gobgp - Debian Package Tracker

general

source: gobgp (main)
version: 4.5.0-1
maintainer: Debian Go Packaging Team (DMD)
uploaders: Vincent Bernat [DMD] – Mathias Gibbens [DMD]
arch: all any
std-ver: 4.7.4
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 2.25.0-2
oldstable: 3.10.0-1
stable: 3.36.0-2
stable-bpo: 4.5.0-1~bpo13+1
testing: 4.5.0-1
unstable: 4.5.0-1

versioned links

2.25.0-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.10.0-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.36.0-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
4.5.0-1~bpo13+1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
4.5.0-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

gobgpd
golang-github-osrg-gobgp-dev

action needed

8 security issues in trixie high

There are 8 open security issues in trixie.

7 important issues:

CVE-2026-7734: A vulnerability has been found in osrg GoBGP up to 4.3.0. This impacts the function SRv6L3ServiceAttribute.DecodeFromBytes of the file pkg/packet/bgp/prefix_sid.go of the component SRv6 L3 Service. Such manipulation of the argument data leads to denial of service. The attack may be performed from remote. Upgrading to version 4.4.0 will fix this issue. The name of the patch is f9f7b55ec258e514be0264871fa645a2c3edad11. You should upgrade the affected component.
CVE-2026-7735: A vulnerability was found in osrg GoBGP up to 4.3.0. Affected is the function PathAttributeAigp.DecodeFromBytes of the file pkg/packet/bgp/bgp.go of the component AIGP Attribute Parser. Performing a manipulation results in buffer overflow. It is possible to initiate the attack remotely. Upgrading to version 4.4.0 is able to address this issue. The patch is named 51ad1ada06cb41ce47b7066799981816f50b7ced. The affected component should be upgraded.
CVE-2026-7736: A vulnerability was determined in osrg GoBGP up to 4.3.0. Affected by this vulnerability is the function parseRibEntry of the file pkg/packet/mrt/mrt.go. Executing a manipulation can lead to integer underflow. It is possible to launch the attack remotely. Upgrading to version 4.4.0 addresses this issue. This patch is called 76d911046344a3923cbe573364197aa081944592. It is suggested to upgrade the affected component.
CVE-2026-7737: A vulnerability was identified in osrg GoBGP up to 4.3.0. Affected by this issue is the function BMPPeerUpNotification.ParseBody/BMPStatisticsReport.ParseBody of the file pkg/packet/bmp/bmp.go of the component BMP Parser. The manipulation leads to out-of-bounds read. The attack can be initiated remotely. Upgrading to version 4.4.0 can resolve this issue. The identifier of the patch is bc77597d42335c78464bc8e15a471d887bbdf260. Upgrading the affected component is recommended.
CVE-2026-30405: An issue in GoBGP gobgpd v.4.2.0 allows a remote attacker to cause a denial of service via the NEXT_HOP path attribute
CVE-2026-37461: An out-of-bounds read in the ParseIP6Extended function (/bgp/bgp.go) of gobgp v4.3.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted BGP UPDATE message.
CVE-2026-41643: GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. Prior to version 4.3.0, a remote Denial of Service (DoS) vulnerability exists in GoBGP where a malformed BGP UPDATE message can trigger a runtime error: index out of range panic. This occurs during the processing of 4-byte AS attributes when the message structure causes an internal slice index shift that is not properly handled. This issue has been patched in version 4.3.0.

1 issue left for the package maintainer to handle:

CVE-2023-46565: (postponed; to be fixed through a stable update) Buffer Overflow vulnerability in osrg gobgp commit 419c50dfac578daa4d11256904d0dc182f1a9b22 allows a remote attacker to cause a denial of service via the handlingError function in pkg/server/fsm.go.

You can find information about how to handle this issue in the security team's documentation.

Created: 2025-07-12 Last update: 2026-05-20 08:32

12 security issues in bookworm high

There are 12 open security issues in bookworm.

