CVE-2026-42285

GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. In version 4.4.0, an unauthenticated remote BGP peer can trigger a fatal panic in GoBGP by sending a specially crafted BGP UPDATE message. When the server receives a message with inconsistent attribute lengths, it improperly handles the internal state transition to a "withdraw" action, leading to a nil pointer dereference in the AdjRib.Update function. This causes the entire GoBGP process to crash, resulting in a complete loss of service availability. This issue has been patched in version 4.5.0.

• CWE-476

• https://github.com/osrg/gobgp/releases/tag/v4.5.0Product, Release Notes
• https://github.com/osrg/gobgp/security/advisories/GHSA-p3w2-64xm-833jExploit, Vendor Advisory
• https://github.com/osrg/gobgp/security/advisories/GHSA-p3w2-64xm-833jExploit, Vendor Advisory

Published

May 7, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-4228A vulnerability was detected in LB-LINK BL-WR9000 2.4.9. Thi…9.8
• CVE-2026-42280Auth0.js is a client-side JavaScript library for Auth0. From…7.1
• CVE-2026-42281MagicMirror² is an open source modular smart mirror platform…8.6
• CVE-2026-42282n8n-MCP is an MCP server that provides AI assistants access …4.3
• CVE-2026-42283DevSpace is a client-only developer tool for cloud-native de…7.8
• CVE-2026-42284GitPython is a python library used to interact with Git repo…9.8
• CVE-2026-42286Emlog is an open source website building system. Prior to ve…8.4
• CVE-2026-42287Emlog is an open source website building system. Prior to ve…10
• CVE-2026-42288ChurchCRM is an open-source church management system. Prior …10
• CVE-2026-42289ChurchCRM is an open-source church management system. Prior …8.8
• CVE-2026-4229A flaw has been found in vanna-ai vanna up to 2.0.2. This im…7.3
• CVE-2026-42290protobufjs-cli is the command line add-on for protobuf.js. P…7.8