VulertSecurity VulertSecurity

Vulnerability Database · Go · Package report

github.com/osrg/gobgp: vulnerability history, versions and safety

github.com/osrg/gobgp is a package in the Go ecosystem. Vulert records 10 vulnerabilities for it across 120 releases, from Apr 2025 to May 2026. Each vulnerability names the versions it affects, the fixed version to move to, and a workaround where no fix has been published.

i
10 vulnerabilities recorded H1 M4 U5
i
9 with no fix published

No patched version yet — these are the ones to plan around.

See the unfixed vulnerabilities →
i
2 in the last 12 months

Most recent disclosure 04 May 2026.

See the disclosure history →
i
0 malicious-package vulnerabilities

No published version shipped hostile code.

See all github.com/osrg/gobgp vulnerabilities

Vulert verdict on github.com/osrg/gobgp v2.0.0+incompatible i

Updated on 23 Oct 2026

Careful: 9 of the 10 vulnerabilities Vulert records for this package have no fix yet. Plan around those, or apply the workaround listed for each. The rest have a fixed version to move to.

Package health score 63/100
  • Security Some issues to review
  • Maintenance Slowing
  • Popularity Key ecosystem project
  • Community Moderate

What to do: Plan around the 9 vulnerabilities with no published fix: each lists the affected range and any workaround that reduces exposure. No fix yet: Vulert alerts you the moment one is published. Monitor it with Vulert →

  • Current release v2.0.0+incompatible — unaffected i
  • Vulnerabilities on record 10 over 1 year · 2 in the last year i
  • Latest disclosure 04 May 2026 i
  • Highest CVSS 8.6 i
  • With no published fix 9 i
  • Stars 4,117 i
  • OpenSSF scorecard 5/10 i
  • Last release 58 months ago i
  • Licence Apache-2.0 i

Version list, release dates, licence and dependants published by the Go module proxy, refreshed 23 Oct 2026. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Versions

Which versions are affected

Every version Vulert tracks for github.com/osrg/gobgp, newest first, with the vulnerabilities recorded against each one. A version showing none has no vulnerability in the Vulert database — open it for the full picture on that release.

