CVE-2026-49838

Received Received - Intake

Denial of Service in GoBGP due to AS_PATH Validation Flaw

Publication date: 2026-09-10

Last updated on: 2026-09-10

Assigner: GitHub, Inc.

Description

GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. Prior to version 4.7.0, GoBGP accepts a zero-length AS_PATH during UPDATE decoding and later panics while validating that attribute for a confederation eBGP peer. The vulnerable path is in the BGP UPDATE validator: a malformed UPDATE that should be rejected as a malformed AS_PATH instead reaches an unchecked `p.Value[0]` access, allowing a configured confederation eBGP peer to trigger a denial of service. Version 4.7.0 patches the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-10

Last Modified

2026-09-10

Generated

2026-09-11

AI Q&A

2026-09-11

EPSS Evaluated

N/A

NVD

CVE-2026-49838

Affected Vendors & Products

Vendor	Product	Version / Range
go_bgp	go_bgp	4.7.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-129	The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.

Attack-Flow Graph

Executive Summary

GoBGP before version 4.7.0 has a flaw where it accepts a zero-length AS_PATH during BGP UPDATE decoding. This causes a panic when validating the attribute for a confederation eBGP peer. The issue lies in the UPDATE validator, where a malformed UPDATE should be rejected but instead triggers a denial of service due to an unchecked array access.

Detection Guidance

This vulnerability can be detected by checking the GoBGP version in use. If your system runs GoBGP versions prior to 4.7.0, it is vulnerable. Run: go version or check the GoBGP binary version. Monitor BGP UPDATE messages for malformed AS_PATH attributes that may cause crashes.

Impact Analysis

This vulnerability allows a remote attacker to crash the GoBGP service by sending a malformed BGP UPDATE message. This results in a denial of service, disrupting BGP routing operations and potentially causing network instability.

Mitigation Strategies

Upgrade GoBGP to version 4.7.0 or later immediately. Apply patches if available. Restrict access to BGP peers to trusted sources only. Monitor BGP UPDATE messages for anomalies and implement strict validation rules for AS_PATH attributes.

Hi! I’m here to help you understand CVE-2026-49838. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70