https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T00:06:43.531083+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2026-14523 bdu:2026-14523 2026-10-04T00:06:43.566741+00:00 bdu:2026-14523 https://cve.radiocsirt.org/vuln/cleanstart-2026-hu02561 CLEANSTART-2026-HU02561 — Security fix for CVE-2026-49838 applied in: kube-vip 1.2.1-r0 2026-10-04T00:06:43.566774+00:00

Affected: CleanStart: kube-vip

Security vulnerability affects the kube-vip package. This issue is resolved in later releases. See references for vulnerability details.

 https://cve.radiocsirt.org/vuln/euvd-2026-367101 EUVD-2026-367101 2026-10-04T00:06:43.566805+00:00 EUVD-2026-367101 https://cve.radiocsirt.org/vuln/fkie_cve-2026-49838 fkie_cve-2026-49838 2026-10-04T00:06:43.566818+00:00

GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. Prior to version 4.7.0, GoBGP accepts a zero-length AS_PATH during UPDATE decoding and later panics while validating that attribute for a confederation eBGP peer. The vulnerable path is in the BGP UPDATE validator: a malformed UPDATE that should be rejected as a malformed AS_PATH instead reaches an unchecked `p.Value[0]` access, allowing a configured confederation eBGP peer to trigger a denial of service. Version 4.7.0 patches the issue.

 https://cve.radiocsirt.org/vuln/ghsa-frrj-87jh-2772 GHSA-frrj-87jh-2772 — GoBGP confederation validation panics on empty AS_PATH attribute 2026-10-04T00:06:43.566849+00:00

Affected: Go: github.com/osrg/gobgp/v4

Found through variant analysis based on `CVE-2026-41643`

## Summary GoBGP accepts a zero-length AS_PATH during UPDATE decoding and later panics while validating that attribute for a confederation eBGP peer. The vulnerable path is in the BGP UPDATE validator: a malformed UPDATE that should be rejected as a malformed AS_PATH instead reaches an unchecked `p.Value[0]` access, allowing a configured confederation eBGP peer to trigger a denial of service.

## Affected - Project: gobgp - Repo: https://github.com/osrg/gobgp - Pinned ref: c24629411ba49f160d9dc09126f418218127e016

## Root cause An established peer's receive path reads BGP bytes from the network connection in `pkg/server/fsm.go:1267`, parses UPDATE bodies through the BGP message decoder, and validates decoded UPDATEs with peer state at `pkg/server/fsm.go:1849`. The UPDATE decoder walks the path-attribute list in `pkg/packet/bgp/bgp.go:15773` and selects the concrete attribute parser from the attacker-controlled attribute type at `pkg/packet/bgp/bgp.go:15855`. For AS_PATH, `PathAttributeAsPath.DecodeFromBytes` returns nil when the decoded attribute length is zero (`pkg/packet/bgp/bgp.go:11533`, `pkg/packet/bgp/bgp.go:11538`), leaving `p.Value` empty rather than reporting a malformed attribute. Validation then dispatches each decoded attribute through `ValidateAttribute` (`pkg/packet/bgp/validate.go:34`); in the confederation eBGP branch, `pkg/packet/bgp/validate.go:162` indexes `p.Value[0]` before checking that any AS_P…

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-49838 UBUNTU-CVE-2026-49838 2026-10-04T00:06:43.566895+00:00

Affected: Ubuntu:Pro:18.04:LTS: gobgp, Ubuntu:Pro:20.04:LTS: gobgp, Ubuntu:Pro:22.04:LTS: gobgp, Ubuntu:Pro:24.04:LTS: gobgp, Ubuntu:25.10: gobgp, Ubuntu:Pro:26.04:LTS: gobgp

GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. Prior to version 4.7.0, GoBGP accepts a zero-length AS_PATH during UPDATE decoding and later panics while validating that attribute for a confederation eBGP peer. The vulnerable path is in the BGP UPDATE validator: a malformed UPDATE that should be rejected as a malformed AS_PATH instead reaches an unchecked `p.Value[0]` access, allowing a configured confederation eBGP peer to trigger a denial of service. Version 4.7.0 patches the issue.