Denial of Service Vulnerability in GoBGP Open Source Implementation

CVE-2026-49838

What is CVE-2026-49838?

GoBGP, an open source Border Gateway Protocol (BGP) implementation written in the Go programming language, allows the acceptance of a zero-length AS_PATH during UPDATE decoding prior to version 4.7.0. This flaw results in an unchecked access during the validation of attributes for a confederation eBGP peer, which can lead to a denial of service. The problem arises in the BGP UPDATE validator where malformed UPDATE messages that should be correctly rejected can cause the service to panic, affecting the stability of network operations. Users are encouraged to upgrade to version 4.7.0 or later to mitigate this issue.

References