CVE-2026-30405: GoBGP Denial of Service via NEXT_HOP Path Attribute
Summary
CVE-2026-30405: GoBGP vulnerable to a denial of service via the NEXT_HOP path attribute. Affects github.com/osrg/gobgp/v4 versions < 4.3.0. No fix is published. How to fix ↓
Also tracked for
The same CVE-2026-30405 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GoBGP is an open-source implementation of the Border Gateway Protocol (BGP) written in Go. It is designed to facilitate the exchange of routing information between different networks. GoBGP is widely used in various networking applications due to its flexibility and performance. However, a vulnerability has been identified in version 4.2.0 that allows remote attackers to exploit the NEXT_HOP path attribute, potentially leading to a denial of service.
Vulnerability Detail
The vulnerability in GoBGP arises from improper handling of the NEXT_HOP path attribute, which can be manipulated by a remote attacker. This manipulation can lead to a denial of service, causing the affected system to become unresponsive or crash. The issue is particularly concerning as it can be exploited without authentication, making it accessible to any remote attacker. The vulnerability has been assigned a CVSS score of 7.5, indicating a high severity level.
How To Fix
No fixed version is published for this vulnerability.
To rectify the vulnerability, it is recommended to update GoBGP to the patched version 4.3.0 or later. You can update the package using the following command:
go get -u github.com/osrg/gobgp/v4
This command will fetch the latest version of the GoBGP package, ensuring that you are protected against this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can restrict access to the GoBGP service by implementing firewall rules that limit incoming connections to trusted IP addresses. This will help mitigate the risk of exploitation until the package can be updated.
Conclusion
In summary, CVE-2026-30405 is a significant vulnerability in GoBGP that can lead to denial of service through the NEXT_HOP path attribute. Users are advised to update to version 4.3.0 or later to mitigate this risk. Additionally, utilizing tools like Vulert can enhance your ability to monitor and respond to vulnerabilities in your applications.
See every vulnerability recorded for github.com/osrg/gobgp/v4 →
FAQ
The impact of this vulnerability is a potential denial of service, which can cause the GoBGP service to crash or become unresponsive.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Yes, a patch is available in version 4.3.0 of GoBGP. It is recommended to update to this version or later.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
Vulert monitors and alerts in real-time for open-source vulnerabilities in software using just Gopkg.lock. It helps developers stay informed about potential security issues.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/osrg/gobgp/v4.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.