BGP OPEN Capability Parsing Issue in GoBGP by OSRG

CVE-2026-49837

What is CVE-2026-49837?

GoBGP, an open source implementation of the Border Gateway Protocol (BGP) built in Go, has a vulnerability concerning its BGP OPEN message capability parsing. In affected versions earlier than 4.6.0, certain capability decoders may improperly read data beyond the designated slice length, allowing maliciously constructed BGP OPEN messages to impact the handling of existing capabilities. Specifically, a crafted payload could lead to the misinterpretation of data, particularly relating to 4-octet AS capabilities. This misparsing could result in vulnerabilities in peer AS validation during BGP session setups, underscoring the importance of updating to version 4.6.0, which addresses this flaw.

References