GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. Prior to version 4.3.0, a remote Denial of Service (DoS) vulnerability exists in GoBGP where a malformed BGP UPDATE message can trigger a runtime error: index out of range panic. This occurs during the processing of 4-byte AS attributes when the message structure causes an internal slice index shift that is not properly handled. This issue has been patched in version 4.3.0.

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8348-1 advisory.

    It was discovered that GoBGP incorrectly handled certain specially crafted BGP UPDATE messages. A remote     attacker could possibly use this issue to cause GoBGP to crash, resulting in a denial of service.
    (CVE-2026-37461)

    Yanlei Wang discovered that GoBGP incorrectly handled certain malformed BGP UPDATE messages containing     4-byte AS attributes. A remote attacker could possibly use this issue to cause GoBGP to crash, resulting     in a denial of service. (CVE-2026-41643)

    It was discovered that GoBGP incorrectly handled certain malformed BGP UPDATE messages containing SRv6 L3     Service attributes. A remote attacker could possibly use this issue to cause GoBGP to crash, resulting in     a denial of service. (CVE-2026-7734)

    It was discovered that GoBGP incorrectly handled certain malformed BGP UPDATE messages containing     Accumulated IGP (AIGP) attributes. A remote attacker could possibly use this issue to cause GoBGP to     crash, resulting in a denial of service. (CVE-2026-7735)

    It was discovered that GoBGP incorrectly handled certain malformed Multi- threaded Routing Toolkit (MRT)     routing information entries. A remote attacker could possibly use this issue to cause GoBGP to crash,     resulting in a denial of service. (CVE-2026-7736)

    It was discovered that GoBGP incorrectly handled certain malformed Multi- threaded Routing Toolkit (MRT)     headers. A remote attacker could possibly use this issue to cause GoBGP to crash, resulting in a denial of     service. (CVE-2026-7737)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. Prior     to version 4.3.0, a remote Denial of Service (DoS) vulnerability exists in GoBGP where a malformed BGP     UPDATE message can trigger a runtime error: index out of range panic. This occurs during the processing of     4-byte AS attributes when the message structure causes an internal slice index shift that is not properly     handled. This issue has been patched in version 4.3.0. (CVE-2026-41643)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. Prior
    to version 4.3.0, a remote Denial of Service (DoS) vulnerability exists in GoBGP where a malformed BGP
    UPDATE message can trigger a runtime error: index out of range panic. This occurs during the processing of
    4-byte AS attributes when the message structure causes an internal slice index shift that is not properly
    handled. This issue has been patched in version 4.3.0. (CVE-2026-41643)

ID	Name	Product	Family	Severity
318621	Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : GoBGP vulnerabilities (USN-8348-1)	Nessus	Ubuntu Local Security Checks	medium
313268	Linux Distros Unpatched Vulnerability : CVE-2026-41643	Nessus	Misc.	high
441007	SCA: security update for github.com/osrg/gobgp/v4 (GHSA-8rxh-r2p6-7f2q)	Tenable Cloud Security	SCA Checks	high
441007	SCA: security update for github.com/osrg/gobgp/v4 (GHSA-8rxh-r2p6-7f2q)	Tenable Self-Hosted Container Security	SCA Checks	high

Detections

Analytics

CVE-2026-41643

high

Tenable Plugins

medium

high

high

high