i
Version Released Vulert vulnerabilities Licence Fix published Details
v0.0.0-20211201041502-6248c576b118 01 Dec 2021 H1 M4 U5 Apache-2.0 No Details →
v0.0.0-20211124132135-b26d1daf4bb7 24 Nov 2021 H1 M4 U5 Apache-2.0 No Details →
v0.0.0-20211124125903-04899bd77643 24 Nov 2021 H1 M4 U5 Apache-2.0 No Details →
v0.0.0-20211124124650-7014234253b5 24 Nov 2021 H1 M4 U5 Apache-2.0 No Details →
v0.0.0-20211116133055-8d7916080293 16 Nov 2021 H1 M4 U5 Apache-2.0 No Details →
v0.0.0-20211107124155-fdc9534a6a3b 07 Nov 2021 H1 M4 U5 Apache-2.0 No Details →
v0.0.0-20211104201559-211fabd41e9a 04 Nov 2021 H1 M4 U5 Apache-2.0 No Details →
v0.0.0-20211104111258-27b80a935b5f 04 Nov 2021 H1 M4 U5 Apache-2.0 No Details →
v0.0.0-20211104111258-59386648fc89 04 Nov 2021 H1 M4 U5 Apache-2.0 No Details →
v0.0.0-20211104111258-93f1ee1258cc 04 Nov 2021 H1 M4 U5 Apache-2.0 No Details →
v0.0.0-20211104030040-dc85224502e5 04 Nov 2021 H1 M4 U5 Apache-2.0 No Details →
v0.0.0-20211102235811-f98cfbf81a90 02 Nov 2021 H1 M4 U5 Apache-2.0 No Details →
v0.0.0-20211029072201-3510a6f2d810 29 Oct 2021 H1 M4 U5 Apache-2.0 No Details →
v0.0.0-20211018075811-c8e54e7f8a2a 18 Oct 2021 H1 M4 U5 Apache-2.0 No Details →
v0.0.0-20211018075811-d3ee05ad2419 18 Oct 2021 H1 M4 U5 Apache-2.0 No Details →
v0.0.0-20211018044354-313b5cf02cb2 18 Oct 2021 H1 M4 U5 Apache-2.0 No Details →
v0.0.0-20211014214746-1684b45610dd 14 Oct 2021 H1 M4 U5 Apache-2.0 No Details →
v0.0.0-20211014214746-a40bc53502bb 14 Oct 2021 H1 M4 U5 Apache-2.0 No Details →
v0.0.0-20211008200014-8072c4488fef 08 Oct 2021 H1 M4 U5 Apache-2.0 No Details →
v0.0.0-20211001064702-91b91278600d 01 Oct 2021 H1 M4 U5 Apache-2.0 No Details →
v0.0.0-20210909160807-b773e7f92464 09 Sep 2021 H1 M4 U5 Apache-2.0 No Details →
v0.0.0-20210908145037-b931ccd0566e 08 Sep 2021 H1 M4 U5 Apache-2.0 No Details →
v0.0.0-20210901090119-8ab84f8636ee 01 Sep 2021 H1 M4 U5 Apache-2.0 No Details →
v0.0.0-20210828115309-f53acb736b0b 28 Aug 2021 H1 M4 U5 Apache-2.0 No Details →
v0.0.0-20210828112815-d6e7a6676321 28 Aug 2021 H1 M4 U5 Apache-2.0 No Details →
v0.0.0-20210825145426-fc1a1899870a 25 Aug 2021 H1 M4 U5 Apache-2.0 No Details →
v0.0.0-20210824190100-14b7bebfde45 24 Aug 2021 H1 M4 U5 Apache-2.0 No Details →
v0.0.0-20210812224318-0b449fda7d99 12 Aug 2021 H1 M4 U5 Apache-2.0 No Details →
v0.0.0-20210812162113-696ff4de8ec2 12 Aug 2021 H1 M4 U5 Apache-2.0 No Details →
v0.0.0-20210808114610-8fbb5abc7cce 08 Aug 2021 H1 M4 U5 Apache-2.0 No Details →
v0.0.0-20210808112539-f99c06740392 08 Aug 2021 H1 M4 U5 Apache-2.0 No Details →
v0.0.0-20210801043420-9e48a36ed97c 01 Aug 2021 H1 M4 U5 Apache-2.0 No Details →
v0.0.0-20210724231830-3facdfc902d2 24 Jul 2021 H1 M4 U5 Apache-2.0 No Details →
v0.0.0-20210724231826-188778603e9e 24 Jul 2021 H1 M4 U5 Apache-2.0 No Details →
v0.0.0-20210724223027-3e04c3bd0b68 24 Jul 2021 H1 M4 U5 Apache-2.0 No Details →
v0.0.0-20210724221353-4a0ab8240c1e 24 Jul 2021 H1 M4 U5 Apache-2.0 No Details →
v0.0.0-20210701110518-b284a8082ab4 01 Jul 2021 H1 M4 U5 Apache-2.0 No Details →
v0.0.0-20210630015506-c114e04958bf 30 Jun 2021 H1 M4 U5 Apache-2.0 No Details →
v0.0.0-20210629223800-35ec732d8589 29 Jun 2021 H1 M4 U5 Apache-2.0 No Details →
