A AegiFlow
HIGHCVSS 7.5EPSS 0.5%

CVE-2026-30405

GoBGP vulnerable to a denial of service via the NEXT_HOP path attribute

Published
2026-03-16
Modified
2026-10-02
EPSS percentile
44%
Aliases
GHSA-4p9m-8gc4-rw2h
Sources
github-advisory

Summary

An issue in GoBGP gobgpd v.4.2.0 allows a remote attacker to cause a denial of service via the NEXT_HOP path attribute.

Affected packages

EcosystemPackageAffected versionsFixed versions
Gogithub.com/osrg/gobgp/v4—4.4.0

Remediation: Upgrade to 4.4.0 or later.

References

Includes data from the GitHub Advisory Database, licensed under CC-BY 4.0.

CVE® is a registered trademark of The MITRE Corporation. CVE content reproduced under the CVE Terms of Use; copyright designation © MITRE.

EPSS scores provided by the FIRST.org Exploit Prediction Scoring System.