CVE-2026-5122
Improper Access Control in GoBGP BGP OPEN Message Handler
Publication date: 2026-03-30
Last updated on: 2026-04-08
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| osrg | gobgp | to 4.4.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-266 | A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor. |
| CWE-284 | The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
There is no information provided in the available context or resources about how this vulnerability (CVE-2026-5122) affects compliance with common standards and regulations such as GDPR or HIPAA.
What immediate steps should I take to mitigate this vulnerability?
The primary mitigation step is to apply the patch that fixes the vulnerability in the GoBGP project. The patch corrects the parsing logic in the DecodeFromBytes function to properly respect the DomainNameLen field, preventing improper access.
If patching immediately is not possible, consider restricting or filtering BGP OPEN messages from untrusted sources to reduce the risk of exploitation.
- Update GoBGP to a version that includes the patch (post March 12, 2026, after pull request #3343 was merged).
- Implement network-level filtering to block malformed or suspicious BGP OPEN messages.
- Monitor logs and network traffic for signs of exploitation attempts.
Can you explain this vulnerability to me?
CVE-2026-5122 is a security flaw in the GoBGP project's handling of the CapFQDN (Capability Fully Qualified Domain Name) BGP attribute. The vulnerability exists in the DecodeFromBytes function, which incorrectly parses the DomainName field by consuming all remaining bytes in the buffer instead of respecting the declared DomainNameLen field. This improper parsing can cause the inclusion of unrelated trailing data in the domain name, leading to incorrect behavior or security issues.
The issue was fixed by modifying the parsing logic to correctly slice the DomainName string using the exact length specified by DomainNameLen, preventing buffer overreads or incorrect domain name extraction.
How can this vulnerability impact me? :
This vulnerability can lead to improper access controls due to incorrect parsing of domain names in BGP OPEN messages. An attacker could exploit this flaw remotely by manipulating the domainNameLen argument, potentially causing the system to process malformed or maliciously crafted domain names.
The impact includes incorrect domain name parsing which might result in unexpected behavior or data leakage. However, the attack complexity is high and exploitability is considered difficult.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability relates to improper parsing of the CapFQDN attribute in GoBGP versions up to 4.3.0, specifically in the DecodeFromBytes function. Detection would involve identifying if your GoBGP instance is running a vulnerable version and if malformed BGP OPEN messages with manipulated domainNameLen fields are being received or processed.
There are no specific detection commands or network signatures provided in the available resources. However, you can check the GoBGP version running on your system to determine if it is vulnerable.
- Check GoBGP version: `gobgp version`
- Monitor BGP OPEN messages for anomalies or malformed CapFQDN attributes using packet capture tools like tcpdump or Wireshark, focusing on BGP packets.
- Review GoBGP logs for errors or unusual behavior related to BGP OPEN message parsing.