gobgp - Debian Package Tracker

general

source: gobgp (main)
version: 4.7.0-1
maintainer: Debian Go Packaging Team (DMD)
uploaders: Vincent Bernat [DMD] – Mathias Gibbens [DMD]
arch: all any
std-ver: 4.7.4
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 2.25.0-2
oldstable: 3.10.0-1
stable: 3.36.0-2
stable-bpo: 4.7.0-1~bpo13+1
testing: 4.7.0-1
unstable: 4.7.0-1

versioned links

2.25.0-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.10.0-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.36.0-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
4.7.0-1~bpo13+1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
4.7.0-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

gobgpd
golang-github-osrg-gobgp-dev

action needed

1 new commit since last upload, is it time to release? normal

vcswatch reports that this package seems to have new commits in its VCS but has not yet updated debian/changelog. You should consider updating the Debian changelog and uploading this new version into the archive.

Here are the relevant commit logs:

commit 2773229c9e4aee4d9680a487e7affbbe014d5e6b
Author: Marcos Talau <talau@debian.org>
Date:   Sun Jul 19 16:38:30 2026 -0300

    debian/salsa-ci.yml: Add to provide CI tests for Salsa

Created: 2026-07-19 Last update: 2026-07-19 21:20

11 low-priority security issues in trixie low

There are 11 open security issues in trixie.

11 issues left for the package maintainer to handle:

CVE-2026-7734: (needs triaging) A vulnerability has been found in osrg GoBGP up to 4.3.0. This impacts the function SRv6L3ServiceAttribute.DecodeFromBytes of the file pkg/packet/bgp/prefix_sid.go of the component SRv6 L3 Service. Such manipulation of the argument data leads to denial of service. The attack may be performed from remote. Upgrading to version 4.4.0 will fix this issue. The name of the patch is f9f7b55ec258e514be0264871fa645a2c3edad11. You should upgrade the affected component.
CVE-2026-7735: (needs triaging) A vulnerability was found in osrg GoBGP up to 4.3.0. Affected is the function PathAttributeAigp.DecodeFromBytes of the file pkg/packet/bgp/bgp.go of the component AIGP Attribute Parser. Performing a manipulation results in buffer overflow. It is possible to initiate the attack remotely. Upgrading to version 4.4.0 is able to address this issue. The patch is named 51ad1ada06cb41ce47b7066799981816f50b7ced. The affected component should be upgraded.
CVE-2026-7736: (needs triaging) A vulnerability was determined in osrg GoBGP up to 4.3.0. Affected by this vulnerability is the function parseRibEntry of the file pkg/packet/mrt/mrt.go. Executing a manipulation can lead to integer underflow. It is possible to launch the attack remotely. Upgrading to version 4.4.0 addresses this issue. This patch is called 76d911046344a3923cbe573364197aa081944592. It is suggested to upgrade the affected component.
CVE-2026-7737: (needs triaging) A vulnerability was identified in osrg GoBGP up to 4.3.0. Affected by this issue is the function BMPPeerUpNotification.ParseBody/BMPStatisticsReport.ParseBody of the file pkg/packet/bmp/bmp.go of the component BMP Parser. The manipulation leads to out-of-bounds read. The attack can be initiated remotely. Upgrading to version 4.4.0 can resolve this issue. The identifier of the patch is bc77597d42335c78464bc8e15a471d887bbdf260. Upgrading the affected component is recommended.
CVE-2023-46565: (postponed; to be fixed through a stable update) Buffer Overflow vulnerability in osrg gobgp commit 419c50dfac578daa4d11256904d0dc182f1a9b22 allows a remote attacker to cause a denial of service via the handlingError function in pkg/server/fsm.go.
CVE-2026-30405: (needs triaging) An issue in GoBGP gobgpd v.4.2.0 allows a remote attacker to cause a denial of service via the NEXT_HOP path attribute
CVE-2026-37461: (needs triaging) An out-of-bounds read in the ParseIP6Extended function (/bgp/bgp.go) of gobgp v4.3.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted BGP UPDATE message.
CVE-2026-37462: (needs triaging) An integer underflow in the BGPUpdate.DecodeFromBytes function (/bgp/bgp.go) of gobgp v4.3.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted BGP UPDATE message.
CVE-2026-41643: (needs triaging) GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. Prior to version 4.3.0, a remote Denial of Service (DoS) vulnerability exists in GoBGP where a malformed BGP UPDATE message can trigger a runtime error: index out of range panic. This occurs during the processing of 4-byte AS attributes when the message structure causes an internal slice index shift that is not properly handled. This issue has been patched in version 4.3.0.
CVE-2026-49837: (needs triaging)
CVE-2026-49838: (needs triaging)

You can find information about how to handle these issues in the security team's documentation.

