7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-41642

CVE-2026-41642: GoBGP: Remote Denial of Service (Panic) via Malformed Well-known Path Attribute

GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. In version 4.3.0, a remote Denial of Service (DoS) vulnerability exists in GoBGP due to a nil pointer dereference. When a malformed BGP UPDATE message contains an unrecognized Path Attribute marked as "Well-known," the daemon fails to interrupt the message handling flow. This results in an illegal memory access and a full process crash (panic). This issue has been patched in version 4.4.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-41642

CVE-2026-41642:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/osrg/gobgp/v4	go	= 4.3.0	4.4.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, a remote Denial of Service, is caused by a nil pointer dereference in GoBGP when handling a malformed BGP UPDATE message. The provided vulnerability description and stack trace point directly to the recvMessageloop function in pkg/server/fsm.go. To confirm this and find the exact patch, I first identified the commits between the vulnerable version (v4.3.0) and the patched version (v4.4.0) by comparing their corresponding git tags. Among the commits, 215aee08db47e55f4f8a7741e516951f76a959b4 stood out with the message "fix: prevent nil dereference on BGP UPDATE validation". Analyzing the patch for this commit revealed that the recvMessageloop function incorrectly handled an error from bgp.ValidateUpdateMsg due to a shadowed err variable. The fix involves introducing a new variable, validationErr, to correctly capture and handle the error, thus preventing the nil pointer dereference when logging the error message. The vulnerable function is therefore fsmHandler.recvMessageloop.

Vulnerable functions

fsmHandler.recvMessageloop

pkg/server/fsm.go

The function `recvMessageloop` in `fsm.go` is vulnerable to a nil pointer dereference. Due to variable shadowing, the error returned by `bgp.ValidateUpdateMsg` was not correctly handled. When processing a malformed BGP UPDATE message, the code would attempt to call the `Error()` method on a nil `err` variable, leading to a panic and causing a Denial of Service.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.