Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
21 results
Sep 10, 2026GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language.CVE-2026-49838 · Other software · osrg · reported by GitHubMedium 5.9
GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. Prior to version 4.7.0, GoBGP accepts a zero-length AS_PATH during UPDATE decoding and later panics while validating that attribute for a confederation eBGP peer. The vulnerable path is in the BGP UPDATE validator: a malformed UPDATE that should be rejected as a malformed AS_PATH instead reaches an unchecked `p.Value[0]` access, allowing a configured confederation eBGP peer to trigger a denial of service. Version 4.7.0 patches the issue.
- Product
- gobgp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2026GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language.CVE-2026-49837 · Other software · osrg · reported by GitHubMedium 5.9
GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. Versions prior to 4.6.0 contain a BGP OPEN capability parsing issue where several concrete capability decoders may parse data from the full remaining capability buffer instead of the slice bounded by the declared capability length, `CapLen`. A malformed BGP OPEN message can cause bytes from a following capability to be interpreted as part of the current capability. The most security-relevant case is the 4-octet AS capability, where a capability with `CapLen == 0` may cause the parser to read bytes from the following capability as the 4-octet AS value. This parsed value may later affect peer AS validation during BGP session establishment. Version 4.6.0 patches the issue.
- Product
- gobgp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 3, 2026An integer underflow in the BGPUpdate.DecodeFromBytes function (/bgp/bgp.go) of gobgp v4.3.0 allows attackers to cause a Denial of Service (DoS) via supplying aCVE-2026-37462 · Other software · reported by MITREHigh 7.5
An integer underflow in the BGPUpdate.DecodeFromBytes function (/bgp/bgp.go) of gobgp v4.3.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted BGP UPDATE message.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2026GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language.CVE-2026-42285 · Other software · osrg · reported by GitHubHigh 7.5
GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. In version 4.4.0, an unauthenticated remote BGP peer can trigger a fatal panic in GoBGP by sending a specially crafted BGP UPDATE message. When the server receives a message with inconsistent attribute lengths, it improperly handles the internal state transition to a "withdraw" action, leading to a nil pointer dereference in the AdjRib.Update function. This causes the entire GoBGP process to crash, resulting in a complete loss of service availability. This issue has been patched in version 4.5.0.
- Product
- gobgp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2026GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language.CVE-2026-41643 · Other software · osrg · reported by GitHubHigh 7.5
GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. Prior to version 4.3.0, a remote Denial of Service (DoS) vulnerability exists in GoBGP where a malformed BGP UPDATE message can trigger a runtime error: index out of range panic. This occurs during the processing of 4-byte AS attributes when the message structure causes an internal slice index shift that is not properly handled. This issue has been patched in version 4.3.0.
- Product
- gobgp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2026GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language.CVE-2026-41642 · Other software · osrg · reported by GitHubHigh 7.5
GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. In version 4.3.0, a remote Denial of Service (DoS) vulnerability exists in GoBGP due to a nil pointer dereference. When a malformed BGP UPDATE message contains an unrecognized Path Attribute marked as "Well-known," the daemon fails to interrupt the message handling flow. This results in an illegal memory access and a full process crash (panic). This issue has been patched in version 4.4.0.
- Product
- gobgp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 4, 2026An out-of-bounds read in the ParseIP6Extended function (/bgp/bgp.go) of gobgp v4.3.0 allows attackers to cause a Denial of Service (DoS) via supplying a craftedCVE-2026-37461 · Other software · Osrg · reported by MITREHigh 7.5
An out-of-bounds read in the ParseIP6Extended function (/bgp/bgp.go) of gobgp v4.3.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted BGP UPDATE message.
- Product
- Gobgp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 4, 2026A vulnerability was identified in osrg GoBGP up to 4.3.0.CVE-2026-7737 · Other software · osrg · reported by VulDBMedium 6.9
A vulnerability was identified in osrg GoBGP up to 4.3.0. Affected by this issue is the function BMPPeerUpNotification.ParseBody/BMPStatisticsReport.ParseBody of the file pkg/packet/bmp/bmp.go of the component BMP Parser. The manipulation leads to out-of-bounds read. The attack can be initiated remotely. Upgrading to version 4.4.0 can resolve this issue. The identifier of the patch is bc77597d42335c78464bc8e15a471d887bbdf260. Upgrading the affected component is recommended.
- Product
- GoBGP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 4, 2026A vulnerability was determined in osrg GoBGP up to 4.3.0.CVE-2026-7736 · Other software · osrg · reported by VulDBMedium 6.9
A vulnerability was determined in osrg GoBGP up to 4.3.0. Affected by this vulnerability is the function parseRibEntry of the file pkg/packet/mrt/mrt.go. Executing a manipulation can lead to integer underflow. It is possible to launch the attack remotely. Upgrading to version 4.4.0 addresses this issue. This patch is called 76d911046344a3923cbe573364197aa081944592. It is suggested to upgrade the affected component.
- Product
- GoBGP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 4, 2026A vulnerability was found in osrg GoBGP up to 4.3.0.CVE-2026-7735 · Other software · osrg · reported by VulDBMedium 6.9
A vulnerability was found in osrg GoBGP up to 4.3.0. Affected is the function PathAttributeAigp.DecodeFromBytes of the file pkg/packet/bgp/bgp.go of the component AIGP Attribute Parser. Performing a manipulation results in buffer overflow. It is possible to initiate the attack remotely. Upgrading to version 4.4.0 is able to address this issue. The patch is named 51ad1ada06cb41ce47b7066799981816f50b7ced. The affected component should be upgraded.
