An integer underflow in the BGPUpdate.DecodeFromBytes function (/bgp/bgp.go) of gobgp v4.3.0 allows attackers to cause a Denial of Service (DoS) via supplying a…

An integer underflow vulnerability has been discovered in the BGPUpdate.DecodeFromBytes function of gobgp version 4.3.0. The vulnerability exists in the /bgp/bgp.go file and can be exploited by attackers through crafted BGP UPDATE messages. Successful exploitation leads to Denial of Service conditions. This affects the BGP routing protocol implementation in the gobgp software package. The vulnerability has been assigned CVE-2026-37462 and appears to have a fix available in the project's GitHub repository.