GoBGP vulnerable to a denial of service via the NEXT_HOP path attribute

Description

References

• nvd.nist.gov/vuln/detail/CVE-2026-30405 · ADVISORY
• osrg/gobgp · WEB
• osrg/gobgp commit 583080a · WEB
• osrg/gobgp · PACKAGE
• osrg/gobgp release v4.4.0 · WEB
• GitHub Advisory GHSA-4p9m-8gc4-rw2h · ADVISORY

Más vulnerabilidades de github.com/osrg/gobgp

• CVE-2026-7737ALTO 7.5A vulnerability was identified in osrg GoBGP up to 4.3.0. Affected by this issue is the function BMPPeerUpNotification.ParseBody/BMPStatisti…
• CVE-2025-43973CRÍTICO 9.8An issue was discovered in GoBGP before 3.35.0. pkg/packet/rtr/rtr.go does not verify that the input length corresponds to a situation in wh…
• CVE-2025-43972ALTO 7.5An issue was discovered in GoBGP before 3.35.0. An attacker can cause a crash in the pkg/packet/bgp/bgp.go flowspec parser by sending fewer …
• CVE-2025-43971ALTO 7.5An issue was discovered in GoBGP before 3.35.0. pkg/packet/bgp/bgp.go allows attackers to cause a panic via a zero value for softwareVersion…
• CVE-2025-43970MEDIO 5.3An issue was discovered in GoBGP before 3.35.0. pkg/packet/mrt/mrt.go does not properly check the input length, e.g., by ensuring that there…