~ / search / GHSA-pw7p-7fqv-hpj8

GHSA-pw7p-7fqv-hpj8

GoBGP: Integer underflow in the BGPUpdate.DecodeFromBytes function

Source: GitHub Advisory Database (reviewed) High CVE-2026-37462

Packages

EcosystemPackageAffectedFixed in
Go github.com/osrg/gobgp/v4 < 4.4.0 4.4.0

Details

As written in the advisory (Markdown source, shown as plain text).

An integer underflow in the BGPUpdate.DecodeFromBytes function (/bgp/bgp.go) of gobgp v4.3.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted BGP UPDATE message.

References

External links from the advisory. They lead to third-party sites.