CVE-2026-37462: GoBGP Integer Underflow Vulnerability in BGPUpdate.DecodeFromBytes Function
Summary
CVE-2026-37462: GoBGP: Integer underflow in the BGPUpdate.DecodeFromBytes function. Affects github.com/osrg/gobgp/v4 versions < 4.4.0. Fixed in 4.4.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GoBGP is an open-source implementation of the Border Gateway Protocol (BGP) written in Go. It is designed to provide a flexible and efficient way to manage BGP routing. GoBGP is widely used in networking applications and services due to its performance and ease of integration. However, like any software, it is susceptible to vulnerabilities that can compromise its functionality and security.
Vulnerability Detail
An integer underflow in the BGPUpdate.DecodeFromBytes function located in the bgp/bgp.go file of gobgp version 4.3.0 allows attackers to exploit this flaw by sending a specially crafted BGP UPDATE message. This can lead to a Denial of Service (DoS), causing the affected service to become unresponsive. The vulnerability arises from improper handling of integer values, which can result in unexpected behavior when processing BGP messages.
How To Fix
Latest published version: v4.10.0 as of 22 Oct 2026
go get github.com/osrg/gobgp/v4@v4.10.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.4.0
This is the first release that contains the fix.
go get github.com/osrg/gobgp/v4@v4.4.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you are unable to update to the patched version immediately, consider implementing input validation to reject malformed BGP UPDATE messages. This can help mitigate the risk of exploitation until the update can be applied.
Conclusion
The CVE-2026-37462 vulnerability in GoBGP represents a significant risk due to the potential for Denial of Service attacks. It is crucial for users of the affected version to update to version 4.4.0 or later to mitigate this risk. Additionally, utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for github.com/osrg/gobgp/v4 →
FAQ
The vulnerability can lead to a Denial of Service (DoS), making the affected GoBGP service unresponsive.
You can use the Vulert playground at Vulert Scanner to check if your application is affected without needing to sign up.
An integer underflow occurs when an arithmetic operation attempts to create a numeric value that is lower than the minimum representable value for that data type, potentially leading to unexpected behavior.
The CVSS score for this vulnerability is 7.3, indicating a high severity level.
Yes, Vulert provides real-time monitoring and alerts for open-source vulnerabilities using just the Gopkg.lock file.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/osrg/gobgp/v4.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.