V4: GoBGP: BGP OPEN capability parser may read capability values outside declared CapLen boundaries (CVE-2026-49837)
GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. Versions prior to 4.6.0 contain a BGP OPEN capability parsing issue where several concrete capability decoders may parse data from the full remaining capability buffer instead of the slice bounded by the declared capability length, `CapLen`. A malformed BGP OPEN message can cause bytes from a following capability to be interpreted as part of the current capability. The most security-relevant case is the 4-octet AS capability, where a capability with `CapLen == 0` may cause the parser to read bytes from the following capability as the 4-octet AS value. This parsed value may later affect peer AS validation during BGP session establishment. Version 4.6.0 patches the issue.
AI Analysis
Technical Summary
GoBGP's BGP OPEN capability parser improperly handles the declared capability length (CapLen) in several concrete capability decoders. Instead of restricting parsing to the declared CapLen, these decoders read from the entire remaining capability buffer after the capability header. A proof of concept shows that a capability with CapLen set to zero can cause the parser to read four bytes from the next capability as the 4-octet AS number, potentially altering peer AS validation and capability negotiation during session establishment. The vulnerability is a protocol parser boundary validation flaw affecting GoBGP versions before 4.6.0.
Potential Impact
A remote attacker capable of sending a malformed BGP OPEN message to a vulnerable GoBGP instance can cause the parser to read capability values outside their declared boundaries. This can affect peer AS validation, capability negotiation, and the acceptance or rejection of BGP sessions. The flaw does not result in arbitrary memory corruption, remote code execution, or information disclosure but may cause incorrect interpretation of BGP OPEN messages and session establishment decisions.
Mitigation Recommendations
A patch is available for this vulnerability. Users should upgrade to GoBGP version 4.6.0 or later where this issue is fixed. No additional mitigation steps are required beyond applying the official fix.
V4: GoBGP: BGP OPEN capability parser may read capability values outside declared CapLen boundaries (CVE-2026-49837)
Description
GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. Versions prior to 4.6.0 contain a BGP OPEN capability parsing issue where several concrete capability decoders may parse data from the full remaining capability buffer instead of the slice bounded by the declared capability length, `CapLen`. A malformed BGP OPEN message can cause bytes from a following capability to be interpreted as part of the current capability. The most security-relevant case is the 4-octet AS capability, where a capability with `CapLen == 0` may cause the parser to read bytes from the following capability as the 4-octet AS value. This parsed value may later affect peer AS validation during BGP session establishment. Version 4.6.0 patches the issue.
CVSS v3.1
Score 5.9medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
GoBGP's BGP OPEN capability parser improperly handles the declared capability length (CapLen) in several concrete capability decoders. Instead of restricting parsing to the declared CapLen, these decoders read from the entire remaining capability buffer after the capability header. A proof of concept shows that a capability with CapLen set to zero can cause the parser to read four bytes from the next capability as the 4-octet AS number, potentially altering peer AS validation and capability negotiation during session establishment. The vulnerability is a protocol parser boundary validation flaw affecting GoBGP versions before 4.6.0.
Potential Impact
A remote attacker capable of sending a malformed BGP OPEN message to a vulnerable GoBGP instance can cause the parser to read capability values outside their declared boundaries. This can affect peer AS validation, capability negotiation, and the acceptance or rejection of BGP sessions. The flaw does not result in arbitrary memory corruption, remote code execution, or information disclosure but may cause incorrect interpretation of BGP OPEN messages and session establishment decisions.
Mitigation Recommendations
A patch is available for this vulnerability. Users should upgrade to GoBGP version 4.6.0 or later where this issue is fixed. No additional mitigation steps are required beyond applying the official fix.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-gjrg-jjr3-56cm
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-49837"]
- Ecosystems
- ["Go"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
Threat ID: 6a50ba3c68715ace4357db13
Added to database: 07/10/2026, 09:24:12 UTC
Last enriched: 09/11/2026, 19:44:40 UTC
Last updated: 09/15/2026, 04:25:42 UTC
Views: 143
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.