The vulnerability in GoBGP (CVE-2026-49838) arises from improper handling of a zero-length AS_PATH attribute during BGP UPDATE message decoding and validation. The decoder accepts a zero-length AS_PATH without error, resulting in an empty attribute value slice. Later, during validation for confederation eBGP peers, the code accesses the first element of this slice without checking its length, causing an index out of range panic. This allows a remote unauthenticated confederation eBGP peer to trigger a denial of service by sending a single malformed UPDATE message with an empty AS_PATH attribute. The root cause is a missing length check before accessing AS_PATH segments in the validation logic. The issue affects GoBGP versions before 4.7.0. The suggested fix adds a length check to reject empty AS_PATH attributes as malformed, preventing the panic.

A remote unauthenticated confederation eBGP peer can cause a denial of service by sending a malformed BGP UPDATE message with a zero-length AS_PATH attribute. This triggers a runtime panic in the GoBGP process or peer session, potentially terminating the affected goroutine or the entire process if the panic is not recovered. There is no impact on confidentiality, integrity, or authentication, and no code execution or memory corruption is reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The suggested fix involves adding a length check in the AS_PATH validation logic to reject empty AS_PATH attributes for confederation eBGP peers, preventing the panic. Until an official patch is released, network operators should consider filtering or blocking malformed UPDATE messages with zero-length AS_PATH attributes from confederation eBGP peers to mitigate denial of service risk.