7 important issues:

CVE-2026-7734: A vulnerability has been found in osrg GoBGP up to 4.3.0. This impacts the function SRv6L3ServiceAttribute.DecodeFromBytes of the file pkg/packet/bgp/prefix_sid.go of the component SRv6 L3 Service. Such manipulation of the argument data leads to denial of service. The attack may be performed from remote. Upgrading to version 4.4.0 will fix this issue. The name of the patch is f9f7b55ec258e514be0264871fa645a2c3edad11. You should upgrade the affected component.
CVE-2026-7735: A vulnerability was found in osrg GoBGP up to 4.3.0. Affected is the function PathAttributeAigp.DecodeFromBytes of the file pkg/packet/bgp/bgp.go of the component AIGP Attribute Parser. Performing a manipulation results in buffer overflow. It is possible to initiate the attack remotely. Upgrading to version 4.4.0 is able to address this issue. The patch is named 51ad1ada06cb41ce47b7066799981816f50b7ced. The affected component should be upgraded.
CVE-2026-7736: A vulnerability was determined in osrg GoBGP up to 4.3.0. Affected by this vulnerability is the function parseRibEntry of the file pkg/packet/mrt/mrt.go. Executing a manipulation can lead to integer underflow. It is possible to launch the attack remotely. Upgrading to version 4.4.0 addresses this issue. This patch is called 76d911046344a3923cbe573364197aa081944592. It is suggested to upgrade the affected component.
CVE-2026-7737: A vulnerability was identified in osrg GoBGP up to 4.3.0. Affected by this issue is the function BMPPeerUpNotification.ParseBody/BMPStatisticsReport.ParseBody of the file pkg/packet/bmp/bmp.go of the component BMP Parser. The manipulation leads to out-of-bounds read. The attack can be initiated remotely. Upgrading to version 4.4.0 can resolve this issue. The identifier of the patch is bc77597d42335c78464bc8e15a471d887bbdf260. Upgrading the affected component is recommended.
CVE-2026-30405: An issue in GoBGP gobgpd v.4.2.0 allows a remote attacker to cause a denial of service via the NEXT_HOP path attribute
CVE-2026-37461: An out-of-bounds read in the ParseIP6Extended function (/bgp/bgp.go) of gobgp v4.3.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted BGP UPDATE message.
CVE-2026-41643: GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. Prior to version 4.3.0, a remote Denial of Service (DoS) vulnerability exists in GoBGP where a malformed BGP UPDATE message can trigger a runtime error: index out of range panic. This occurs during the processing of 4-byte AS attributes when the message structure causes an internal slice index shift that is not properly handled. This issue has been patched in version 4.3.0.

5 issues left for the package maintainer to handle:

CVE-2023-46565: (postponed; to be fixed through a stable update) Buffer Overflow vulnerability in osrg gobgp commit 419c50dfac578daa4d11256904d0dc182f1a9b22 allows a remote attacker to cause a denial of service via the handlingError function in pkg/server/fsm.go.
CVE-2025-43970: (needs triaging) An issue was discovered in GoBGP before 3.35.0. pkg/packet/mrt/mrt.go does not properly check the input length, e.g., by ensuring that there are 12 bytes or 36 bytes (depending on the address family).
CVE-2025-43971: (needs triaging) An issue was discovered in GoBGP before 3.35.0. pkg/packet/bgp/bgp.go allows attackers to cause a panic via a zero value for softwareVersionLen.
CVE-2025-43972: (needs triaging) An issue was discovered in GoBGP before 3.35.0. An attacker can cause a crash in the pkg/packet/bgp/bgp.go flowspec parser by sending fewer than 20 bytes in a certain context.
CVE-2025-43973: (needs triaging) An issue was discovered in GoBGP before 3.35.0. pkg/packet/rtr/rtr.go does not verify that the input length corresponds to a situation in which all bytes are available for an RTR message.

You can find information about how to handle these issues in the security team's documentation.

Created: 2024-05-01 Last update: 2026-05-20 08:32

Fails to build during reproducibility testing normal

A package building reproducibly enables third parties to verify that the source matches the distributed binaries. It has been identified that this source package produced different results, failed to build or had other issues in a test environment. Please read about how to improve the situation!