Created: 2025-07-12 Last update: 2026-07-14 05:01

15 low-priority security issues in bookworm low

There are 15 open security issues in bookworm.

15 issues left for the package maintainer to handle:

CVE-2026-7734: (postponed; to be fixed through a stable update) A vulnerability has been found in osrg GoBGP up to 4.3.0. This impacts the function SRv6L3ServiceAttribute.DecodeFromBytes of the file pkg/packet/bgp/prefix_sid.go of the component SRv6 L3 Service. Such manipulation of the argument data leads to denial of service. The attack may be performed from remote. Upgrading to version 4.4.0 will fix this issue. The name of the patch is f9f7b55ec258e514be0264871fa645a2c3edad11. You should upgrade the affected component.
CVE-2026-7735: (postponed; to be fixed through a stable update) A vulnerability was found in osrg GoBGP up to 4.3.0. Affected is the function PathAttributeAigp.DecodeFromBytes of the file pkg/packet/bgp/bgp.go of the component AIGP Attribute Parser. Performing a manipulation results in buffer overflow. It is possible to initiate the attack remotely. Upgrading to version 4.4.0 is able to address this issue. The patch is named 51ad1ada06cb41ce47b7066799981816f50b7ced. The affected component should be upgraded.
CVE-2026-7736: (postponed; to be fixed through a stable update) A vulnerability was determined in osrg GoBGP up to 4.3.0. Affected by this vulnerability is the function parseRibEntry of the file pkg/packet/mrt/mrt.go. Executing a manipulation can lead to integer underflow. It is possible to launch the attack remotely. Upgrading to version 4.4.0 addresses this issue. This patch is called 76d911046344a3923cbe573364197aa081944592. It is suggested to upgrade the affected component.
CVE-2026-7737: (postponed; to be fixed through a stable update) A vulnerability was identified in osrg GoBGP up to 4.3.0. Affected by this issue is the function BMPPeerUpNotification.ParseBody/BMPStatisticsReport.ParseBody of the file pkg/packet/bmp/bmp.go of the component BMP Parser. The manipulation leads to out-of-bounds read. The attack can be initiated remotely. Upgrading to version 4.4.0 can resolve this issue. The identifier of the patch is bc77597d42335c78464bc8e15a471d887bbdf260. Upgrading the affected component is recommended.
CVE-2023-46565: (postponed; to be fixed through a stable update) Buffer Overflow vulnerability in osrg gobgp commit 419c50dfac578daa4d11256904d0dc182f1a9b22 allows a remote attacker to cause a denial of service via the handlingError function in pkg/server/fsm.go.
CVE-2025-43970: (needs triaging) An issue was discovered in GoBGP before 3.35.0. pkg/packet/mrt/mrt.go does not properly check the input length, e.g., by ensuring that there are 12 bytes or 36 bytes (depending on the address family).
CVE-2025-43971: (needs triaging) An issue was discovered in GoBGP before 3.35.0. pkg/packet/bgp/bgp.go allows attackers to cause a panic via a zero value for softwareVersionLen.
CVE-2025-43972: (needs triaging) An issue was discovered in GoBGP before 3.35.0. An attacker can cause a crash in the pkg/packet/bgp/bgp.go flowspec parser by sending fewer than 20 bytes in a certain context.
CVE-2025-43973: (needs triaging) An issue was discovered in GoBGP before 3.35.0. pkg/packet/rtr/rtr.go does not verify that the input length corresponds to a situation in which all bytes are available for an RTR message.
CVE-2026-30405: (needs triaging) An issue in GoBGP gobgpd v.4.2.0 allows a remote attacker to cause a denial of service via the NEXT_HOP path attribute
CVE-2026-37461: (postponed; to be fixed through a stable update) An out-of-bounds read in the ParseIP6Extended function (/bgp/bgp.go) of gobgp v4.3.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted BGP UPDATE message.
CVE-2026-37462: (postponed; to be fixed through a stable update) An integer underflow in the BGPUpdate.DecodeFromBytes function (/bgp/bgp.go) of gobgp v4.3.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted BGP UPDATE message.
CVE-2026-41643: (needs triaging) GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. Prior to version 4.3.0, a remote Denial of Service (DoS) vulnerability exists in GoBGP where a malformed BGP UPDATE message can trigger a runtime error: index out of range panic. This occurs during the processing of 4-byte AS attributes when the message structure causes an internal slice index shift that is not properly handled. This issue has been patched in version 4.3.0.
CVE-2026-49837: (postponed; to be fixed through a stable update)
CVE-2026-49838: (postponed; to be fixed through a stable update)

