2026
go get github.com/osrg/gobgp/v4@v4.10.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.5.0
This is the first release that contains the fix.
go get github.com/osrg/gobgp/v4@v4.5.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement strict validation checks on incoming BGP UPDATE messages to prevent malformed messages from being processed. This may involve filtering out messages that do not conform to expected attribute lengths before they reach the GoBGP processing logic.
Conclusion
CVE-2026-42285 is a significant vulnerability in GoBGP that can lead to a denial of service through nil pointer dereference during BGP UPDATE message processing. It is crucial to update to the patched version to mitigate this risk and ensure the stability of your BGP operations.
See every vulnerability recorded for github.com/osrg/gobgp/v4 →
FAQ
The impact is a remote denial of service (DoS) that can crash the GoBGP process, leading to loss of service.
An unauthenticated remote BGP peer can exploit this vulnerability by sending specially crafted BGP UPDATE messages.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
If you cannot update immediately, implement strict validation checks on incoming BGP UPDATE messages as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/osrg/gobgp/v4.
