osrg GoBGP up to 4.5.x BGP OPEN Capability Parser buffer overflow

Summaryinfo

A vulnerability marked as problematic has been reported in osrg GoBGP up to 4.5.x. This vulnerability affects unknown code of the component BGP OPEN Capability Parser. Performing a manipulation results in buffer overflow. This vulnerability was named CVE-2026-49837. The attack may be initiated remotely. There is no available exploit. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic has been found in osrg GoBGP up to 4.5.x. This affects an unknown code of the component BGP OPEN Capability Parser. The manipulation with an unknown input leads to a buffer overflow vulnerability. CWE is classifying the issue as CWE-120. The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow. This is going to have an impact on integrity. The summary by CVE is:

GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. Versions prior to 4.6.0 contain a BGP OPEN capability parsing issue where several concrete capability decoders may parse data from the full remaining capability buffer instead of the slice bounded by the declared capability length, `CapLen`. A malformed BGP OPEN message can cause bytes from a following capability to be interpreted as part of the current capability. The most security-relevant case is the 4-octet AS capability, where a capability with `CapLen == 0` may cause the parser to read bytes from the following capability as the 4-octet AS value. This parsed value may later affect peer AS validation during BGP session establishment. Version 4.6.0 patches the issue.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-49837 since 06/01/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Neither technical details nor an exploit are publicly available.

Upgrading to version 4.6.0 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• osrg

Name

• GoBGP

Version

• 4.0
• 4.1
• 4.2
• 4.3
• 4.4
• 4.5

Website

• Product: https://github.com/osrg/gobgp/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion