7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-41643

CVE-2026-41643: GoBGP: Remote Denial of Service (Panic) in UpdatePathAttrs4ByteAs via Malformed BGP UPDATE

GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. Prior to version 4.3.0, a remote Denial of Service (DoS) vulnerability exists in GoBGP where a malformed BGP UPDATE message can trigger a runtime error: index out of range panic. This occurs during the processing of 4-byte AS attributes when the message structure causes an internal slice index shift that is not properly handled. This issue has been patched in version 4.3.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-41643

CVE-2026-41643:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/osrg/gobgp/v4	go	<= 4.2.0	4.3.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, as described, is a remote Denial of Service in GoBGP caused by an 'index out of range' panic. The advisory explicitly points to the UpdatePathAttrs4ByteAs function within internal/pkg/table/message.go as the location of the flaw. The issue arises from improper index handling after removing an element from a slice while iterating over it. By comparing the vulnerable version tag v4.2.0 with the patched version tag v4.3.0, I identified the fixing commit 9fe96a9b92918e782c2d054e305fc96b48f3e8e4. The patch in this commit modifies internal/pkg/table/message.go and adds logic to decrement the asAttrPos index after removing the as4Attr element, but only if the removed element was located before the asAttr element in the slice. This directly confirms the root cause described in the advisory. The vulnerable function is therefore table.UpdatePathAttrs4ByteAs, as it contains the flawed logic that leads to the panic when processing a specially crafted BGP UPDATE message.

Vulnerable functions

table.UpdatePathAttrs4ByteAs

internal/pkg/table/message.go

The vulnerability lies in the `UpdatePathAttrs4ByteAs` function. When processing a BGP UPDATE message, if a malformed AS4_PATH attribute appears before the AS_PATH attribute, the code removes the AS4_PATH attribute from the `msg.PathAttributes` slice. This removal shifts the indices of all subsequent attributes. However, the function fails to adjust the `asAttrPos` index, which was calculated before the removal. When this stale index is used later to access the slice, it can point beyond the new bounds of the slice, triggering a panic and causing a Denial of Service.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.