GoBGP has an out-of-bounds read in the ParseIP6Extended function

Description

References

• nvd.nist.gov/vuln/detail/CVE-2026-37461 · ADVISORY
• osrg/gobgp commit 362cce3 · WEB
• osrg/gobgp commit 9ce8936 · WEB
• osrg/gobgp · PACKAGE
• osrg/gobgp · WEB
• GitHub Advisory GHSA-wmvj-f67g-qg4g · ADVISORY

More vulnerabilities in github.com/osrg/gobgp/v4

• CVE-2026-49838MEDIUM 5.9GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. Prior to version 4.7.0, GoBGP accepts a…
• CVE-2026-49837MEDIUM 5.9GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. Versions prior to 4.6.0 contain a BGP O…
• CVE-2026-37462HIGH 7.5An integer underflow in the BGPUpdate.DecodeFromBytes function (/bgp/bgp.go) of gobgp v4.3.0 allows attackers to cause a Denial of Service (…
• CVE-2026-42285HIGH 7.5GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. In version 4.4.0, an unauthenticated re…
• CVE-2026-41643HIGH 7.5GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. Prior to version 4.3.0, a remote Denial…