GoBGP DoS Vulnerability (CVE-2026-41642) Patched in Version 4.4.0

title: GoBGP DoS - Malformed BGP UPDATE Message (CVE-2026-41642)
id: scw-2026-05-07-ai-1
status: experimental
level: high
description: |
  Detects the execution of the GoBGP daemon (gobgpd). This rule serves as a baseline indicator for systems running the vulnerable version of GoBGP. The actual DoS attack involves sending a malformed BGP UPDATE message, which would likely be observed in network traffic or application logs, not directly in process creation events. This rule is a proxy for identifying the potential target.
author: SCW Feed Engine (AI-generated)
date: 2026-05-07
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-41642/
tags:
  - attack.impact
  - attack.t1499
logsource:
    category: process_creation
detection:
  selection:
      Image|endswith:
          - 'gobgpd'
      CommandLine|contains:
          - '--bgp-as'
      # This rule assumes that the gobgpd process is started with specific command line arguments.
      # The actual detection of the malformed BGP UPDATE message would typically happen within the GoBGP application logs or network traffic analysis, which are not directly supported by the provided log source categories and fields.
      # Therefore, this rule focuses on the presence of the GoBGP daemon, which is the target of the vulnerability.
      # A more effective detection would require network traffic analysis or application-level logging.
      condition: selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse