A remote Denial of Service vulnerability exists in the GoBGP routing implementation prior to version 4.3.0, allowing unauthenticated attackers to disrupt network infrastructure services.

This flaw involves improper validation of array index values within CWE-129, triggered by a malformed 4-byte AS attribute in a BGP UPDATE message that causes an index out of range panic, requiring no attacker authentication.

A successful exploit of this vulnerability results in a complete crash of the routing daemon, leading to potential network disruption and service downtime. Given the CVSS score of 7.5, the severity is high due to the potential for unauthenticated remote attackers to trigger a high-impact availability disruption against critical routing infrastructure.

Immediate Action: Update osrg GoBGP to version 4.3.0 or later where the array indexing issue is fully patched.

Proactive Monitoring: Monitor network routing logs and daemon process health for unexpected restarts or crash events indicating potential attack attempts.

Compensating Controls: Implement strict BGP peer authentication and edge filtering to limit BGP traffic sources to trusted neighbors only.

Public Exploit Available: No — exploit_available (false / unknown).

Organizations running vulnerable versions of GoBGP face a credible risk of remote service disruption from unauthenticated attackers. Administrators must apply the version 4.3.0 update immediately to ensure robust input validation and maintain continuous network availability.