Created: 2026-05-17 Last update: 2026-05-21 08:31

1 new commit since last upload, is it time to release? normal

vcswatch reports that this package seems to have new commits in its VCS but has not yet updated debian/changelog. You should consider updating the Debian changelog and uploading this new version into the archive.

Here are the relevant commit logs:

commit 067136e95cb61dba1e5ba1cbfa259260c1bbaf0d
Author: Mathias Gibbens <gibmat@debian.org>
Date:   Sun May 10 13:51:59 2026 +0000

    Update d/changelog with additional fixed CVEs

Created: 2026-05-10 Last update: 2026-05-19 18:00

news

[rss feed]

[2026-05-20] Accepted gobgp 4.5.0-1~bpo13+1 (source amd64 all) into stable-backports (Debian FTP Masters) (signed by: Clément Hermann)
[2026-05-16] gobgp 4.5.0-1 MIGRATED to testing (Debian testing watch)
[2026-05-08] Accepted gobgp 4.5.0-1 (source) into unstable (Mathias Gibbens)
[2026-04-08] gobgp 4.4.0-1 MIGRATED to testing (Debian testing watch)
[2026-04-05] Accepted gobgp 4.4.0-1 (source) into unstable (Mathias Gibbens)
[2026-03-31] gobgp 4.3.0-1 MIGRATED to testing (Debian testing watch)
[2026-03-26] Accepted gobgp 4.3.0-1 (source) into unstable (Mathias Gibbens)
[2025-05-08] gobgp 3.36.0-2 MIGRATED to testing (Debian testing watch)
[2025-04-27] Accepted gobgp 3.36.0-2 (source) into unstable (Mathias Gibbens)
[2025-04-08] gobgp 3.36.0-1 MIGRATED to testing (Debian testing watch)
[2025-04-05] Accepted gobgp 3.36.0-1 (source) into unstable (Mathias Gibbens)
[2025-03-09] gobgp 3.35.0-1 MIGRATED to testing (Debian testing watch)
[2025-03-04] Accepted gobgp 3.35.0-1 (source) into unstable (Mathias Gibbens)
[2025-01-14] gobgp 3.33.0-1 MIGRATED to testing (Debian testing watch)
[2025-01-11] Accepted gobgp 3.33.0-1 (source) into unstable (Mathias Gibbens)
[2024-12-07] gobgp 3.32.0-1 MIGRATED to testing (Debian testing watch)
[2024-12-05] Accepted gobgp 3.32.0-1 (source) into unstable (Mathias Gibbens)
[2024-11-15] gobgp 3.31.0-1 MIGRATED to testing (Debian testing watch)
[2024-11-13] Accepted gobgp 3.31.0-1 (source) into unstable (Mathias Gibbens)
[2024-10-06] gobgp 3.30.0-1 MIGRATED to testing (Debian testing watch)
[2024-10-04] Accepted gobgp 3.30.0-1 (source) into unstable (Mathias Gibbens)
[2024-08-18] gobgp 3.29.0-1 MIGRATED to testing (Debian testing watch)
[2024-08-10] Accepted gobgp 3.29.0-1 (source) into unstable (Mathias Gibbens)
[2024-07-17] gobgp 3.28.0-1 MIGRATED to testing (Debian testing watch)
[2024-07-14] Accepted gobgp 3.28.0-1 (source) into unstable (Mathias Gibbens)
[2024-06-23] gobgp 3.27.0-1 MIGRATED to testing (Debian testing watch)
[2024-06-19] Accepted gobgp 3.27.0-1 (source) into unstable (Mathias Gibbens)
[2024-04-23] gobgp 3.25.0-1 MIGRATED to testing (Debian testing watch)
[2024-04-14] Accepted gobgp 3.25.0-1 (source) into unstable (Mathias Gibbens)
[2024-02-18] gobgp 3.23.0-1 MIGRATED to testing (Debian testing watch)

bugs [bug history graph]

all: 1
RC: 0
I&N: 1
M&W: 0
F&P: 0
patch: 0

links

homepage
lintian
buildd: logs, reproducibility, cross
popcon
browse source code
other distros
security tracker
debian patches
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 3.36.0-2build1