CVE-2026-41643

Katalog CVE

CVSS 7.5 · High EPSS 0,61%

Kerentanan Improper Validation of Array Index pada osrg gobgp. Skor CVSS 3.1 7.5 (High) menurut github.com.

Deskripsi (NVD)

GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. Prior to version 4.3.0, a remote Denial of Service (DoS) vulnerability exists in GoBGP where a malformed BGP UPDATE message can trigger a runtime error: index out of range panic. This occurs during the processing of 4-byte AS attributes when the message structure causes an internal slice index shift that is not properly handled. This issue has been patched in version 4.3.0.

Rincian

Terbit di NVD

7 Mei 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-129: Improper Validation of Array Index

EPSS (30 hari)

0,61% peluang dieksploitasi; lebih tinggi dari 47,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/osrg/gobgp/security/advisories/GHSA-8rxh-r2p6-7f2q exploit · advisory vendor
• https://github.com/osrg/gobgp/releases/tag/v4.3.0 patch · release notes