CVE-2026-41643: 
NixOS vulnerability analysis and mitigation

CVE-2026-41643 is a remote Denial of Service (DoS) vulnerability in GoBGP, an open-source Border Gateway Protocol implementation written in Go. A malformed BGP UPDATE message can trigger a panic: runtime error: index out of range crash in the UpdatePathAttrs4ByteAs function, causing the entire GoBGP process to terminate. All versions up to and including v4.2.0 are affected; the vulnerability was disclosed on April 22, 2026, and published to the GitHub Advisory Database on April 29, 2026. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory).

The root cause is classified as CWE-129 (Improper Validation of Array Index) and resides in internal/pkg/table/message.go within the UpdatePathAttrs4ByteAs function. When a BGP UPDATE message contains both an AS4_PATH (Type 17) attribute appearing before an AS_PATH (Type 2) attribute, and the AS4_PATH is deemed invalid/malformed, GoBGP removes it from the msg.PathAttributes slice (line 112), shifting all subsequent elements left by one position. The function then uses the now-stale asAttrPos index (computed before the deletion) to write back the updated AS_PATH at line 206; because the slice is shorter, this access is out of bounds and triggers a Go runtime panic, crashing the daemon. No authentication or prior session establishment beyond a BGP peer connection is required, and a detailed PoC hex payload is publicly documented in the security advisory (GitHub Advisory).

Successful exploitation causes an immediate, complete crash of the GoBGP process, resulting in a total loss of BGP routing capabilities for the affected deployment. Because the crash occurs inside the FSM (Finite State Machine) handling loop, a single malicious BGP UPDATE message — sent either by a directly peered attacker or propagated through a transit provider — is sufficient to bring down the daemon. There is no confidentiality or integrity impact; the sole consequence is high availability impact, potentially disrupting network routing for all prefixes managed by the affected GoBGP instance (GitHub Advisory).

A proof-of-concept exploit consisting of a specific crafted BGP UPDATE hex payload is publicly available in the GitHub Security Advisory, with detailed reproduction steps (GitHub Advisory). The EPSS score is approximately 0.115% (roughly the 16th percentile), indicating a low but non-negligible probability of exploitation in the near term. There is currently no evidence of in-the-wild exploitation, no known threat actor attribution, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory).

1. Reconnaissance: Identify GoBGP instances (v4.2.0 or earlier) exposed on TCP port 179, using network scanning tools such as Shodan, Censys, or Nmap targeting BGP service banners.
2. Establish BGP session: Establish or spoof a BGP peer connection to the target GoBGP instance. Passive peering mode (as noted in the PoC environment) makes this easier, as the target accepts incoming connections.
3. Craft malicious BGP UPDATE: Construct a BGP UPDATE message where the AS4_PATH attribute (Type 17) appears before the AS_PATH attribute (Type 2) in the path attributes list, with the AS4_PATH set to an invalid/malformed value. The documented PoC payload is:

ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff  # BGP marker
00 22 02 00 00                                    # Length, Type=UPDATE, Withdrawn Routes Len=0
00 0b                                             # Total Path Attribute Length
40 11 01 02                                       # AS4_PATH (Type 17, Flags, Len 1, Val 02)
40 02 04 ff ff de ad                              # AS_PATH (Type 2, Flags, Len 4, Val 0xffffdead)

4. Send the payload: Transmit the crafted UPDATE message to the target over the established BGP TCP session (port 179).
5. Achieve DoS: The GoBGP process immediately crashes with panic: runtime error: index out of range [1] with length 1, terminating all routing functions (GitHub Advisory).

• Logs: GoBGP process logs showing panic: runtime error: index out of range with a stack trace referencing internal/pkg/table/message.go and the UpdatePathAttrs4ByteAs function; sudden process termination entries in system logs (e.g., journalctl or syslog).
• Network: Unexpected or anomalous BGP UPDATE messages on TCP port 179 from unknown or untrusted peers; BGP session resets or flaps immediately following receipt of an UPDATE from a specific peer IP.
• Process: Unexpected termination of the gobgpd process; automatic restart events if a process supervisor (e.g., systemd) is configured; absence of GoBGP in the process list after a BGP session event.
• File System: Core dump files generated by the Go runtime in the GoBGP working directory following a panic event (GitHub Advisory).

Upgrade GoBGP to version 4.3.0 or later, which includes the fix table: fix panic when AS4_PATH appears before AS_PATH (commit 9fe96a9) (GoBGP v4.3.0 Release). As a network-level workaround prior to patching, restrict BGP peering (TCP port 179) to explicitly trusted and known peer IP addresses using firewall rules or BGP session authentication (e.g., MD5 TCP-AO), which reduces the attack surface to only established, authenticated peers. Monitor GoBGP logs for panic errors as an early warning of exploitation attempts (GitHub Advisory).

The vulnerability was noted on Mastodon via The Hacker Wire shortly after public disclosure. Ubuntu issued a security notice (USN-8348-1) addressing GoBGP and other packages, and Tenable published detection plugins (Nessus plugin IDs 313268 and 318621). Community coverage was primarily aggregated through vulnerability tracking services such as VulnDB, CVE Feed, and CIRCL. No major vendor statements beyond the GoBGP maintainer's own advisory and patch release have been identified.