The GoBGP BGP OPEN capability parser improperly handles the declared capability length (CapLen) in several concrete capability decoders. Instead of restricting parsing to the declared CapLen, some decoders parse from the full remaining capability buffer, allowing malformed BGP OPEN messages to cause capability values to be read from outside their boundaries. A proof of concept shows that a 4-octet AS capability with CapLen set to zero can cause the parser to read the next four bytes as the AS number, potentially affecting peer AS validation and session establishment decisions. The issue is a protocol parser boundary validation flaw and does not result in arbitrary memory corruption, remote code execution, or information disclosure.

A remote attacker able to send malformed BGP OPEN messages to a vulnerable GoBGP instance can cause the parser to read capability values beyond their declared length. This can affect peer AS validation, capability negotiation, and the interpretation of malformed OPEN messages, potentially influencing acceptance or rejection of BGP sessions. There is no indication of memory corruption, code execution, or data leakage from this vulnerability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, carefully validate BGP OPEN messages and consider deploying network-level controls to restrict untrusted BGP peers. Monitor vendor channels for updates regarding patches or official fixes.