- Product
- GoBGP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 4, 2026A vulnerability has been found in osrg GoBGP up to 4.3.0.CVE-2026-7734 · Other software · osrg · reported by VulDBMedium 6.9
A vulnerability has been found in osrg GoBGP up to 4.3.0. This impacts the function SRv6L3ServiceAttribute.DecodeFromBytes of the file pkg/packet/bgp/prefix_sid.go of the component SRv6 L3 Service. Such manipulation of the argument data leads to denial of service. The attack may be performed from remote. Upgrading to version 4.4.0 will fix this issue. The name of the patch is f9f7b55ec258e514be0264871fa645a2c3edad11. You should upgrade the affected component.
- Product
- GoBGP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2026A security vulnerability has been detected in osrg GoBGP up to 4.3.0.CVE-2026-5124 · Other software · osrg · reported by VulDBMedium 6.3
A security vulnerability has been detected in osrg GoBGP up to 4.3.0. Affected is the function BGPHeader.DecodeFromBytes of the file pkg/packet/bgp/bgp.go of the component BGP Header Handler. The manipulation leads to improper access controls. Remote exploitation of the attack is possible. The attack is considered to have high complexity. The exploitability is told to be difficult. The identifier of the patch is f0f24a2a901cbf159260698211ab15c583ced131. To fix this issue, it is recommended to deploy a patch.
- Product
- GoBGP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2026A weakness has been identified in osrg GoBGP up to 4.3.0.CVE-2026-5123 · Other software · osrg · reported by VulDBMedium 6.3
A weakness has been identified in osrg GoBGP up to 4.3.0. This impacts the function DecodeFromBytes of the file pkg/packet/bgp/bgp.go. Executing a manipulation of the argument data[1] can lead to off-by-one. The attack may be launched remotely. Attacks of this nature are highly complex. The exploitability is said to be difficult. This patch is called 67c059413470df64bc20801c46f64058e88f800f. A patch should be applied to remediate this issue.
- Product
- GoBGP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2026A security flaw has been discovered in osrg GoBGP up to 4.3.0.CVE-2026-5122 · Other software · osrg · reported by VulDBMedium 6.3
A security flaw has been discovered in osrg GoBGP up to 4.3.0. This affects the function DecodeFromBytes of the file pkg/packet/bgp/bgp.go of the component BGP OPEN Message Handler. Performing a manipulation of the argument domainNameLen results in improper access controls. The attack may be initiated remotely. A high degree of complexity is needed for the attack. The exploitability is reported as difficult. The patch is named 2b09db390a3d455808363c53e409afe6b1b86d2d. It is suggested to install a patch to address this issue.
- Product
- GoBGP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2026An issue in GoBGP gobgpd v.4.2.0 allows a remote attacker to cause a denial of service via the NEXT_HOP path attributeCVE-2026-30405 · Other software · Osrg · reported by MITREHigh 7.5
An issue in GoBGP gobgpd v.4.2.0 allows a remote attacker to cause a denial of service via the NEXT_HOP path attribute
- Product
- Gobgp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 12, 2025A vulnerability classified as problematic has been found in osrg GoBGP up to 3.37.0.CVE-2025-7464 · Other software · osrg · reported by VulDBMedium 6.3
A vulnerability classified as problematic has been found in osrg GoBGP up to 3.37.0. Affected is the function SplitRTR of the file pkg/packet/rtr/rtr.go. The manipulation leads to out-of-bounds read. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The name of the patch is e748f43496d74946d14fed85c776452e47b99d64. It is recommended to apply a patch to fix this issue.
- Product
- GoBGP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 20, 2025An issue was discovered in GoBGP before 3.35.0.CVE-2025-43973 · Other software · GoBGP · reported by MITREMedium 6.8
An issue was discovered in GoBGP before 3.35.0. pkg/packet/rtr/rtr.go does not verify that the input length corresponds to a situation in which all bytes are available for an RTR message.
- Product
- GoBGP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 20, 2025An issue was discovered in GoBGP before 3.35.0.CVE-2025-43972 · Other software · GoBGP · reported by MITREMedium 6.8
An issue was discovered in GoBGP before 3.35.0. An attacker can cause a crash in the pkg/packet/bgp/bgp.go flowspec parser by sending fewer than 20 bytes in a certain context.
- Product
- GoBGP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 20, 2025An issue was discovered in GoBGP before 3.35.0.CVE-2025-43971 · Other software · GoBGP · reported by MITREHigh 8.6
An issue was discovered in GoBGP before 3.35.0. pkg/packet/bgp/bgp.go allows attackers to cause a panic via a zero value for softwareVersionLen.
- Product
- GoBGP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 20, 2025An issue was discovered in GoBGP before 3.35.0.CVE-2025-43970 · Other software · GoBGP · reported by MITREMedium 4.3
An issue was discovered in GoBGP before 3.35.0. pkg/packet/mrt/mrt.go does not properly check the input length, e.g., by ensuring that there are 12 bytes or 36 bytes (depending on the address family).
- Product
- GoBGP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 29, 2024Buffer Overflow vulnerability in osrg gobgp commit 419c50dfac578daa4d11256904d0dc182f1a9b22 allows a remote attacker to cause a denial of service via the handliCVE-2023-46565 · Other software · osrg · reported by MITREHigh 7.5
Buffer Overflow vulnerability in osrg gobgp commit 419c50dfac578daa4d11256904d0dc182f1a9b22 allows a remote attacker to cause a denial of service via the handlingError function in pkg/server/fsm.go.
- Product
- gobgp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.