V4: GoBGP: BGP OPEN capability parser may read capability values outside declared CapLen boundaries (CVE-2026-49837)
### Summary GoBGP contains a BGP OPEN capability parsing issue where several concrete capability decoders may parse data from the full remaining capability buffer instead of the slice bounded by the declared capability length, `CapLen`. A malformed BGP OPEN message can cause bytes from a following capability to be interpreted as part of the current capability. The most security-relevant case is the 4-octet AS capability, where a capability with `CapLen == 0` may cause the parser to read bytes from the following capability as the 4-octet AS value. This parsed value may later affect peer AS validation during BGP session establishment. ### Details The issue is in the BGP OPEN capability parser under: - `pkg/packet/bgp/bgp.go` - `pkg/packet/bgp/validate.go` - The BGP OPEN optional parameter capability format includes a capability code, a capability length field, and a capability value. Each concrete capability decoder should only parse bytes inside the declared capability value boundary. In affected versions, the generic capability parser records the declared `CapLen`, but several concrete capability decoders continue parsing from the full remaining capability buffer after advancing past the two-byte capability header. Conceptually, the vulnerable pattern is: ```go data = data[2:] // decoder reads from data without first limiting it to CapLen ### PoC The following parser-level proof of concept demonstrates the issue without requiring a full BGP session or a running `bgpd` instance. The malformed capability uses: - Capability Code: `65` (`BGP_CAP_FOUR_OCTET_AS_NUMBER`) - Declared `CapLen`: `0` - Four following bytes: `00 00 fd e8` Although the capability declares an empty value, affected versions parse the following four bytes as the 4-octet AS value `65000`. ### Impact A remote peer that can send a malformed BGP OPEN message to a GoBGP instance may cause capability values to be parsed from outside their declared `CapLen` boundaries. In the 4-octet AS capability case, this may affect: - peer AS validation; - capability negotiation; - interpretation of malformed OPEN messages; - acceptance or rejection decisions during BGP session establishment. This issue does not appear to be arbitrary memory corruption, remote code execution, or information disclosure. It is a protocol parser boundary validation issue that can affect BGP OPEN validation semantics.
AI Analysis
Technical Summary
The GoBGP BGP OPEN capability parser improperly handles the declared capability length (CapLen) in several concrete capability decoders. Instead of restricting parsing to the declared CapLen, some decoders parse from the full remaining capability buffer, allowing malformed BGP OPEN messages to cause capability values to be read from outside their boundaries. A proof of concept shows that a 4-octet AS capability with CapLen set to zero can cause the parser to read the next four bytes as the AS number, potentially affecting peer AS validation and session establishment decisions. The issue is a protocol parser boundary validation flaw and does not result in arbitrary memory corruption, remote code execution, or information disclosure.
Potential Impact
A remote attacker able to send malformed BGP OPEN messages to a vulnerable GoBGP instance can cause the parser to read capability values beyond their declared length. This can affect peer AS validation, capability negotiation, and the interpretation of malformed OPEN messages, potentially influencing acceptance or rejection of BGP sessions. There is no indication of memory corruption, code execution, or data leakage from this vulnerability.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, carefully validate BGP OPEN messages and consider deploying network-level controls to restrict untrusted BGP peers. Monitor vendor channels for updates regarding patches or official fixes.
V4: GoBGP: BGP OPEN capability parser may read capability values outside declared CapLen boundaries (CVE-2026-49837)
Description
### Summary GoBGP contains a BGP OPEN capability parsing issue where several concrete capability decoders may parse data from the full remaining capability buffer instead of the slice bounded by the declared capability length, `CapLen`. A malformed BGP OPEN message can cause bytes from a following capability to be interpreted as part of the current capability. The most security-relevant case is the 4-octet AS capability, where a capability with `CapLen == 0` may cause the parser to read bytes from the following capability as the 4-octet AS value. This parsed value may later affect peer AS validation during BGP session establishment. ### Details The issue is in the BGP OPEN capability parser under: - `pkg/packet/bgp/bgp.go` - `pkg/packet/bgp/validate.go` - The BGP OPEN optional parameter capability format includes a capability code, a capability length field, and a capability value. Each concrete capability decoder should only parse bytes inside the declared capability value boundary. In affected versions, the generic capability parser records the declared `CapLen`, but several concrete capability decoders continue parsing from the full remaining capability buffer after advancing past the two-byte capability header. Conceptually, the vulnerable pattern is: ```go data = data[2:] // decoder reads from data without first limiting it to CapLen ### PoC The following parser-level proof of concept demonstrates the issue without requiring a full BGP session or a running `bgpd` instance. The malformed capability uses: - Capability Code: `65` (`BGP_CAP_FOUR_OCTET_AS_NUMBER`) - Declared `CapLen`: `0` - Four following bytes: `00 00 fd e8` Although the capability declares an empty value, affected versions parse the following four bytes as the 4-octet AS value `65000`. ### Impact A remote peer that can send a malformed BGP OPEN message to a GoBGP instance may cause capability values to be parsed from outside their declared `CapLen` boundaries. In the 4-octet AS capability case, this may affect: - peer AS validation; - capability negotiation; - interpretation of malformed OPEN messages; - acceptance or rejection decisions during BGP session establishment. This issue does not appear to be arbitrary memory corruption, remote code execution, or information disclosure. It is a protocol parser boundary validation issue that can affect BGP OPEN validation semantics.
CVSS v3.1
Score 5.9medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The GoBGP BGP OPEN capability parser improperly handles the declared capability length (CapLen) in several concrete capability decoders. Instead of restricting parsing to the declared CapLen, some decoders parse from the full remaining capability buffer, allowing malformed BGP OPEN messages to cause capability values to be read from outside their boundaries. A proof of concept shows that a 4-octet AS capability with CapLen set to zero can cause the parser to read the next four bytes as the AS number, potentially affecting peer AS validation and session establishment decisions. The issue is a protocol parser boundary validation flaw and does not result in arbitrary memory corruption, remote code execution, or information disclosure.
Potential Impact
A remote attacker able to send malformed BGP OPEN messages to a vulnerable GoBGP instance can cause the parser to read capability values beyond their declared length. This can affect peer AS validation, capability negotiation, and the interpretation of malformed OPEN messages, potentially influencing acceptance or rejection of BGP sessions. There is no indication of memory corruption, code execution, or data leakage from this vulnerability.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, carefully validate BGP OPEN messages and consider deploying network-level controls to restrict untrusted BGP peers. Monitor vendor channels for updates regarding patches or official fixes.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-gjrg-jjr3-56cm
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-49837"]
- Ecosystems
- ["Go"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
Threat ID: 6a50ba3c68715ace4357db13
Added to database: 07/10/2026, 09:24:12 UTC
Last enriched: 07/10/2026, 09:33:08 UTC
Last updated: 07/31/2026, 12:27:30 UTC
Views: 57
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.