v0.0.0-20210629223800-4f29fd7785b8 29 Jun 2021 H1 M4 U5 Apache-2.0 No Details →
v0.0.0-20210629223800-7f7a3c570b8b 29 Jun 2021 H1 M4 U5 Apache-2.0 No Details →
v0.0.0-20210629223800-8aaeb6d33902 29 Jun 2021 H1 M4 U5 Apache-2.0 No Details →
v0.0.0-20210629223800-92f37d65aa08 29 Jun 2021 H1 M4 U5 Apache-2.0 No Details →
v0.0.0-20210629223800-edda6899101c 29 Jun 2021 H1 M4 U5 Apache-2.0 No Details →
v0.0.0-20210627150427-ee300ba7ae9f 27 Jun 2021 H1 M4 U5 Apache-2.0 No Details →
v0.0.0-20210627144540-0419224a8c74 27 Jun 2021 H1 M4 U5 Apache-2.0 No Details →
v0.0.0-20210613225110-8260b60afefc 13 Jun 2021 H1 M4 U5 Apache-2.0 No Details →
v0.0.0-20210607002943-11eea493bebd 07 Jun 2021 H1 M4 U5 Apache-2.0 No Details →
v0.0.0-20210607002555-3047f6c9b733 07 Jun 2021 H1 M4 U5 Apache-2.0 No Details →
v0.0.0-20210607002554-d277950d0f55 07 Jun 2021 H1 M4 U5 Apache-2.0 No Details →
v0.0.0-20210524065503-94d720ff4064 24 May 2021 H1 M4 U5 Apache-2.0 No Details →
v0.0.0-20210510024417-cbdb752b1084 10 May 2021 H1 M4 U5 Apache-2.0 No Details →
v0.0.0-20210505225800-5fca0300b8da 05 May 2021 H1 M4 U5 Apache-2.0 No Details →
v0.0.0-20210503121111-d1a8400dc698 03 May 2021 H1 M4 U5 Apache-2.0 No Details →
v0.0.0-20210422234015-9e98fcf1d6bb 22 Apr 2021 H1 M4 U5 Apache-2.0 No Details →
v0.0.0-20210402043138-915bfc2d8189 02 Apr 2021 H1 M4 U5 Apache-2.0 No Details →
v0.0.0-20210329185736-34ed2a2ce58e 29 Mar 2021 H1 M4 U5 Apache-2.0 No Details →
v0.0.0-20210329185353-3c437e5aecab 29 Mar 2021 H1 M4 U5 Apache-2.0 No Details →
v0.0.0-20210329185345-76f40ede0d46 29 Mar 2021 H1 M4 U5 Apache-2.0 No Details →
v0.0.0-20210329185325-c1e7463e3616 29 Mar 2021 H1 M4 U5 Apache-2.0 No Details →
v0.0.0-20210319181313-7ff15bfa54ac 19 Mar 2021 H1 M4 U5 Apache-2.0 No Details →
v0.0.0-20210316144434-dfc8ec6437ca 16 Mar 2021 H1 M4 U5 Apache-2.0 No Details →
v0.0.0-20210313234644-390e3127cea7 13 Mar 2021 H1 M4 U5 Apache-2.0 No Details →
v0.0.0-20210313171256-dc708d5bed57 13 Mar 2021 H1 M4 U5 Apache-2.0 No Details →
v0.0.0-20210306121521-4df939a3c9db 06 Mar 2021 H1 M4 U5 Apache-2.0 No Details →
v0.0.0-20210306115835-5b7e12382058 06 Mar 2021 H1 M4 U5 Apache-2.0 No Details →
v0.0.0-20210303004750-cd5671baee53 03 Mar 2021 H1 M4 U5 Apache-2.0 No Details →
v0.0.0-20210303002808-2d73cf8eba6a 03 Mar 2021 H1 M4 U5 Apache-2.0 No Details →
v0.0.0-20210303002808-82d2877c7038 03 Mar 2021 H1 M4 U5 Apache-2.0 No Details →
v0.0.0-20210302053313-5960e8ebd1e3 02 Mar 2021 H1 M4 U5 Apache-2.0 No Details →
v0.0.0-20210301132339-1d80152c34f3 01 Mar 2021 H1 M4 U5 Apache-2.0 No Details →
v0.0.0-20210227000305-f33148428ac2 27 Feb 2021 H1 M4 U5 Apache-2.0 No Details →
v0.0.0-20210225115203-69fd66299fe5 25 Feb 2021 H1 M4 U5 Apache-2.0 No Details →
v0.0.0-20210224053841-3c6f5dafdc58 24 Feb 2021 H1 M4 U5 Apache-2.0 No Details →
v0.0.0-20210223232744-65d094d7f25e 23 Feb 2021 H1 M4 U5 Apache-2.0 No Details →
v0.0.0-20210213120055-c1c2e05058ff 13 Feb 2021 H1 M4 U5 Apache-2.0 No Details →
v0.0.0-20210213095431-3339f97722e3 13 Feb 2021 H1 M4 U5 Apache-2.0 No Details →
v0.0.0-20210203062257-c89a32ea7bbe 03 Feb 2021 H1 M4 U5 Apache-2.0 No Details →
