CVE-2026-49837: GoBGP BGP OPEN Capability Parser Boundary Issue
Summary
CVE-2026-49837: GoBGP: BGP OPEN capability parser may read capability values outside declared CapLen boundaries. Affects github.com/osrg/gobgp/v4 versions < 4.6.0. Fixed in 4.6.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GoBGP is an open-source implementation of the Border Gateway Protocol (BGP), which is essential for routing data across the internet. It is designed to be highly extensible and supports various features, including 4-octet AS numbers. The package is widely used in network environments for managing BGP sessions. However, it is susceptible to a vulnerability in its BGP OPEN capability parser that can lead to improper parsing of capability values.
Vulnerability Detail
The vulnerability arises from a flaw in the BGP OPEN capability parsing logic within GoBGP. Specifically, certain capability decoders may read data beyond the declared CapLen boundaries, allowing a malformed BGP OPEN message to cause bytes from subsequent capabilities to be misinterpreted as part of the current capability. This can lead to incorrect peer AS validation and potentially affect BGP session establishment. The issue is particularly concerning for the 4-octet AS capability, where a declared CapLen of zero could result in the parser reading unintended bytes, impacting the integrity of BGP operations.
How To Fix
Latest published version: v4.10.0 as of 22 Oct 2026
go get github.com/osrg/gobgp/v4@v4.10.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.6.0
This is the first release that contains the fix.
go get github.com/osrg/gobgp/v4@v4.6.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. The best course of action is to update to the patched version as mentioned above.
Conclusion
In summary, CVE-2026-49837 presents a significant vulnerability in the GoBGP package that can lead to improper parsing of BGP OPEN capabilities. Users are strongly advised to update to version 4.6.0 or later to mitigate the risks associated with this issue.
See every vulnerability recorded for github.com/osrg/gobgp/v4 →
FAQ
CVE-2026-49837 is a vulnerability in the GoBGP package that affects the BGP OPEN capability parser, allowing it to read capability values outside declared boundaries.
The vulnerability can lead to incorrect peer AS validation and affect BGP session establishment, potentially compromising network routing integrity.
You can use Vulert's playground at Vulert Scanner to monitor and alert for open-source vulnerabilities in your software without needing to sign up.
The CVSS score for this vulnerability is 5.9, indicating a moderate severity level.
Yes, the vulnerability has been fixed in version 4.6.0 of the GoBGP package. It is recommended to update to this version.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/osrg/gobgp/v4.
