An out-of-bounds read in the ParseIP6Extended function (/bgp/bgp.go) of gobgp v4.3.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted BGP UPDATE message.

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8348-1 advisory.

    It was discovered that GoBGP incorrectly handled certain specially crafted BGP UPDATE messages. A remote     attacker could possibly use this issue to cause GoBGP to crash, resulting in a denial of service.
    (CVE-2026-37461)

    Yanlei Wang discovered that GoBGP incorrectly handled certain malformed BGP UPDATE messages containing     4-byte AS attributes. A remote attacker could possibly use this issue to cause GoBGP to crash, resulting     in a denial of service. (CVE-2026-41643)

    It was discovered that GoBGP incorrectly handled certain malformed BGP UPDATE messages containing SRv6 L3     Service attributes. A remote attacker could possibly use this issue to cause GoBGP to crash, resulting in     a denial of service. (CVE-2026-7734)

    It was discovered that GoBGP incorrectly handled certain malformed BGP UPDATE messages containing     Accumulated IGP (AIGP) attributes. A remote attacker could possibly use this issue to cause GoBGP to     crash, resulting in a denial of service. (CVE-2026-7735)

    It was discovered that GoBGP incorrectly handled certain malformed Multi- threaded Routing Toolkit (MRT)     routing information entries. A remote attacker could possibly use this issue to cause GoBGP to crash,     resulting in a denial of service. (CVE-2026-7736)

    It was discovered that GoBGP incorrectly handled certain malformed Multi- threaded Routing Toolkit (MRT)     headers. A remote attacker could possibly use this issue to cause GoBGP to crash, resulting in a denial of     service. (CVE-2026-7737)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - An out-of-bounds read in the ParseIP6Extended function (/bgp/bgp.go) of gobgp v4.3.0 allows attackers to
    cause a Denial of Service (DoS) via supplying a crafted BGP UPDATE message. (CVE-2026-37461)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An out-of-bounds read in the ParseIP6Extended function (/bgp/bgp.go) of gobgp v4.3.0 allows attackers to     cause a Denial of Service (DoS) via supplying a crafted BGP UPDATE message. (CVE-2026-37461)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
318621	Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : GoBGP vulnerabilities (USN-8348-1)	Nessus	Ubuntu Local Security Checks	Local	medium
441550	SCA: security update for github.com/osrg/gobgp/v4 (GHSA-wmvj-f67g-qg4g)	Tenable Cloud Security	SCA Checks	Local	high
441550	SCA: security update for github.com/osrg/gobgp/v4 (GHSA-wmvj-f67g-qg4g)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
312618	Linux Distros Unpatched Vulnerability : CVE-2026-37461	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-37461

high

Tenable Plugins

medium

high

high

high