v0.0.0-20210127184339-72027852e236 27 Jan 2021 H1 M4 U5 Apache-2.0 No Details →
v0.0.0-20210123195617-43c62634fdd8 23 Jan 2021 H1 M4 U5 Apache-2.0 No Details →
v0.0.0-20210123000318-4c8ab0d4b509 23 Jan 2021 H1 M4 U5 Apache-2.0 No Details →
v0.0.0-20210123000318-c70d99cc9135 23 Jan 2021 H1 M4 U5 Apache-2.0 No Details →
v0.0.0-20210120002129-89e404be46cf 20 Jan 2021 H1 M4 U5 Apache-2.0 No Details →
v0.0.0-20210112215648-35e733246e1a 12 Jan 2021 H1 M4 U5 Apache-2.0 No Details →
v0.0.0-20210112052527-635128d3e564 12 Jan 2021 H1 M4 U5 Apache-2.0 No Details →
v0.0.0-20210101133947-496b372f7b8d 01 Jan 2021 H1 M4 U5 Apache-2.0 No Details →
v0.0.0-20201220152754-839495d33041 20 Dec 2020 H1 M4 U5 Apache-2.0 No Details →
v0.0.0-20201220151310-055806626162 20 Dec 2020 H1 M4 U5 Apache-2.0 No Details →
v0.0.0-20201216071224-5aa7108d85b6 16 Dec 2020 H1 M4 U5 Apache-2.0 No Details →
v0.0.0-20201214143933-066e79161059 14 Dec 2020 H1 M4 U5 Apache-2.0 No Details →
v0.0.0-20201209150220-c091ec6ae6e0 09 Dec 2020 H1 M4 U5 Apache-2.0 No Details →
v0.0.0-20201202003019-b5913a29e4c5 02 Dec 2020 H1 M4 U5 Apache-2.0 No Details →
v0.0.0-20201201222101-283659d8b70e 01 Dec 2020 H1 M4 U5 Apache-2.0 No Details →
v0.0.0-20201201222101-57068b16fd39 01 Dec 2020 H1 M4 U5 Apache-2.0 No Details →
v0.0.0-20201201222101-ffe50e85d4ab 01 Dec 2020 H1 M4 U5 Apache-2.0 No Details →
v0.0.0-20201130214834-6e4eb286706c 30 Nov 2020 H1 M4 U5 Apache-2.0 No Details →
v0.0.0-20201129222140-0422c608b302 29 Nov 2020 H1 M4 U5 Apache-2.0 No Details →
v0.0.0-20201129222140-63b958b2a7f2 29 Nov 2020 H1 M4 U5 Apache-2.0 No Details →
v0.0.0-20201129222140-cb0c7ce51f89 29 Nov 2020 H1 M4 U5 Apache-2.0 No Details →
v0.0.0-20201129062536-aa1272dc3651 29 Nov 2020 H1 M4 U5 Apache-2.0 No Details →
v0.0.0-20201129032328-b55c32ce65c9 29 Nov 2020 H1 M4 U5 — No Details →
v0.0.0-20201125222948-c5dcfb72a847 25 Nov 2020 H1 M4 U5 — No Details →
v0.0.0-20201125222913-48e55b7c388d 25 Nov 2020 H1 M4 U5 — No Details →
v0.0.0-20201125222818-66413b533579 25 Nov 2020 H1 M4 U5 — No Details →
v0.0.0-20201111032519-17d0b3cce52b 11 Nov 2020 H1 M4 U5 — No Details →
v0.0.0-20201110131726-b44362fddd60 10 Nov 2020 H1 M4 U5 — No Details →
v0.0.0-20201110131726-c0d75f780617 10 Nov 2020 H1 M4 U5 — No Details →
v0.0.0-20201110131726-c595b561669e 10 Nov 2020 H1 M4 U5 — No Details →
v0.0.0-20201109143136-9a5c7f32d305 09 Nov 2020 H1 M4 U5 — No Details →
v0.0.0-20201109141034-3df131c6ba76 09 Nov 2020 H1 M4 U5 — No Details →
v0.0.0-20201109134714-3d51923e3c33 09 Nov 2020 H1 M4 U5 — No Details →
v0.0.0-20201109132139-e67e3739577f 09 Nov 2020 H1 M4 U5 — No Details →
v0.0.0-20201109033507-c297c0b22244 09 Nov 2020 H1 M4 U5 — No Details →
v0.0.0-20201108114148-46b15a7512c6 08 Nov 2020 H1 M4 U5 — No Details →
v0.0.0-20201107035104-e4285293e436 07 Nov 2020 H1 M4 U5 — No Details →
v0.0.0-20201106121510-393d82f955cf 06 Nov 2020 H1 M4 U5 — No Details →
v0.0.0-20201106120855-01aa3f287bd4 06 Nov 2020 H1 M4 U5 — No Details →
v0.0.0-20201106120855-5c979fea68b6 06 Nov 2020 H1 M4 U5 — No Details →
v0.0.0-20201101142815-7ce0dddd4f49 01 Nov 2020 H1 M4 U5 — No Details →
v0.0.0-20201021120912-3d3d6f34381f 21 Oct 2020 H1 M4 U5 — No Details →

