GHSA-FRRJ-87JH-2772 GoBGP confederation validation panics on empty AS_PATH attribute

Found through variant analysis based on CVE-2026-41643 Summary GoBGP accepts a zero-length ASPATH during UPDATE decoding and later panics while validating that attribute for a confederation eBGP peer. The vulnerable path is in the BGP UPDATE validator: a malformed UPDATE that should be rejected a...

PT-2026-57024

Name of the Vulnerable Software and Affected Versions gobgp affected versions not specified Description GoBGP fails to properly handle BGP UPDATE messages containing a zero-length AS PATH attribute. When a configured confederation eBGP peer sends a malformed UPDATE with a syntactically valid AS...

GHSA-PW7P-7FQV-HPJ8 GoBGP: Integer underflow in the BGPUpdate.DecodeFromBytes function

An integer underflow in the BGPUpdate.DecodeFromBytes function /bgp/bgp.go of gobgp v4.3.0 allows attackers to cause a Denial of Service DoS via supplying a crafted BGP UPDATE message...

PT-2026-45955

Name of the Vulnerable Software and Affected Versions gobgp version 4.3.0 Description An integer underflow occurs in the BGPUpdate.DecodeFromBytes function located in /bgp/bgp.go. This allows attackers to cause a Denial of Service DoS by supplying a specially crafted BGP UPDATE message...