You can find information about how to handle these issues in the security team's documentation.

Created: 2024-05-01 Last update: 2026-07-14 05:01

news

[rss feed]

[2026-07-14] Accepted gobgp 4.7.0-1~bpo13+1 (source) into stable-backports (Mathias Gibbens)
[2026-07-14] gobgp 4.7.0-1 MIGRATED to testing (Debian testing watch)
[2026-07-02] Accepted gobgp 4.7.0-1 (source) into unstable (Mathias Gibbens)
[2026-06-29] gobgp 4.6.0-2 MIGRATED to testing (Debian testing watch)
[2026-06-29] Accepted gobgp 4.6.0-2~bpo13+1 (source) into stable-backports (Mathias Gibbens)
[2026-06-26] Accepted gobgp 4.6.0-2 (source) into unstable (Mathias Gibbens)
[2026-06-10] gobgp 4.6.0-1 MIGRATED to testing (Debian testing watch)
[2026-06-04] Accepted gobgp 4.6.0-1 (source) into unstable (Mathias Gibbens)
[2026-05-20] Accepted gobgp 4.5.0-1~bpo13+1 (source amd64 all) into stable-backports (Debian FTP Masters) (signed by: Clément Hermann)
[2026-05-16] gobgp 4.5.0-1 MIGRATED to testing (Debian testing watch)
[2026-05-08] Accepted gobgp 4.5.0-1 (source) into unstable (Mathias Gibbens)
[2026-04-08] gobgp 4.4.0-1 MIGRATED to testing (Debian testing watch)
[2026-04-05] Accepted gobgp 4.4.0-1 (source) into unstable (Mathias Gibbens)
[2026-03-31] gobgp 4.3.0-1 MIGRATED to testing (Debian testing watch)
[2026-03-26] Accepted gobgp 4.3.0-1 (source) into unstable (Mathias Gibbens)
[2025-05-08] gobgp 3.36.0-2 MIGRATED to testing (Debian testing watch)
[2025-04-27] Accepted gobgp 3.36.0-2 (source) into unstable (Mathias Gibbens)
[2025-04-08] gobgp 3.36.0-1 MIGRATED to testing (Debian testing watch)
[2025-04-05] Accepted gobgp 3.36.0-1 (source) into unstable (Mathias Gibbens)
[2025-03-09] gobgp 3.35.0-1 MIGRATED to testing (Debian testing watch)
[2025-03-04] Accepted gobgp 3.35.0-1 (source) into unstable (Mathias Gibbens)
[2025-01-14] gobgp 3.33.0-1 MIGRATED to testing (Debian testing watch)
[2025-01-11] Accepted gobgp 3.33.0-1 (source) into unstable (Mathias Gibbens)
[2024-12-07] gobgp 3.32.0-1 MIGRATED to testing (Debian testing watch)
[2024-12-05] Accepted gobgp 3.32.0-1 (source) into unstable (Mathias Gibbens)
[2024-11-15] gobgp 3.31.0-1 MIGRATED to testing (Debian testing watch)
[2024-11-13] Accepted gobgp 3.31.0-1 (source) into unstable (Mathias Gibbens)
[2024-10-06] gobgp 3.30.0-1 MIGRATED to testing (Debian testing watch)
[2024-10-04] Accepted gobgp 3.30.0-1 (source) into unstable (Mathias Gibbens)
[2024-08-18] gobgp 3.29.0-1 MIGRATED to testing (Debian testing watch)

bugs [bug history graph]

all: 0

links

homepage
lintian
buildd: logs, reproducibility, cross
popcon
browse source code
other distros
security tracker
debian patches
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 3.36.0-2build1