CyberRota Analysis
AI-GeneratedGoBGP versions prior to 4.7.0 are vulnerable to a denial of service due to improper handling of a zero-length AS_PATH during BGP UPDATE decoding, which can lead to a panic when validating this attribute for confederation eBGP peers. This flaw allows an attacker to exploit malformed UPDATE messages, potentially disrupting BGP operations. Organizations using GoBGP should prioritize upgrading to version 4.7.0 or later to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. Prior to version 4.7.0, GoBGP accepts a zero-length AS_PATH during UPDATE decoding and later panics while validating that attribute for a confederation eBGP peer. The vulnerable path is in the BGP UPDATE validator: a malformed UPDATE that should be rejected as a malformed AS_PATH instead reaches an unchecked `p.Value[0]` access, allowing a configured confederation eBGP peer to trigger a denial of service. Version 4.7.0 patches the issue.