CVE-2026-49837

Received Received - Intake

BGP OPEN Capability Parsing Issue in GoBGP

Publication date: 2026-09-10

Last updated on: 2026-09-10

Assigner: GitHub, Inc.

Description

GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. Versions prior to 4.6.0 contain a BGP OPEN capability parsing issue where several concrete capability decoders may parse data from the full remaining capability buffer instead of the slice bounded by the declared capability length, `CapLen`. A malformed BGP OPEN message can cause bytes from a following capability to be interpreted as part of the current capability. The most security-relevant case is the 4-octet AS capability, where a capability with `CapLen == 0` may cause the parser to read bytes from the following capability as the 4-octet AS value. This parsed value may later affect peer AS validation during BGP session establishment. Version 4.6.0 patches the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-10

Last Modified

2026-09-10

Generated

2026-09-11

AI Q&A

2026-09-11

EPSS Evaluated

N/A

NVD

CVE-2026-49837

Affected Vendors & Products

Vendor	Product	Version / Range
go_bgp	go_bgp	to 4.6.0 (exc)
go_bgp	go_bgp	4.6.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

GoBGP versions before 4.6.0 have a BGP OPEN capability parsing flaw where decoders may read beyond the declared capability length, causing malformed messages to incorrectly parse data from adjacent capabilities. This can lead to invalid AS values being used in peer validation during BGP session setup.

Impact Analysis

An attacker could send a crafted BGP OPEN message to manipulate AS values, potentially allowing unauthorized BGP sessions or route advertisements. This may disrupt network routing or enable man-in-the-middle attacks on BGP traffic.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a BGP OPEN capability parsing issue in GoBGP that could lead to incorrect AS number interpretation during BGP session establishment. Compliance impacts would only occur if this vulnerability caused unauthorized data access or network disruption, which is not described in the provided context.

Mitigation Strategies

Upgrade GoBGP to version 4.6.0 or later to patch the BGP OPEN capability parsing issue.

Hi! I’m here to help you understand CVE-2026-49837. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70