Gobgp
Vendor:
First CVE: Apr 21, 2025 · Active for 1 year
16
Total CVEs
More Total CVEs than 92% of tracked products
8.0
Avg CVEs / Year
Higher CVE frequency than 94% of tracked products
6.8
Avg CVSS
Higher Avg CVSS than 36% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Gobgp over time
Volume of CVEsAvg CVSS Base Score
First CVE
Apr 21, 2025
15 months ago
Most Recent CVE
May 7, 2026
79 days ago
CVE Severity & Scoring
Gobgp16 CVEs
19%
69%
All CVEs352,708 CVEs
45%
40%
11%
LowMediumHighCritical
Attack Vector
Local0 (0.0%)
Network16 (100.0%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low13 (81.3%)
High3 (18.8%)
Unknown0 (0.0%)
User Interaction
None16 (100.0%)
Unknown0 (0.0%)
Required0 (0.0%)
Privileges Required
Low0 (0.0%)
High0 (0.0%)
None16 (100.0%)
Unknown0 (0.0%)
Top CVEs
Signals from CVEs in this product scope (16 CVEs).
16 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2026-42285HIGH GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. In version 4.4.0, an unauthenticated remote BGP peer can trigger a fatal panic | May 7, 2026 | 7.5 | 30 | NO | NO |
CVE-2026-41643HIGH GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. Prior to version 4.3.0, a remote Denial of Service (DoS) vulnerability exists i | May 7, 2026 | 7.5 | 30 | NO | NO |
CVE-2026-41642HIGH GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. In version 4.3.0, a remote Denial of Service (DoS) vulnerability exists in GoBG | May 7, 2026 | 7.5 | 30 | NO | NO |
CVE-2026-7736HIGH A vulnerability was determined in osrg GoBGP up to 4.3.0. Affected by this vulnerability is the function parseRibEntry of the file pkg/packet/mrt/mrt.go. Executing a manipulation c | May 4, 2026 | 7.5 | 30 | NO | NO |
CVE-2026-7734HIGH A vulnerability has been found in osrg GoBGP up to 4.3.0. This impacts the function SRv6L3ServiceAttribute.DecodeFromBytes of the file pkg/packet/bgp/prefix_sid.go of the component | May 4, 2026 | 7.5 | 30 | NO | NO |
CVE-2025-43973CRITICAL An issue was discovered in GoBGP before 3.35.0. pkg/packet/rtr/rtr.go does not verify that the input length corresponds to a situation in which all bytes are available for an RTR m | Apr 21, 2025 | 9.8 | 30 | NO | NO |
CVE-2026-7737HIGH A vulnerability was identified in osrg GoBGP up to 4.3.0. Affected by this issue is the function BMPPeerUpNotification.ParseBody/BMPStatisticsReport.ParseBody of the file pkg/packe | May 4, 2026 | 7.5 | 29 | NO | NO |
CVE-2026-7735HIGH A vulnerability was found in osrg GoBGP up to 4.3.0. Affected is the function PathAttributeAigp.DecodeFromBytes of the file pkg/packet/bgp/bgp.go of the component AIGP Attribute Pa | May 4, 2026 | 7.3 | 29 | NO | NO |
CVE-2026-37461HIGH An out-of-bounds read in the ParseIP6Extended function (/bgp/bgp.go) of gobgp v4.3.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted BGP UPDATE message. | May 4, 2026 | 7.5 | 28 | NO | NO |
CVE-2026-30405HIGH An issue in GoBGP gobgpd v.4.2.0 allows a remote attacker to cause a denial of service via the NEXT_HOP path attribute | Mar 16, 2026 | 7.5 | 24 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (16 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%
Social Chatter
Signals from CVEs in this product scope (16 CVEs).
Media Mentions
Signals from CVEs in this product scope (16 CVEs).
Top CNAs Publishing CVEs For Gobgp
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 4.4.0 | 1 | 7.5 | 0.4% | 0 | 0 |
| 4.3.0 | 2 | 7.5 | 0.4% | 0 | 0 |
| 4.2.0 | 1 | 7.5 | 0.3% | 0 | 0 |