The newest 120 of 1,927 versions Vulert tracks. Severity counts are the vulnerabilities recorded against that exact release.

02 Disclosure history

How often vulnerabilities are recorded

  • 2025 8
  • 2026 2

Counted by the year Vulert recorded each vulnerability — the same date the table below shows as disclosed. 2 of the 10 were recorded in the last 12 months.

03 Vulnerabilities

Recorded vulnerabilities for github.com/osrg/gobgp

The 5 most severe of 10 vulnerabilities recorded for this package

Search all 10 in the database →
Vulnerability Severity Fixed version ↓ Disclosed ↓
CVE-2025-43971: GoBGP Zero Value Panic Vulnerability 8.6 high No fix published 21 Apr 2025
CVE-2025-43973: GoBGP Input Length Verification Vulnerability 6.8 medium No fix published 21 Apr 2025
CVE-2025-43972: GoBGP Flowspec Parser Crash Vulnerability 6.8 medium No fix published 21 Apr 2025
CVE-2026-7737: GoBGP Improper Restriction of Operations within the Bounds of a Memory Buffer 5.3 medium 4.4.0 04 May 2026
CVE-2025-43970: GoBGP Input Length Validation Flaw 4.3 medium No fix published 21 Apr 2025

Vulnerability wrong, a fix missing, or a package we should cover? Report it and we will fix the record. Report Vulnerability Provide Feedback

Updated: 23/Oct/2026 · Vulnerabilities in our DB: 524315

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About github.com/osrg/gobgp

Is github.com/osrg/gobgp safe to use?

Vulert records 10 vulnerabilities for github.com/osrg/gobgp in Go: 0 critical, 1 high, 4 medium and 0 low, plus 5 not yet rated. 9 of them have no published fix yet, so those are the ones to avoid or mitigate.

What is github.com/osrg/gobgp's Vulert package health score?

Vulert scores github.com/osrg/gobgp 63/100, which reads as usable, but worth attention. The score weighs the vulnerability record (40), maintenance and release cadence (25), adoption from dependents and stars (20) and community signals such as the OpenSSF scorecard and forks (15).

Which version of github.com/osrg/gobgp should I use?

v2.0.0+incompatible is the version Vulert recommends for the affected releases. The version table above lists every release with the vulnerabilities recorded against it, so you can confirm the range you actually run.

How many vulnerabilities does github.com/osrg/gobgp have?

10 vulnerabilities are recorded for github.com/osrg/gobgp in the Go ecosystem: 0 critical, 1 high, 4 medium and 0 low, plus 5 not yet rated. The ledger on this page lists the same counts next to the date of the most recent disclosure.

How often are new github.com/osrg/gobgp vulnerabilities disclosed?

2 vulnerabilities were recorded for github.com/osrg/gobgp in the last 12 months, and the oldest entry in this database dates to 21 Apr 2025. Recency matters more than a lifetime total: it shows how actively new issues are being disclosed for the package you are considering.

Which versions of github.com/osrg/gobgp are affected?

Each vulnerability on this page lists the affected version range and the fixed version to move to. Open the vulnerability for the version you actually run — fixes are specific to a release line, not to the package as a whole.

How do I monitor github.com/osrg/gobgp for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the github.com/osrg/gobgp version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.