CVE-2026-49838
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
GoBGP, a BGP implementation in Go, prior to version 4.7.0 accepts a zero-length AS_PATH during UPDATE decoding and later panics while validating that attribute for a confederation eBGP peer. A malformed UPDATE that should be rejected as an invalid AS_PATH reaches an unchecked p.Value[0] access, allowing a configured confederation eBGP peer to trigger a denial of service. Version 4.7.0 patches the issue.
Risk Assessment
A malicious or misconfigured confederation eBGP peer can trigger a panic and crash the GoBGP process, causing a BGP routing disruption.
Recommendation
Update GoBGP to version 4.7.0 or later. Limit trust to confederation eBGP peers to the necessary minimum.
Other vulnerabilities in GoBGP
See all- CVE-2026-37461High
An out-of-bounds read in the ParseIP6Extended function in gobgp v4.3.0 allows attackers to cause a Denial of Service (DoS) by supplying a crafted BGP UPDATE message.
- CVE-2026-49837Medium
GoBGP, a BGP implementation in Go, prior to version 4.6.0 has a BGP OPEN capability parsing issue where several capability decoders may read from the full remaining capability buffer instead of the slice bounded by the declared CapLen. A malformed BGP OPEN message can cause bytes from a following capability to be interpreted as part of the current one; the most security-relevant case is the 4-octet AS capability, where CapLen == 0 may cause the parser to read bytes from the following capability as the 4-octet AS value. This parsed value may later affect peer AS validation during BGP session establishment. Version 4.6.0 patches the issue.
- CVE-2026-37462High
An integer underflow in the BGPUpdate.DecodeFromBytes function (/bgp/bgp.go) of gobgp v4.3.0 allows attackers to cause a denial of service by sending a crafted BGP UPDATE message.
- CVE-2026-42285High
In version 4.4.0 of GoBGP, an unauthenticated remote BGP peer can trigger a fatal panic by sending a specially crafted BGP UPDATE message. This bug causes the entire GoBGP process to crash, resulting in a complete loss of service availability.
- CVE-2026-41643High
GoBGP, an open source implementation of the BGP protocol in Go, prior to version 4.3.0 has a remote Denial of Service (DoS) vulnerability. A malformed BGP UPDATE message can trigger a runtime error related to an index out of range.
- CVE-2026-41642High
In version 4.3.0 of GoBGP, an open source BGP implementation, a remote Denial of Service (DoS) vulnerability exists due to a nil pointer dereference. A malformed BGP UPDATE message containing an unrecognized Path Attribute marked as 'Well-known' leads to a process crash.
- CVE-2026-7737Medium
A vulnerability was identified in osrg GoBGP up to 4.3.0 in the BMPPeerUpNotification.ParseBody and BMPStatisticsReport.ParseBody functions of pkg/packet/bmp/bmp.go (BMP Parser component). Manipulation of data leads to an out-of-bounds read, and the attack can be initiated remotely. The fix is available in version 4.4.0 (commit bc77597d42335c78464bc8e15a471d887bbdf260).
- CVE-2026-7734Medium
A vulnerability was found in osrg GoBGP up to 4.3.0 in the SRv6L3ServiceAttribute.DecodeFromBytes function of pkg/packet/bgp/prefix_sid.go (SRv6 L3 Service component). Manipulation of the data argument leads to denial of service, and the attack can be performed remotely. The fix is available in version 4.4.0 (commit f9f7b55ec258e514be0264871fa645a2c3edad11).
Original NVD description (English source)
GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. Prior to version 4.7.0, GoBGP accepts a zero-length AS_PATH during UPDATE decoding and later panics while validating that attribute for a confederation eBGP peer. The vulnerable path is in the BGP UPDATE validator: a malformed UPDATE that should be rejected as a malformed AS_PATH instead reaches an unchecked `p.Value[0]` access, allowing a configured confederation eBGP peer to trigger a denial of service. Version 4.7.0 patches the issue.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS