CVE-2026-49837: GoBGP BGP OPEN Capability Parser Vulnerability
Summary
CVE-2026-49837: GoBGP: BGP OPEN capability parser may read capability values outside declared CapLen boundaries in github.com/osrg/gobgp. Affects github.com/osrg/gobgp/v4 versions < 4.6.0. Fixed in 4.6.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
GoBGP is an open-source implementation of the Border Gateway Protocol (BGP) used for routing data across the internet. It is designed to be flexible and extensible, allowing users to manage BGP sessions and configurations effectively. The package is widely used in network applications and services. However, it has been identified that the BGP OPEN capability parser may read capability values beyond the declared CapLen boundaries, leading to potential security risks.
Vulnerability Detail
The vulnerability arises from the BGP OPEN capability parser in GoBGP, which may incorrectly read capability values outside the specified CapLen boundaries. This flaw can lead to unexpected behavior, including potential memory corruption and denial of service. Attackers could exploit this vulnerability to manipulate BGP messages, potentially affecting network stability and security. The issue is particularly critical as it can compromise the integrity of routing information exchanged between BGP peers.
How To Fix
Latest published version: v4.10.0 as of 22 Oct 2026
go get github.com/osrg/gobgp/v4@v4.10.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.6.0
This is the first release that contains the fix.
go get github.com/osrg/gobgp/v4@v4.6.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you may consider implementing additional validation checks on the capability values before processing them. However, this is not a substitute for updating to the patched version.
Conclusion
In summary, CVE-2026-49837 is a critical vulnerability in the GoBGP package that affects the BGP OPEN capability parser. Users are strongly advised to update to version 4.6.0 or later to mitigate the risks associated with this vulnerability. Temporary workarounds may be implemented, but they should not replace the need for an update.
See every vulnerability recorded for github.com/osrg/gobgp/v4 →
FAQ
The impact includes potential memory corruption and denial of service, which could lead to compromised network stability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
If immediate updates are not possible, consider implementing validation checks as a temporary workaround.
While the primary risk is related to network stability, there could be indirect risks to data integrity if routing information is manipulated.
More information about GoBGP can be found on its official GitHub repository and documentation.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/osrg/gobgp/v4.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.