A null pointer dereference vulnerability in GoBGP version 4.4.0 allows unauthenticated remote attackers to cause a complete denial of service via a crafted BGP UPDATE message.

This issue is a null pointer dereference (CWE-476) occurring when the server processes inconsistent attribute lengths, triggered by an unauthenticated remote BGP peer.

A successful exploit results in the complete loss of service availability for the routing daemon. This can disrupt critical network routing operations and cause extended downtime for dependent infrastructure. The CVSS score of 7.5 reflects a high severity threat due to the complete loss of availability via network vector.

Immediate Action: Update GoBGP to version 4.5.0 or later to resolve the vulnerability.

Proactive Monitoring: Monitor BGP peer sessions, routing daemon logs, and process uptime for unexpected crashes or restarts.

Compensating Controls: Implement strict BGP peer authentication and network access control lists to limit which peers can establish a BGP connection with the server.

Public Exploit Available: false

This high severity denial of service vulnerability requires prompt attention because unauthenticated remote attackers can easily crash the routing process. Administrators must apply the version 4.5.0 update immediately to ensure service stability and prevent potential network disruptions.